PSA: Credit Card Phone Scam
(Or, how Tumblr just saved my ass)
I saw a PSA recently about a scam going around with spoofed official numbers calling and asking for information, and how you should hang up and call back using the correct number rather than just go along with what the caller is telling you. But this is Tumblr, so I'll never be able to find the post again.
I decided to make my own, because this literally just happened to me an hour ago. Hopefully my story can spread some more awareness and save other asses the way mine was saved.
Around 7:30pm tonight (Friday), I got a phone call from a 1-800 number. I almost didn't answer it, then I saw it was 1-800-465-4___, and I recognized that as the start of the CIBC phone number, so I picked up.
Guy: Hi, is this [MrsD]?"
Guy: Hi, [MrsD], this is _____ from CIBC, how are you tonight?
I thought, okay, this is a sales call. Right before I'm about to sit down for dinner. Typical. Mentally, I'm already putting together an exit strategy, preparing to say no to everything and get off the phone ASAP. But then—
Guy: We've just flagged suspicious activity on your CIBC Visa card. It was an online BestBuy transaction for $980.00. Was that your transaction?
Me, flustered: Uh. What? Sorry, how much?
Guy: $980.00 at BestBuy, was that you?
Guy: Yes, your card was used at a BestBuy in [town nearby]. Was that you? Did you go to [town nearby] today? You don't live in [town nearby], right?
Guy: Okay, so I need some information to verify this transaction.
By this point, my brain had caught on that something about this was hinky. First of all, I thought he said it was an online purchase, then he said it was in person. But maybe I'd misheard, he was talking fast. My second thought was that every other time there was a suspicious transaction, I got an automated phone call and a text message with instructions to call back. I've never had a person call me directly.
My third thought was, well, the phone number on the caller ID was right....
THEN! I remembered a Tumblr post I saw recently, and I remembered what it told me to do.
Me: I'm skeptical about this call. I'm going to call CIBC myself and look into this.
Guy: What? Ma'am, you can just tell me, I can verify—
Me: No. Thank you, but I'll call the number on the back of my card.
Guy, getting more agitated: Ma'am, if you look at the number on your card, you'll see it's the same number.
Me: You know that can spoofed, right?
Me: Sorry, but I need to make sure. I'm going to call CIBC directly.
The guy kept sputtering, but I hung up on him. In that moment, I really didn't think that he was a scammer. In fact, I thought I was being paranoid and was maybe kinda rude to the guy. I wondered if I was being overcautious, and I felt a bit guilty.
I called the number on the back of my credit card, waited 15 minutes for an agent, and told him what just happened.
Agent: You didn't tell him anything, did you?
Me: No. I said I wasn't in [town nearby] today, but that's it.
Agent: Good. You did the right thing by calling us, let me look into the transaction for you.
Agent: I'm not seeing any transaction like that. There's no flags on your card, nothing suspicious at all.
Agent: Yep. Entirely fake.
I was honestly surprised. I really thought that there was some kind of mix-up and that I would be apologizing to this guy for being rude to his colleague.
Looking back on it now, I can see all the telltale signs of it being a scam call:
Time of day. Early evening on a Friday, chances are people are either sitting down for dinner or in a hurry to get somewhere. In this situation, a lot people probably wouldn't think twice about giving "the bank" some information just to get off the phone. (Joke's on them, I have no life!) But the way that I reacted to his introduction did evoke the desired reaction of Ugh, what now? Leave me alone! that the scammer was banking on (pun intended).
Sense of urgency. The scammer spoke fast, threw details at me quickly, and made sure I knew that I had to give him my information right away. This honestly threw me off. It was overwhelming, and I felt concerned and a bit frantic for a few seconds until I thought about what I know about scams and what I'd just read in that Tumblr PSA.
Complete lack of empathy or understanding about my skepticism/anti-fraud precautions. The last time I had to get a new credit card number due to fraud, the agent I spoke to said things like "I know this is frustrating", "I'm sorry this is a hassle", etc. And of course the CIBC agent I spoke to tonight was immediately grateful that I'd called them directly and reassured me that CIBC would never ask for information. By contrast, the scammer was outright dismissive of my concerns and got agitated when I wouldn't just trust him right off the bat.
Emotional provocation. Similar to #2 & #3 above, the scammer was very good at making me feel things. Worried and fearful at first, then guilty about being suspicious, to the point where I actually apologized to the guy. (Granted, I am Canadian, but still!)
And finally, I cannot stress enough: the spoofed phone number. I am a pretty well-informed person. I keep up with news about scams and whatnot. I know that phone numbers can be spoofed. I've been in front of my phone when it just starts to ring and I can see the auto-dialler number appear briefly before it gets replaced with a number that has my area code. But tonight—early evening on a Friday—I was cooking dinner and my phone was across the room. It had rung several times by the time I got to it. I only picked it up because I recognized the CIBC number. And when the scammer started his spiel, the fact that the number was the same was enough for me to give him just a tiny moment of trust. Had he actually gotten past that first barrier and started requesting my information, I think I would have caught on, because people asking for sensitive information over the phone is a huge obvious red flag. I like to think I would have caught on, anyway. But maybe not! That fake number almost had me.
TL;DR: No matter what the number on your caller ID says—that it's your bank, your energy company, your internet provider, whatever!—if the person on the other end is requesting sensitive information urgently, don't panic. Stop. Think. Then tell them nothing, hang up the phone, and call your service provider yourself using a verified phone number.
