9

Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention: someone tried to charge $600 through Amazon. He asked me to verify that I had the card in hand by providing him the CVV (3-digit number on back of card). If I have the card and it should be enough that I state this. He gently threatened that the card would be suspended and I agreed that it was OK to cancel the card.

I refused to provide the CVV because if I do not know who is calling and I do not give out sensitive info. As I understand it, caller ID is easily faked with an App.

Red flags include asking 3 times for the CVV and trying to convince me that the phone number is proof of identity.

QUESTIONS

  • Does the CVV enable escalation privilege (change address / phone / email)
  • What are the 3 most common techniques for the phisherman to gain my name, phone-number and 4 digits of my credit card?
  • Is it reasonable to assume that he has all 16 digits since he is asking for the CVV (time to change the card number).
  • If caller found a receipt with my name, how difficult would it to acquire my phone number?
10

Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention

That looks like a legit number for State Farm Bank but, rather critically, phone numbers can be spoofed. The same goes for the sending number for SMS. The caller ID you see on screen is an arbitrary text field that can be overridden when a call is placed - this is very commonly used to provide a general call-back number instead of the direct phone number of the operative in a call center.

I refused because if I do not know who is calling and I do not give out sensitive info.

Good. If the "bank" calls you, you should always ask for their name and a reference number if they have one, then tell them you will call the bank back on their advertised phone number. Banks will always be fine with you doing this; most scammers will get upset or annoyed at you and try to persuade you not to hang up. Never give any kind of sensitive information to someone who called you, no matter what their provided reason is. You call them, they don't call you.

As far as I'm aware your bank shouldn't usually ask for your CVV for verification. Check emails from your bank as they usually have boilerplate security advice (e.g. "we will never call you directly" or "we will never ask for card details") that can quickly indicate that the call was bogus.

In fact your first action should be to call your bank's fraud department, via their advertised number, and ask if they just tried to contact you. You should then ask them to read back your recent transactions to make sure if there was any unusual activity.

Does the CVV enable escalation privilege (change address / phone / email)

Assuming the scammer has your full CC number and personal details except the CVV from a compromised website, providing the CVV would enable them to make purchases online. The CVV isn't much use aside from that.

What are the 3 most common techniques for the phisherman to gain my name, phone-number and 4 digits of my credit card?

This is subjective and open to opinion, but in my experience:

  1. A website that you provided your card details and personal information to was compromised.
  2. You were infected with malware and it stole your details when you entered them into a site.
  3. You unwittingly clicked a phishing link and provided your login details (e.g. for your bank, a retail site, your work's HR system, etc.) to an attacker, and they used that to get your details.

The first one is by far the most common from what I've seen. Another potential is that you had your card's magstrip skimmed at an ATM or at a restaurant, cafe, store, etc. and they got your card number and name from that but not the CVV (it's not usually encoded in the magstrip afaik), and they used OSINT to find your number to ask you for the CVV.

Is it reasonable to assume that he has all 16 digits since he is asking for the CVV (time to change the card number).

Yes.

If caller found a receipt with my name, how difficult would it to acquire my phone number?

Depends. This is all down to OSINT really. If you've listed your number on Facebook, for example, they might have found it there, particularly if you've got your privacy settings configured to allow friends of friends to see it. They could've gone the old fashioned way looked you up in the phone directory. They might have found your card details and email address on one compromised site, and your email address and personal details on another compromised site. There are any number of ways.

  • Is this correct? OSINT = open source intelligence. Excellent response – gatorback Feb 1 '18 at 17:48
  • @gatorback Yes. Sorry, I should've explained that one. – Polynomial Feb 1 '18 at 17:50
  • @gatorback As another note, if you've had prior experiences with the bank's fraud team you can use them as a comparison. For example, my bank always sends a text message asking me to confirm yes/no if I placed a suspicious transaction - they never call me first without me indicating that fraud took place. Of course this is still something that can be abused by faking text messages, so you should always contact the fraud number advertised on the bank's website rather than trusting the number sent to you via SMS, but if there was no text first I immediately know it's a scam. – Polynomial Feb 1 '18 at 17:54
  • 2
    "tell them you will call the bank back on their advertised phone number." If this is a land-line and you call the bank back, use a different phone line, call a friend/colleague first to verify line operation or wait a few hours before doing so. Some banking scams involve the caller holding the line open and simulating a dialling tone etc. – RedGrittyBrick Feb 1 '18 at 19:41
  • @RedGrittyBrick Very good point, I had forgotten about that trick! – Polynomial Feb 1 '18 at 22:42
6

Too long for a comment, but--

I've noticed with two different credit unions I've been a member of, when fraud prevention comes calling it's been a very uncomfortable situation. The job seems to be outsourced, so if you ask what institution they're calling from they'll just tell you something generic like "card services" while refusing to name your bank. Then they ask for a suspicious amount of information off your card and to verify recent transactions, which sends up every red flag in the book.

I refused to play, then called the number on the back of the card, and there was in fact a flagged transaction that needed review. It turned out to be a legit call! Absolutely terrible practice. By contrast when American Express or Capital One have called in the past, all they wanted to know was whether or not I authorized a transaction for ___ with no other questions asked.

You did good in not playing along. Even if it's legit, we shouldn't normalize such terrible practices. I think in the case of call centers servicing multiple clients, they can't look up flagged transactions without you providing some amount of card information (whereas American Express' fraud prevention team already has your card info).

But asking for CVV seems really shady to me and has nothing to do with validating a swipeless purchase-- whether you physically have the card or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.