Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention
That looks like a legit number for State Farm Bank but, rather critically, phone numbers can be spoofed. The same goes for the sending number for SMS. The caller ID you see on screen is an arbitrary text field that can be overridden when a call is placed - this is very commonly used to provide a general call-back number instead of the direct phone number of the operative in a call center.
I refused because if I do not know who is calling and I do not give out sensitive info.
Good. If the "bank" calls you, you should always ask for their name and a reference number if they have one, then tell them you will call the bank back on their advertised phone number. Banks will always be fine with you doing this; most scammers will get upset or annoyed at you and try to persuade you not to hang up. Never give any kind of sensitive information to someone who called you, no matter what their provided reason is. You call them, they don't call you.
As far as I'm aware your bank shouldn't usually ask for your CVV for verification. Check emails from your bank as they usually have boilerplate security advice (e.g. "we will never call you directly" or "we will never ask for card details") that can quickly indicate that the call was bogus.
In fact your first action should be to call your bank's fraud department, via their advertised number, and ask if they just tried to contact you. You should then ask them to read back your recent transactions to make sure if there was any unusual activity.
Does the CVV enable escalation privilege (change address / phone / email)
Assuming the scammer has your full CC number and personal details except the CVV from a compromised website, providing the CVV would enable them to make purchases online. The CVV isn't much use aside from that.
What are the 3 most common techniques for the phisherman to gain my name, phone-number and 4 digits of my credit card?
This is subjective and open to opinion, but in my experience:
- A website that you provided your card details and personal information to was compromised.
- You were infected with malware and it stole your details when you entered them into a site.
- You unwittingly clicked a phishing link and provided your login details (e.g. for your bank, a retail site, your work's HR system, etc.) to an attacker, and they used that to get your details.
The first one is by far the most common from what I've seen. Another potential is that you had your card's magstrip skimmed at an ATM or at a restaurant, cafe, store, etc. and they got your card number and name from that but not the CVV (it's not usually encoded in the magstrip afaik), and they used OSINT to find your number to ask you for the CVV.
Is it reasonable to assume that he has all 16 digits since he is asking for the CVV (time to change the card number).
If caller found a receipt with my name, how difficult would it to acquire my phone number?
Depends. This is all down to OSINT really. If you've listed your number on Facebook, for example, they might have found it there, particularly if you've got your privacy settings configured to allow friends of friends to see it. They could've gone the old fashioned way looked you up in the phone directory. They might have found your card details and email address on one compromised site, and your email address and personal details on another compromised site. There are any number of ways.