The phone rings. Your caller ID displays a number that appears to be from your bank’s official customer service number. So, you answer the call.
On the other end is someone claiming to be a customer service representative calling to inform you that there’s a security issue with your bank account. They urge you to provide personal information, such as your Social Security number and other account credentials, to resolve the issue.
Panicked, you willingly give the nice customer service representative everything they need to secure your account.
It’s not until a few days later that you realize you’ve been scammed by someone spoofing your bank’s official phone number. They now have enough personal information about you to steal your identity and raid your bank account and other financial assets.
“Today, you can’t trust caller ID because with the technology that’s available; it’s very easy for someone to make that number look like it’s coming from anywhere,” said David Campbell, Dollar Bank’s SVP Corporate Security Director. “(Spoofing) tricks you into having that trust factor. It’s a form of social engineering to psychologically manipulate someone into revealing sensitive information.”
With the rise of artificial intelligence, it’s getting easier for scammers to sound like familiar people on the phone as well, said Campbell. “Everyone has something that’s been compromised about them in this day and age,” he said. “Criminals take that one piece of information and use it to build trust with you on spoofed calls to get even more sensitive information so they can monetize it.”
Consumers who receive calls like this should resist the urge to be terrified into making a bad decision in the moment. The best thing to do to protect yourself is to hang up, and then call the customer service number for the bank or other business the person claimed to be calling from to verify if the call was legitimate, said Campbell.
Adam Dick, First Commonwealth Bank’s Retail Regional Leader covering the Pittsburgh Region and Ohio areas, agreed that hanging up and calling the bank’s customer service number back is the best course of action. “Don’t be afraid to ask questions,” he said. “We’re here to help.”
Paul Fero, North Districts Community Credit Union’s Chief Executive Officer, said the best policy is to question everything, including that customer service representative you think is calling from your credit card company. “Be suspicious of everything,” he said. “Don’t answer calls from numbers you don’t recognize, and don’t give out personal information to anybody calling you.”
He assured customers that banks and credit card companies are never bothered by consumers verifying whether contact is legitimate before handing over sensitive information. “They’ll more than understand if you do this if it’s a legitimate call, and they’ll be grateful you took extra steps to protect yourself. And if it’s not a legitimate call, you’ve just saved yourself a world of grief.”
Banks and other financial institutions have security measures in place to protect customer accounts from unauthorized access. The key to effective security for any company is a layered approach, said Campbell. One of the most effective variables in a layered approach is multi-factor authentication.
Multi-factor authentication works by requiring users to provide multiple forms of identification before granting access to a system or an account. For example, you may use your username and password to log into your bank account. The system may then send you a one-time code to your email or via text that you must then enter to authenticate your identity.
“Multi-factor authentication is recommended because even if you fall for one of these scams and accidentally give out your information, they won’t be able to access it if they don’t have that additional code to enter,” said Campbell.
Some of the more sophisticated scammers have ways to try to coax that one-time code out of their victims. Campbell advises to never give out that code to anyone who asks, even if they claim to be from the bank or other business that sent it to you.
For additional protection, Campbell recommended using unique usernames and passwords for your accounts. “That way, if one company is compromised, (scammers) can’t gain access to all your accounts by using the same username and password to gain entry,” he said.
Falling for spoofing is just one way consumers get swindled. Another popular method of stealing consumer financial data is with credit card skimmers, said Fero. “Plastic card transactions are the biggest risk for fraud because of the ease at which to skim them.”
To protect against skimming and to make more secure online transactions in general, Fero recommends getting a disposable credit card to use. Fero’s bank offers them to consumers for a $2 transaction fee, plus whatever amount of money they put on the card. The preloaded card has the consumer’s name associated with it, so you can even use it for purchases that require an account holder’s name for the card.
As scams get more sophisticated thanks to AI and other technology, educating consumers on how to protect themselves is one of the best tools banks and other financial institutions have at their disposal.
Dollar Bank, First Commonwealth Bank and North Districts Community Credit Union offer educational resources for their customers to prevent them from becoming victims of financial scams.
“We periodically offer educational seminars focusing on fraud and also encourage community groups to contact us and schedule in-person seminars for their groups,” said Dick.
Campbell said Dollar Bank’s customers can access the security center section of the website to learn how to protect themselves. Additionally, the bank participates in the American Bankers Association’s “Banks Never Ask That” Campaign that raises awareness about spoofing calls and other financial scams.
In addition to all these practical tips, Fero also reminded consumers to request their free annual credit reports from all three credit reporting agencies. Consumers can request their free copy at annualcreditreport.com.