Beware: telephone phishing scams are getting very crafty
I was almost phished this week, and I'm posting my experience so no one else gets hooked.
I received a phone call from an 877 # with Capital One as the caller ID. A man with a very professional voice asked for me and when I answered, told me that he was from Capital One, then gave me that "all calls are recorded and monitored" jazz before proceeding.
He informed me that Capital One had noticed some unusual ATM withdrawals on my account and wanted to confirm whether I made them or not. He walked me through several, as in, "There was an ATM withdrawal attempt for $200 at the ____ in Atlanta, Georgia. Was that you? No. Okay, Ma'am. We're gonna go ahead and clear that one out."
After I declined the charges, he told me he would close this debit card and send me a new one. He then gave me some "security tips" about how to make sure this didn't happen again. Then he said that before he sent out the new card, he had to make sure he had the right account, so asked me for my pin #.
He went through several more steps to confirm it was me, such as texting a code that I had to read back to him. (The code was formatted exactly like what you'd get from a company, such as, "Capital One will never sell your information to anyone.") Each time he completed a step, he put me on hold for 1-2 minutes. After putting me on hold for the third time, he asked for the CV code on the back of my current debit card. Then he asked for my account number. This is when I suspected fraud. I yelled at the guy, hung up and called Capital One to find out if the guy was legit it or not.
I called Capital One immediately to find out if my account was hacked, and here is how brilliant the phishing scam was. The customer rep was thoroughly confused about my asking whether Capital One had called me, because she was noticing on her end that at that very moment, someone was making unauthorized withdrawals on my account. So she said, "No, that probably was us calling you before, because your debit card is being blocked as we speak, and yes, we would definitely call you if that was happening."
I suddenly felt guilty, thinking, "D'oh! I just yelled at and hung up on some poor grunt who was just doing his job." Then she read me the charges she saw on her screen and that's when I knew that the previous call was fake. The charges the real Capital One rep read were completely different from the one the fake customer rep had read me. The phisher claimed ATM attempts in Georgia; the ones she read were in Florida, West Virginia and the UK. Meanwhile, as I was talking to her, the phisher kept calling me repeatedly (I have call waiting). I told her what was happening, and that's when she realized that he was a fake, too. She said, "Yeah, we would never call you back if you hung up." When I told her more about the phone call, she said that legit reps would never ask for CV codes, pin numbers or account information because they don't have them on file.
When it was all over, I couldn't believe how well-crafted this phishing scam was. The guy sounded like a trained professional who knew the Capital One customer rep handbook like the back of his hand. He even kept his cool when I yelled at him, was all like, "Oh, no, Ma'am. It's okay. We understand your concern. We're not trying to get any information from you. We just need to confirm your ID before we send you a new card." His behavior led my brother-in-law to believe that he might've worked for Capital One at some point. This makes sense, because he knew how to mimic a rep exactly.
Moral of the story: if you get a call claiming to be from your bank claiming fraud, always make sure to call your bank back. And be especially leery if the person starts asking for CV codes and account numbers towards the end of the call.