I had an unusual experience yesterday: a call from a scammer claiming to be from my bank.
Because the caller ID showed the correct name, I was initially taken in.
They claimed that there had been a suspicious transfer from my bank account via online banking, and that they had blocked it. They then asked about how I use online banking—from what devices—and suggested that one of these must have been hacked.
They also asked my branch address, which I gave them. I’m not sure if they transferred the call or I was called back, but—it shows up in my phone as a call from my branch’s public phone number.
It was when they tried to get me to install a “support app” on my phone that I became suspicious, asking for more information.
I asked for the account number of the account with the issue, and they made up a number—it didn’t match anything I recognized. I asked for the address associated with the account—and they had a wrong, out of date, address for me.
So I said I’d have to check and call back and they said that was fine.
Checking the account number they’d given against my list of accounts, there definitely was no match.
I then verified that the phone number in my phone’s call history matched the public number of my branch, and “called them back”.
The person I spoke to was obviously a little confused—but helpful. They put me on hold while they looked for the right person to transfer me to.
While I was on hold I got another call, so I hung up and took that one. I assumed it was the “right person to transfer to” at the bank; in fact it was a colleague of the scammer.
This time I was better prepared. I pushed them about the account number; they were evasive.
They wanted me to install an app; I got the name: “quicksupport”.
I asked for confirming details such as the name of my contact at the bank; of course, they couldn’t give any.
At this point I was convinced they were scammers, and said so.
They made one last ditch effort: they said that my account would be blocked for 30 days, and asked if I was okay with that. That convinced me. I replied, sure, I should spend less money anyway; and hung up.
I then called my bank directly for a second time, this time getting through to someone who could confirm there had been no real call from the bank, and there were no issues with my account.
There turned out to be some minor cleanup needed; because I called my real bank, they wanted to reset my credentials and block my cards. I pointed out that the scammers didn’t actually get any critical information for me, so there was no need. They wanted to confirm that I hadn’t installed any apps or clicked on any links; I hadn’t.
I ended up talking to the online banking support team; they confirmed with their IT team that there was indeed no need to take any action related to my account, and the case was closed.
Well, I learned that caller ID can be spoofed in this country; I had somehow been under the impression that it could not be. Useful to know.
I also learned from my bank that it’s impossible to get a call from their public number—it’s “receive only”. Also good to know.
I got to experience two types of unusual phone conversation: first, where one of the participants is outright lying; and second, where one of the participants is unintentionally relaying false information.
This type of information mismatch makes for good fiction, but it’s unusual to experience first hand. Since no harm was done I can find something to appreciate there—it cost me some hours, but I did get something out of it. Funnily enough the half an hour spent following up with the bank to make sure they didn’t block my account seems like time less well spent than the time speaking to scammers.
I’ve also had calls from the “we are Microsoft tech support and we need to fix your PC” type of scammer, but these I recognized immediately. My answer: “I don’t have a PC”.
On the whole, people trying to sell me insurance and people who want to ask me questions for a survey are more hassle than the scammers, because there are so many more of them.
So far today, 2023-06-16, feedback has been received 111 times. Of these, 102 were likely from bots, and 9 might have been from real people. Thank you, maybe-real people!
———
/ \ i a
| C a \ D n |
irc \ /
———