Phone/Card Scam - August 2009

The scam works like this:

Caller: This is (name), and I'm calling from  the Security and Fraud Department at VISA (or MasterCard). My Badge number is 12460. Your card has been flagged for an unusual purchase pattern, and I'm calling to verify. This would be on your VISA (MasterCard) card which was issued by (name of bank). Did you purchase an Anti-Telemarketing Device for $497.99 from a Marketing company based in  Arizona?

When you say 'No',
Caller:  Then we will be issuing a credit to your account.. This is a company we have been watching and the charges range from $297 to $497, just under the $500 purchase pattern that flags most cards. Before your next statement, the credit will be sent to (gives you your address), is that correct?

You say 'yes'.
Caller: I will be starting a fraud investigation. If you have any questions, you should call the 1- 800 number listed on the back of your card and ask for Security.  You will need to refer to this Control Number. The caller then gives you a 6 digit number. Do you need me to read it again?

Here's the IMPORTANT part on how the scam works.  

Caller:   I need to verify you are in possession of your card.  He'll ask you to turn your card over and look for some numbers. There are 7 numbers; the first 4 are part of your card number, the next 3 are the security Numbers that verify you are the possessor of the card. These are the numbers you sometimes use to make Internet purchases to prove you have the card... please read the 3 numbers to me. 
 
After you tell the caller the 3 numbers.
Caller:  That is correct, I just needed to verify that the card has not been lost or stolen, and that you still have your card. Do you have any other questions?

After you say No.
Caller:  Thank you and don't hesitate to call back if you do.

You actually say very little, and they never ask for or tell you the Card number. But after SSA was called on Wednesday, the SSA cardholder called back within 20 minutes to ask a question.  The REAL VISA Security Department told us it was a scam and in the last 15 minutes a new purchase of $497.99 was charged to the card.

SSA made a real fraud report and closed the VISA account. VISA is reissuing them a new number. What the scammers want is the 3-digit PIN number on the back of the card  Don't give it to them. Instead, tell them you'll call your card issuing bank directly for verification of their conversation.. The real VISA told them that they will never ask for anything on the card as they already know the information since they issued the card!

If you give the scammers your 3 Digit PIN Number, you think you're receiving a credit. However, by the time you get your statement you'll see charges for purchases you didn't make, and by then it's almost too late and/or more difficult to actually file a fraud report.


 Emails from the FDIC (Federal Deposit Insurance Corp.)
Emails to financial institution customers fraudulently claim to be from the FDIC, in attempt to obtain sensitive personal information.

 Emails from the NCUA
Email from a party fraudulently claiming to be the NCUA advising that your credit union has joined the FCU network. The email recipients are directed to a FCU activation page where they are asked to provide sensitive personal information. The NCUA will never ask credit union members for such personal information.

 Thieves Targeting Credit Cards at Gas Pumps
Sophisticated thieves intercept the numbers on credit cards being used at gas pumps at primarily large service stations by attaching what is known as a skimming device to the credit card reader at the gas pump.

 Cashiers Check Fraud
A variation of the Nigerian Letter Scam, the scam involves a seller advertising a valuable item over the internet. A buyer contacts the seller about purchasing the item and states that he plans to use a cashiers check issued from a bank/credit union in the US. The buyer then tells the seller that he either mistakenly sent too large a check or that he will be sending a check for more than the purchase price. In either event, the seller is instructed to immediately wire the balance back to the buyer. The unsuspecting seller then deposits the cashiers check into their account. Under federal banking law, the customer's bank is required to make those funds available to its customer on the business day after the funds are deposited. As the unwary seller is able to withdraw the overpayment before the check winds its way back to the bank where it was supposedly issued. That can take 7 days or more. Of course, after wiring the money back to the buyer, the scam artist is nowhere to be found.

 Phishing survey offers gift cards for your personal and confidential information
This new scam uses the promise of gift cards or merchandise from major retailers to lure recipients into providing sensitive and personal financial information.

 Targeted trojan email attacks
A trojan horse is an attack method by which malicious or harmful code is contained inside apparently harmless files. Once opened, the malicious code can collect unauthorized information that can be exploited for various purposes or permit computers to be used surreptitiously for other malicious activity. These attacks appear to target US information for exfiltration.

There are two distinct elements that make this attach technique significant. First, the trojans can elude conventional protective measures such as anti-virus software and firewalls. Second, the emails are sent to specific or targeted recipients. Unlike "phishing" attacks, the emails use social engineering to appear credible, with subject lines often referring to work or other subjects that the recipient would find relevant. The emails contain the trojanized attachments, or links to websites hosting trojanized files that are spoofed, making it appear to come from a colleague or reliable party. The email attachments exploit known vulnerabilities to install a trojan on the user's computer. When opened, the file or link installs the trojan.