Thread by @shrikant

Just got a brilliant scam call that I almost fell for. Impressed with the flow of the scam and the machinations that went into it.

Will try and explain what happened but some details are a li'l fuzzy.

1/

The person who called claimed he was from the credit card dept of my bank. Usually, most scam calls this way, so I was on alert.

Scammer had my bank name right, though, so I was just guarded and not in full-blown rejection mode...

2/

Scammer then proceeded to explain the 'offer'. Apparently, my credit card reward points had expired in November, and since I hadn't redeemed them, my bank was offering to convert it into cashback that I could use to offset any future purchases on the card.

3/

He got two things right:
1. I had racked up a decent number of reward points.
2. I didn't care about my reward points to keep track of them.

Then he asked me for my DoB for 'verification' purposes, a common request. I gave it.

4/

Then, he off-handedly mentioned (or fir I bring it up?) that this cashback could be used to pay off my credit card, since it was getting 'credited back' to the card.

This piqued my interest. One less credit card payment to make? Of course I was interested!

5/

To do that, he needed to know the expiry date of my card.

Uhh, what?

Still, giving out just the expiry date can't hurt, can it? I mean, it is usless unless combined with other pieces of info, like CC number, etc.

I gave it.

6/

The next part of the conversation is a bit hazy in my memory. I'll have to listen to the call recording to get the sequence of events right but, all that matters, is that it came to a point where he wanted to know my CC number.

ALARM BELLS!

Not happening, mate. 😑

7/

At this point, I told him I'll call up the official bank hotline because all of this was sounding suspicious.

The brilliance of the scam is this: He acknowledged my concerns and said he wasn't asking for my PIN or CVV, because that's what scammers do!

8/

He even encouraged me to connect with my bank and check it with them - a bluff, I think.

I called his bluff and told him I'm disconnecting the call at which point got a bit flustered, I think. Then, he changed tack and reverted to 'assuring' me that everything was genuine.

9/

My fraud detection meter was going haywire at this point, and the only though in my head was to block my card asap.

I wasn't sure how much information I had given out and didn't want to find out the hard way.

10/

Credit to him, he tried to keep me on the call by giving me the first four digits of my card. (Yeah, FIRST four digits.)

He got those numbers wrong, and that pretty much stamped the fate of the call and my card.

11/

I wrapped up the call as politely as I could and immediately called my bank's PhoneBanking number.

Took ke THIRTY minutes and five separate calls to reach a human! WTF?!

Somehow, I got through and explained my situation...

12/

(The frustration of not being able to easily find a human operator option at the end of an IVR menu deserves another tweet-thread of its own but I don't want to digress here.)

13/

The phone banker confirmed that no such 'cashback' program existed and that it was likely a scam or a fraud attempt.

I hotlisted my CC and asked them to send me a new one with a new number, which should be arriving within the week.

Christmas week. No CC. FML.

15/

To those wondering, I have given the guy:

- My DoB
- My CC expiry date
- My card merchant (i.e whether it was a Visa/Master/Amex/Diner's)

The guy already knew my name.

16/

Here's how it could be used for Identity Theft.

Scammer calls my bank posing as me, gives them my DoB and my address when asked for verification. Initiates a change of phone number and/or email, with all the details they acquired from me...

17/

Once a different phone number and/or email is associated with the card, all OTPs, notifications, and calls will go there.

I wouldn't even realize that my card was being used until I got my next bill, which would be a huge one, no doubt.

18/

In fact, now that I think of it, he could have initiated a change of phone number request right then and there and sent me the confirmation link by text.

(I think that's what he may have been trying to do but I didn't stick around to find out.)

19/

I think I managed to get things under control but I am not entirely sure, at the moment.

I'll be
- Logging into my bank account everyday, checking for any suspicious activity.
- Setting up spending limits
- Scurutinizing all SMS messages from my bank.

20/

The only way to defeat a scammer is to stay alert and ACTIVELY look for the red flags.

A scammer will never ask for crucial info directly - they will ask the most innocuous question that leads to you giving away a crucial/critical piece of private information.

21/

A scammer will always act righteous. It's a bluff. Call that bluff.

The truly righteous don't mind any verification protocols. Scammers will passive-aggressively try to dissuade you...

22/

Remember a scammer's greatest weapon is their confidence but your skepticism is their kryptonite.

When someone seems too smooth, or something seems too good to be true, that's because it usually is.

There is a reason scammers are called 'confidence men', ya know?

23/

Here's the last word:

If someone tells you to trust them, don't.

If someone offers you an 'irrefutable fact', verify it independently.

If someone is offended by your 'lack of trust in them', tell them you are offended by their lack of credibility.

Good luck!

24/24