When in doubt: hang up, look up, and call back (krebsonsecurity.com)

Article summary

A security-conscious individual, Mitch, was scammed out of over $10,000 through an elaborate phone-based phishing scam. The scammers posed as his bank, using spoofed caller ID and manipulating Mitch into verifying his identity and allowing a large wire transfer. Mitch's bank was able to reverse the transfer and restore his funds, but not before the scammers had opened a new online account in his name. The incident highlights the importance of verifying the identity of callers claiming to be from a bank or financial institution.

Main themes

• phone-based phishing scams
• bank security measures
• customer verification
• financial institution responsibility
• vulnerable populations
• technology and scams

What commenters say

• Banks should train their customer service representatives to instruct customers to hang up and call back using a verified phone number to prevent scams.
• The finance industry is not doing enough to combat phone-based scams and is inadvertently conditioning customers to hand over personal details to scammers.
• Using a phone number from the back of a credit card or the bank's website is a more secure way to verify the identity of the caller than relying on Google search results.
• The use of two-factor authentication can help prevent scams, but it is not foolproof and can be gamed by sophisticated scammers.
• The onus is on the financial institutions to protect their customers from scams, rather than relying on customers to be vigilant.
• Phone-based scams can be particularly effective against seniors and other vulnerable populations who may be less familiar with technology and more trusting of callers.
• The use of landlines can make it easier for scammers to stay on the line and pretend to be the bank after the customer has hung up.