*Ring* It's the telephone.

“Hello?” I say tentatively.

“We are calling from your bank. We are updating the security on all our debit cards. We need to verify some information.”

Alarm bells are going off all over in my head already.

“You called me. I don’t know who you are.” I say.

“Oh, we are sending you an SMS from Abu Dhabi police. That should verify us,” they say breezily.

"Why is the Abu Dhabi police sending messages for a bank?” I wonder. But the other person is rattling off stuff and not giving me time to think. I check the phone and sure enough, there’s an SMS from “ADPolice” (“That can be anyone, or even spoofed,” my mind counters …)

I decided to play along for a little while longer and see what happened.

“OK, I got the SMS,” I say.

“See? That verifies that I am who I said, I am,” the guy says enthusiastically. “Can you verify your card number? The first digits are … “ He reads out the first few digits, which I knew would be common and well-known.

So I should probably have hung up at this point. Or, better still in hindsight, given a fake set of numbers for the card to see if they accepted it. If they accepted the fake number, then they can’t be from the bank, right?

I didn’t think of that though. But I figured they already had my card number and so gave them the number. Then they ask for the expiration date and I provide that too.

“Thank you. I’m transferring you over to my supervisor now,” he says.

Another guy, more brusque and officious sounding comes on.

“We are upgrading the card security since you might have used the card at a mall or online,” he says. This makes no sense at all to me. Everybody uses cards online etc. Do they upgrade security each time.

“OK.” I say.

“Can you read me the number on the back of your card for verification purposes?” he asks.

I know that this is as far as I can go. I say, “No.”

He says, “Why not?”

“You might be a scammer. I get lots of fake calls”.

“Yes, there are fake calls, but this is real,” he counters. “I’ll send you an SMS from the government to prove it,” he continues.

I get an SMS from a government site asking me to verify a transaction for 1 AED. This is not a verification, just somebody trying to get me to pay them 1 AED. Again, not very bank-like.

I ask further questions, but the guy starts getting loud and obnoxious, repeating the same things he’d said before.

“Don’t yell at me!” I say. He gets quieter, but still demands information, saying that the bank has all my info and that they just need to verify it. I realize that this is not going any further and hang up.

They call again 6 - 7 times. I know a bank would never do that. They’d simply move on to the next customer, not that calling each customer individually to verify is what they’d do in a situation like this anyway …

So, the moral of the story, don’t give away any info at all. And provide fake info if you suspect it’s a fake/fraud call. If they don’t recognize that the info is fake, then they aren’t who they say they are …

#UAE #Scammers #FakeCalls #CreditCardPhishing #Fraudsters

[IOC] Some new indicators (4) are available for FakeCalls https://vuldb.com/?actor.fakecalls #fakecalls #apt #cti #ioc