When you receive a phone call from your bank, it may not be what it seems. Thanks to a new scam tactic, a call from someone claiming to be at your bank may actually be a ruse.
Pieter Gunst, who is an attorney who specializes in technology law, was almost a victim of this scam, and he took to Twitter to explain what happened and warn others not to fall for the same ploy.
First, he got a call from someone pretending to be from his bank and asking if he’d made a charge in another city. When he denied the purchase, the person said they would “block” the transaction and asked for his member number. Because the person was asking for a member number, not a bank account number, you might be more inclined to think it’s safe. But as Gunst explains, that would be a mistake.
Next, the scammer told him that they’d send a verification PIN to his phone, and asked him to read it back to them. The PIN appeared to come from his bank’s real number:
3) "We've sent a verification pin to your phone."
~ Gets verification pin text from bank's regular number ~
Me: <reads out the pin>
— Pieter Gunst (@DigitalLawyer) October 7, 2019
Then, they asked him to verify some other, legitimate transactions, and he did:
4) "Ok. I am going to read some other transactions, tell me if these are yours. ~ Reads transactions ~"
Me: Yes. These are all legitimate transactions I made
— Pieter Gunst (@DigitalLawyer) October 7, 2019
Then, they asked for his personal identification number, or PIN, which made Gunst realize something was not right:
5) "Thank you! We now want to block the pin on your account, so you get a fraud alert when it is used again. What is your pin?"
Me: Are you effing kidding me, no way.
— Pieter Gunst (@DigitalLawyer) October 7, 2019
Gunst then contacted the fraud department of his bank to report the incident:
6) Ok! But than we can't block your card
Me: that is bs.
~ hangs up, calls the fraud department of bank ~
— Pieter Gunst (@DigitalLawyer) October 7, 2019
He explained that the verification PIN was a way for the scammer to reset his password and gain access to his account:
–> Once I gave my member number, the attacker used the password reset flow to trigger a text message from the bank.
–> They used this to gain access to the account.
–> Then read some of my transactions to give the call more credibility— Pieter Gunst (@DigitalLawyer) October 7, 2019
Because he would not give his PIN, their plan was foiled. But he noted that everything that happened before that seemed legitimate, causing him to almost fall for the scam:
–> Needed the pin to send money, failed at that step.
–> Everything before the "what is your pin" seemed totally legitimate. English was perfect. The bank verification code, sent by the expected number, tricked me.
–> The asking for my pin over the phone… not so much.— Pieter Gunst (@DigitalLawyer) October 7, 2019
He’s using the incident to motivate him to be extra vigilant going forward and urging others to do the same:
Stay safe out there people.
And now… joyfully resetting all my passwords, filing a police report, getting additional fraud detection in place.
Never a dull moment!
— Pieter Gunst (@DigitalLawyer) October 7, 2019
“I learned a lot,” Gunst told CBC Radio of the experience. “The easiest way to block would have been as I received a call, say, ‘Thank you, I will call you back on the number on my card.’ And that would essentially have stopped the attack.”
“The second mistake was giving that member number,” he added. “Just don’t give personal information to a caller, regardless of who they say they are.”
The Federal Trade Commission’s consumer advice for phone scams is pretty much the same: Don’t give up personal information to a caller.
The FTC also recommends reporting scams to them and joining the Do Not Call Registry.
This story originally appeared on Don't Waste Your Money. Checkout Don't Waste Your Money for product reviews and other great ideas to save and make money.
