How to distinguish between a scam and a genuine call?

Question

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank.

• The bank number is hidden just like many other companies maybe because they use VOIP to make calls or they don't want you to ring them back on the number they call you from.

• The person I spoke to refused my proposal to mutual verification of our identities when I asked him to tell me my account number since all the information he revealed to know about me was my name and phone number which are available to the public.

Answer 1

If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up:

1. Name of the company/service the account is for.
2. What is the nature of the issue/offer the caller wants to discuss?
3. Is there a reference ID (e.g.: ticket #) for the call?
4. Name and/or agent ID of the caller.

Important: Throughout this process, you should not ever give the caller any more of your information. The main point here is to assume that someone calling you like this is an attacker, for the entire duration of the initial call.

Question #1 should be answered by the caller before you even have to ask. Be especially wary if it's not. My wife once argued for a good couple of minutes with someone calling from the "Account Services Department", before she finally handed the phone to me. When I interrupted the caller to ask "Account Services Department for whom?" the caller suddenly hung up.

After you've gotten all you can from the caller, hang up. Then, obtain legitimate contact information for the company from a reliable source (do not use any contact info given by the caller, without verifying it first).

Once you've got known-good contact information, call the company yourself and ask about your account's status. Use information obtained from the caller as needed, to reference the incident.

Answer 2

Ask for their extension, then call the bank back with a number you trust. Most office phone systems allow you to get directly to any employee if you know that employee's extension, so hanging up and calling the bank back will not take more than a few seconds. If you have been called on an old style landline you should phone back on a different phone line or mobile phone as the caller could have kept the phone line open, and give out a fake dial tone or use a different person/voice. This will ensure that you have in fact reached the bank, and once you've reached the employee, you should be able to tell in a couple of seconds if it's the same person.

Admittedly, this does not protect against the possibility of an insider threat at the bank. But if the bank has an insider gone rogue, you (and the bank) have bigger problems.

Answer 3

I worked at a call center that handled services for several banks. The person calling was likely following procedure when they didn't tell you your account number. Since phishing scams are common against banks it was a fireable offense to give any account number without the customer verifying who they were and even though they called you they are still not allowed to assume the person that answers is the one they are trying to reach. Usually, and ironically, one of the verification questions we asked the customer was for them to verify their account number.

The best way to verify them is to get some kind of claim, order or support number to reference back. Get the phone number from your banks website and call them back with the details they provided, if they have no such reference number available they likely have a note tied to your account. You could also call or visit a local bank branch and see if they know anything about the issue, but it was common they would not and request you call the support line anyways.

Answer 4

This does sound like a scam. Given the amount of big data breaches of late scammers have huge datasets they can parse through and create a targeted attack.

That being said, mutual authentication is a good action to perform as they will always have the data in their system. In addition I have never experienced a large organization VoIP system that does not route to real phone numbers.

In general it is best practice to always initiate the contact between you and your financial institution.

Answer 5

First of all, never give them any information that isn't available to the public until you are sure that they are real. In fact, if they called you, I would probably never give them any information, since they shouldn't be calling to collect that kind of information. Most legitimate banks will send you a letter and then ask you to come into the branch to update your information.

If you absolutely need to update the information over the phone, what you can do, is find out what they want to know, and then tell them you will call them back. Then call them back using the phone number that you find on their website, and give them the information that they need.

No bank will ever ask you for your bank account number or something like that. However, if they say something like "I want to make sure this is really you. Could you tell me your birth date?" Give them the wrong answer and see what they say. If they keep asking different things, keep giving them wrong answers. If they never mention that it is wrong, you know they are lying. Before you believe them though, make sure you give them a wrong answer to something only you and the bank would know, and they tell you its wrong. Birthday, Address, SIN/SSN, etc. can all be looked up; what the date of your last transaction or how many transactions you have made in the last month are much harder to find. NOTE: this is an imperfect system. Someone could still have potentially stolen that kind of information, however, if they have they probably already know everything about you that they need to...

tl;dr: Don't answer any questions from cold calls, either call them back or go in to see them face to face.

Answer 6

As above the best methods of verification include reference numbers/account information. However, I think it would be highly unlikely in most cases that your bank would ever directly ring you, perhaps only in the event of card fraud. In such event I would end the call and dial the bank from another number or at least verify the call had indeed been terminated.

A common scam in the UK is to dial a person using a landline telephone and inform them to call their bank as their account is compromised/card fraud. As the person hangs up and dials their bank the fraudster never terminates the call and plays a fake dial tone to the victim to make them believe their outgoing call is genuine. The victim is then subjected to social engineering and unknowingly gives their bank account information to the fraudster posing as their bank.

Answer 7

When I get a call from my bank (presumably) and they say there is some problem and they need to verify my identity first before proceeding in the call, I tell them I don't feel comfortable to provide this information because I don't know their identity. That say they understand and I should call the number on the back on my credit card and hang up. There is no haggling about the identity of either party, it's simple and effective.

Answer 8

Ditto lots of what others have said.

I've been stupid in the past and given out information to people who called me claiming to be from the bank or a charity or whatever. No more.

These days, if someone calls claiming to be from a charity and asks to put a donation on my credit card, I say no, send me something in the mail. Then I can verify that any address given really is the address of the charity. Etc.

If someone calls claiming to be from the bank or a credit card company or whatever, I make sure they are giving me some information that a scammer is unlikely to know. If they don't, I say that I will call them back, then I look up the phone number on the bank's web site. Companies won't normally tell you your account number for verification, but at a minimum they should tell you the name of the company, and not just "the bank" or "VISA". If there's a problem with a particular transaction, they should know all about that transaction, like when it was made and the amount.

In my experience, most scammers don't go to a lot of work to research your life. They call and say "this is the bank" because they don't know what bank you patronize, etc.

Most scammers are pretty lame. I get lots of scam emails that I know are scams because they are filled with spelling and grammar errors. I could believe that Microsoft would send an email with a grammar error. But Microsoft is not going to send me an email with 20 grammar errors. That's a scam. Etc.

I'm sure some scammers take the time to do some research on you. There are plenty of ways today they could find out your birthday. They could steal your mail to find out the name of your bank and your account number. Etc. To the best of my knowledge, I've never run into a scammer who did that much work. Probably I'm not rich enough to be worth special effort. It's easier for the scammer to just dial through a bunch of numbers or send out a bulk email and try dupe the most gullible people. Or people who are usually smart but just have a moment of carelessness.

But my point is, if they can tell you one or two things about yourself, they are PROBABLY legitimate. I wouldn't beat verification to death. But get SOME verification.

Answer 9

I would refuse to give out any personal details to anyone that called me as you can't verify who they are.
If they need to talk to you then say you can call back. You can then call through on the direct number, which if it is a large bank will be well known and on their website. You could then ask for an extension number to direct your call once you know you are through to your bank.