Scam call - they knew all about me

pafpcg

DullGreyGuy said:

TVR450 said:

Hi all.  I just had a scam call 'from' Santander Bank.  They knew my name, address, address and my debit card number.  They said there were fraudulent transactions on my card from Ikea in the town I grew up in.  Even though they seemed genuine, I had my guard up.  They then said they would send me a new debit card out and asked me to tell them the code on an SMS they would send.  This was a red alert to me and sure enough the OTP was to pay for an item for around £1500.  

I hung up and called my bank who confirmed it was a scam call.  But how did they know so much about me?

400ixl said:

Ergates said:

Jellynailer said:

TVR 450 -

I dont have a smart phone mainly because of concern about the security of my financial details

Smart phones are very secure - significantly more so than the average PC/Laptop.  Obviously that doesn't help with your other issues with them.

Touch screens also work with gloves (Latex / non latex ones rather than woollen of course). 

you can also get special treatment to woollen, cotton, leather etc gloves so they do operate touch screens eg https://www.dentsgloves.com/products/womens-touchscreen-knitted-gloves 

OFF TOPIC:

I have circulation problems so I have to wear gloves in winter months (Sept-April) to keep my fingers from getting chilblains.  In my experience:

1. Black nitrile "rubber" gloves work on my smartphones (they are carbon loaded), but are next-to-useless at keeping my fingers warm!  They also get uncomfortable with skin perspiration.

2.  I've tried several brands of gloves claimed to be suitable for touchscreens but either don't work or they are rubber-coated and give rise to the clamminess problem.

3. Last year I discovered that simple knitted cotton gloves are warm enough and once they get a bit grubby work perfectly with my smartphones.  The only downsides are:

- cotton gloves don't give a good enough grip on the ball of my trackerball (I use trackerballs on my computers rather than mice) which I solve by wearing a silicone "rubber thumb" to manipulate the ball.

- I need spare gloves for when I spill my tea - damp gloves aren't comfortable!

Back on topic:  when I get a scam call and I'm not too busy, I play the doddery old fool and keep them on the line waiting for my ancient old computer to boot - just to waste their time (whilst I can get on with surfing MSE etc).  And if I'm feeling vindictive, before terminating the call, I ask them if their mother knows what they do for a job.

GeoffTF

PRAISETHESUN said:

AmityNeon said:

TVR450 said:

AmityNeon said:

TVR450 said:

Yes, ok, the only part they did not manage was to convince my phone provider to send them a new SIM, then they could have received the OTP themselves.  I guess they did not manage to work out who my phone provider was or my security is good enough on my phone account.

How do you know they attempted to take over your mobile number?

I don't to be honest. That was just speculation that the scam would have worked if they had taken over my mobile phone account.

Indeed it could have. I recommend a second mobile phone number that's strictly reserved for banking and 2FA, and never revealed to any contact. Modern phones can support Dual SIM Dual (Standby/Active) and PAYG SIMs are very cheap to maintain connectivity. Whilst it won't stop rogue employees, at least your mobile number that's likely been uploaded by your contacts to countless databases won't be associated with your banking.

I'd also recommend setting up/changing the default SIM PIN to protect against SIM swapping attempts. It's not foolproof, but it slows things down if it gets to the point of a scammer actually managing to hijack your SIM.

I suggest putting a PIN on the SIM, so that they cannot SIM swap unless they know the PIN.

AmityNeon

PRAISETHESUN said:

AmityNeon said:

TVR450 said:

AmityNeon said:

TVR450 said:

Yes, ok, the only part they did not manage was to convince my phone provider to send them a new SIM, then they could have received the OTP themselves.  I guess they did not manage to work out who my phone provider was or my security is good enough on my phone account.

How do you know they attempted to take over your mobile number?

I don't to be honest. That was just speculation that the scam would have worked if they had taken over my mobile phone account.

Indeed it could have. I recommend a second mobile phone number that's strictly reserved for banking and 2FA, and never revealed to any contact. Modern phones can support Dual SIM Dual (Standby/Active) and PAYG SIMs are very cheap to maintain connectivity. Whilst it won't stop rogue employees, at least your mobile number that's likely been uploaded by your contacts to countless databases won't be associated with your banking.

I'd also recommend setting up/changing the default SIM PIN to protect against SIM swapping attempts. It's not foolproof, but it slows things down if it gets to the point of a scammer actually managing to hijack your SIM.

A SIM PIN helps against physical theft of a SIM and should absolutely be enabled of course, but it doesn’t help against remote SIM swapping (where the mobile number itself is transferred off the SIM and onto another).

Teapot55

@AmityNeon I’m grateful to you for mentioning SIM swapping. It’s prompted me to read a bit more about it as a refresher, since I wasn’t 100% up to speed. 

Below is the link to a good piece I found on Wikihow. It’s written for a US audience but is still accessible to a UK person. 

https://www.wikihow.com/Reverse-Phone-Cloning