You receive a call on your phone.
The caller says they're from your bank and they're calling about a suspected fraud.
"Oh yeah," you think. Obvious scam, right?
The caller says "I'll send you an in-app notification to prove I'm calling from your bank."
Your phone buzzes. You tap the notification This is what you see.
Still think it is a scam?
1/3
The scammer is on the phone to you.
Their accomplice is on the phone to your bank, pretending to be you.
Your bank send you the notification.
You accept, and scammers proceed to drain your account.
Someone has just lost £18,000 because of this.
https://www.reddit.com/r/UKPersonalFinance/comments/1cih3kd/been_scammed_over_18000_through_my_chase_account/
2/3
It *is* a genuine notification. But it isn't confirming the bank is calling you.
Should the bank word that differently?
In a rush, would you read it thoroughly?
Most likely, in a panic about the fraud, you'd confirm it was a genuine notification (it is!) and accept it.
3/3
@gunchleoc @flabberghaster @simonwood @Edent been there; done that. "no. you rang me out of the blue. i have no idea who you are, so before i provide any of my information to you, why don't you provide me some information about me? "we can't do that sir."
fine. bloop. just hang up immediately. they never ring back.
@flabberghaster @simonwood @Edent
Indeed. They should, probably, do it like the good banks send mails: plaintext notification, no link at all, just an info - there is an important message in your Internet banking inbox, go there and fetch it.
So even the call may be initiated in a way - hello, this is your bank, we need to talk to you immediately because of "reason without details" (e.g. there was a suspicious transaction we want to xcheck with you), please contact our telebanking number to proceed.
Wow! What’s your number, again?
@philip @Edent It could add the number and the question "DID YOU CALL US?"
Edit: it just occurred to me that they could also spoof your own number to the bank, no? So that might not be helpful at all and may be misleading.
And other than that, do not assume any incoming call asking for any info is legit. Other than your significant other asking whether you fed the cat.
A few years back the boss of the local credit union in my town got nicked and sent to prison for fraud/stealing customer data and funds, he was only caught because the main bank they use for the electronic transactions noticed suspicious activity and went over his head to cops. The credit union has since been taken over by the local Council.
@vfrmedia @Edent @derickr previously, she twigged to the scam in time to call her bank and raise a red flag. It was super inconvenient to change out her account numbers and logins, but nothing was stolen.
We were all mystified when, months later, a scammer pretending to be from her actual bank (again: a tiny credit union, not Chase) almost got to her. I'm realizing now that they knew which bank to mimic from that earlier scam.
The title of the family group chat is now "urgency+money=fraud"
@Edent I feel like the notification would be better used for warning you about the purpose of the call. "are you on the phone with us right now RE your requested money transfer" would be more accurate.
Also, I'm not sure how it works with this bank, but with mine I need to approve transactions to new recipients with a physical card reader that asks for a ref no and the transfer amount. That would nix this scam.
@Edent I think it’s just not possible for the average person (or maybe anyone) to evaluate these situations correctly. It’d be better for people to have a blanket rule *never* to trust any incoming call from a business under any circumstances. Hang up the phone, find the number of the business through some trusted channel, and call them back. Don’t try to suss out whether the call is legitimate.
It’s surprising to me that businesses that ought to know better are training people to do exactly the wrong thing. I got a text message from Citibank recently about suspected fraud, asking me to call a phone number they provided. I ignored that number and called the number I found in their app. After working my way through the phone tree, I eventually made my way to the fraud department, where they proceeded to ask me a bunch of questions about sensitive information. It turns out the text message was legitimate, and Citibank expected me to call them at a number that arrived at my phone unsolicited and hand over a bunch of sensitive information.
Citibank’s own fraud protection page warns you of this exact scenario: “Named for SMS (Short Message Service), the technology used for cell phone text messaging, SMiShing messages appear to be from a legitimate company and typically contain a link that takes you to a spoof website or asks you to call a phone number.”
@Edent If I was lucky, I would've noticed that it's kinda strange that the person on the phone said they'd show a notification to prove it's them, while the notification is asking me to prove it's me.
But the person on the phone could just phrase it differently, something like "for security reasons, we have to verify that we have reached the right person, you will receive a notification to confirm" and then I'd have no chance at all, I *am* on the phone with "Chase" after all
Well if it was my bank calling I'd be suing them for disability discrimination for phoning me (deaf). I've already tried the Financial Ombudsman on NatWest over deafness and phone issues.
I've told my mum that even if she thinks the bank caller to her is legit. Hang up. Wait 10 mins. Look up the bank's number on a statement she has and use a different phoneline to initiate her own call.
Thanks for sharing how this scam works. I hadn't thought of the dual prong approach. Evil scammers
Wow a man-in-the-middle attack with a real life person actually in the middle! 😮
In cryptography, it's called "man-in-the-middle attack":
https://en.m.wikipedia.org/wiki/Man-in-the-middle_attack
@Edent "If someone called you and you did not call the bank, hang up and report fraud" at the beginning would help.
Directionality is important in this protocol and needs to be of prime importance.
Somewhere on that page it should say that the bank will never call you and ask you to accept this.
Not even in a drunken stupor. I’d hang up, block & call my bank.
@Edent so Scam-2 is on the phone with the bank and gets the bank to send the notification before Scam-1 or 2 have any of your card details. how the hell did S2 convince the bank to do that? sure, the notification came in legit, but what convinced the bank S2 was you at that stage to send the notification? did the bank just test a phone number? it sounds... improbable.
after that it's all sorts of dumb. 12 digits... nah. CVV and 12 digits... you kidding?
i still can't get to why the notification was sent. okay, a phone number not hard, people have those everywhere. but a bank would never simply use that as authentication. first pet name, anyone?
honestly the whole thing sounds like BS, or the guy in question was d-u-m-b dumb. perhaps both. why did the bank send the original notification? was this guy's whole life available online? xfer money instead of lock the account? sounds like he was scammed and has made up a "they were so good" story to save face.
I think this is another reason why I bank at a small local credit union. I get text notifications and phone calls occasionally that warn me that my Chase or other big bank account may have been breached, and I get to know 100% its a scam, because I don't have an account at a major bank. I think the perpetuators of this particular scam would be hard pressed to spoof my bank.
@Edent I think we need to become really stupid and stubborn, because smart is not going to help. They’ve thought it through.
1. If they call you, hang up, find the number yourself, call back. Even for probably genuine calls. Make it a habit.
2. The only thing that might be happening now, in real time, in a rush, is a scam. There is never a rush.
I wonder will this advice continue to hold.
Terence Eden
Simon Wood
flabberghaster
GunChleoc
Paul McO'Smith III
Ľuboš Moščovič 
Olivier Mengué
Stuart McHattie 👨🏼💻
AlisonW ♿🏳️🌈♾️
Aleggra
stephen
Amanda Bee
Philip Mallegol-Hansen
sahqon
Led By Gilded Fools
Derick Rethans
Alex@rtnVFRmedia Suffolk UK
Mélani (Melanie) Bjornsdottir (she, ŝi)
Verđandi K Soldusty
dinosaurdigger
LonM
Keith Ivey
Jennifer
Chris Johnson
mort
lp0 on fire 
NatalyaD
Chris Martin
Dan McDonald
gram
Tristan Slominski
Pass the Dutchie
ferricoxide
Ariaflame
Tilo
MarkS
Bindestrich
Joe Hill 🇵🇸🇺🇦
mal3aby
John Mark Ockerbloom
Korny
Paul Richards
Houston Bova
Sue
tptigger
Mark
Keith Mann