TSB 'check a transaction' text

dale_cotterill

I'm used to text scams, but this one really caught my attention.

Got a text just recently from TSB in my usual text chain full of OTP's saying 'Hello, It's TSB. We need to check a transaction. You'll get messages from +44740.....etc'. I'm fully aware it's possible to spoof it so it appears as genuinely from TSB, so on that basis I'd just ignore it.

I then got a text from said number stating the two transactions in question, and asking me to reply Yes or No as to whether I made them. Obviously coming from a mobile number I'm not going to respond. There are also no transactions to approve in the App, which you'd think was a fairly good way of doing it. Surely even with working from home and whatever else, you don't run your fraud detection line off mobile numbers.

What really got my attention is that the text message correctly identified the last 4 digits of my credit card. This is a credit card that was exclusively opened for a balance transfer. It has never been activated, it has never been used, as such it's never been put up on the internet into anything that has reported as been hacked. I also opened the credit card after TSB's own data breach.

So either TSB have an impossibly bad way of dealing with notifying for fraud and the text is genuine (possible but surely not), or something is leaking somewhere. Any other options? Theoretically the only other place which has the card number is HSBC for the DD.

Jami74

What is the risk of texting No? Is it that someone might call you and try to extract information? Is it because the request to yes or no a transaction came from a second text from a different number that makes it dodgy? I'm asking because I am sure I've had text messages to yes or no a transaction (not recently) and I would have replied.

My daughter got a text like this once so I phoned the number on the back of her bank card on her behalf (she was 15 or 16) and they said for her to call back via her app which she did and was told that 2 transactions were attempted from the previous expired card, then they reassured her that her account was safe and that was that.

dale_cotterill

Jami74 said:

What is the risk of texting No? Is it that someone might call you and try to extract information? Is it because the request to yes or no a transaction came from a second text from a different number that makes it dodgy? I'm asking because I am sure I've had text messages to yes or no a transaction (not recently) and I would have replied.

My daughter got a text like this once so I phoned the number on the back of her bank card on her behalf (she was 15 or 16) and they said for her to call back via her app which she did and was told that 2 transactions were attempted from the previous expired card, then they reassured her that her account was safe and that was that.

If it came through the standard TSB text chain where the OTPs come through with the card number and transactions I'd probably be ok and just reply 'No'. I just find it hard to believe the TSB would manage their fraud detection department on what would look like personal mobile numbers.

Mind you it is seeming more and more like it is genuine, and TSB just has awful processes

Sandtree

What exactly do you think a fraudster would get from the word yes or no?

dale_cotterill said:

So either TSB have an impossibly bad way of dealing with notifying for fraud and the text is genuine (possible but surely not), or something is leaking somewhere. Any other options? Theoretically the only other place which has the card number is HSBC for the DD.

Seems a perfectly reasonable way to me... given you realise that a text can be programmed to show whatever the sender wants as the number it claims to come from how would having a number make it any more or less secure than having anything else?

At the end of the day if you ignore the message then TSB will take that into consideration when deciding if to allow the transactions or not

WillPS

If in doubt, call the number on the back of your card and ask if it's legit.

elasto

OP: I had essentially the same thing happen, only with my debit card.

I got a text spoofed as First Direct to say that they'd be texting me from a mobile number. The new text arrived and asked me to verify a transaction Yes or No.

Like you, I was struck by the fact that they had the correct last four digits of my card number despite the fact I don't think I have ever used this card online.

I phoned up FD and they confirmed it was a scam text.

I asked them to cancel and reissue my debit card simply because I didn't like the fact the scammers had my phone number and part (or perhaps all) of my debit card details. FD were quite happy to do so and sent a new card free of charge.

Maybe there was a data breach in the place where cards are being produced or something..?

born_again

elasto said:

Maybe there was a data breach in the place where cards are being produced or something..?

Or from any retailer as they will have your card details.
Remember card production facilities like banks are locked down tight. Staff are all checked for criminal records & finanical troubles. Unlike your average retailer.