A new scam

brighouse55

Well, I never thought I would be posting here about being caught in a scam.
Last Thursday evening I got a call from my bank. They introduced themselves in the way they should and gave me the last four digits of my debit card. I then asked them to tell me the last four digits of the account, which they did. Happy, I went on with the call. The account was holding two payments as it looked like fraud; one for £647 was for a holiday in Aberdeen and the other for a £237 payment to Ebay. They had stopped the holiday amount but Ebay was in pending already and I was asked if that was my sale. None of them were. Not to worry said the very educated voice we can stop the holiday payment now, but as the Ebay was in pending it could take up to 5 working days to get it back into your account.
I was then told, as a security precaution, it would be best if I cancelled the debit card and a new one would be sent within five working days. I asked them to confirm my first line of address, which they did, and they then put a stop on the account. I was then given a lecture on online security, all of which I knew and comply with, a suggestion I check the account in the morning just to make sure the holiday didn't appear and they rang off after pleasantries about don't be too concerned, these things happen in the best of houses etc. Sigh of relief that we had caught the bounders and wondering how on earth they got my details.
Next morning I logged on to the bank account and while the £647 didn't appear the £237 was still in pending. Which was what I expected. That afternoon I used the car park and accidentally paid with my debit card (I don't destroy until the new one appears) and it worked. Alarm bells, home and contacted the bank.
Sure enough this was the first contact the bank had made this month to me. It was a scam and they were immediately able to stop the £237 going out of my account. The £647 was entirely spurious and was used to give me a false sense of security. And it worked!
I have lots of questions that need answers - how did they get my details including address when I am very, very careful about this sort of thing and why go to so much trouble for so little gain?
The bank has suggested it might have been a taster for a bigger scam later on. On checking the numbers I was called from they were both known as scam/spam numbers - which is of course locking the gate too late. I am also checking with credit companies to see if anyone has taken out new credit using my name, and will be doing so for a long time to come. New cards are on the way and I was keen to change my account details but the bank suggested waiting for a while as it would mean a lot of work to sort out. 
Final piece of advice from the bank - if your bank calls you, hang up and call them back on the number on the reverse side of the card, they won't mind and it can save you a day of calls.          
 

marcia_

 Your details may have been obtained by a hack on a website you have used in the past 

CliveOfIndia

brighouse55 said:

Final piece of advice from the bank - if your bank calls you, hang up and call them back on the number on the reverse side of the card, they won't mind and it can save you a day of calls.          
 

To add to that good advice, call back on a different phone.  I don't know if it's still the case, but it often used to be the case that the scammer could still somehow be on the line, so you think you're talking to your bank but you're actually talking to the scammer.  I don't know how it works, but apparently it's a trick they use.

So if they call on your landline, call them back on a mobile, or vice-versa.  And yes, obviously call on a number that you know to be genuine.

UnsureAboutthis

This is one of the main reasons we never use our debit card unless buying a car, which always costs many k's.

brighouse55

marcia_ said:

 Your details may have been obtained by a hack on a website you have used in the past 

I never use a debit card online, its always a credit card which gives far better protection as often said on this website

MyRealNameToo

brighouse55 said:
why go to so much trouble for so little gain?

So they could get whatever they bought for £237 because you dont report the suspect pending transaction thinking its in hand and it allows it to go to collection, the seller dispatches the goods (or whatever it was) and the chargeback happens later with the seller being the one that ultimately loses out.  That or they are the seller, the couple of days gives them time to withdraw the funds and eBay are the losers who can't claw the money back from the seller. 

Either way seems like a tactic to delay you to allow them to complete whatever it is they are doing. 

The only really unusual feature in this all is that they had the last 4 digits of your card number AND part of your account number... I can think of very few sources that would have both for me. Sure they could have gotten one from one breach and the other from another and glued the two together but the number with my account number is going to be small and mainly the few companies I pay by DD which is pretty much the council, utilities and credit cards. 

Lorian

If it's a scam they have quite a lot of info. Have you checked your email address at haveibeenpwned?

I would be changing the password for my email and making sure 2FA is enabled on my email, indeed on every account I owned.

Also worth keeping an eye on your credit report.

Emmia

The giveaway is that they called you (was it a private number perchance?).

 I had a similar scam call a couple of months ago, and politely told them that i wasn't discussing this with whoever they were, as they had called me, using a private number. The main giveaway is the email address they told me, was fairly obviously not the one I used for online banking (and I also know because of the address where the fraud probably originated).

I would consider using a completely separate email for online banking arrangements if you tend to use the same email for online transactions and banking.

They tried using urgency. "shall we cancel your debit card..." And when I said no. And I'd contact the bank directly they followed up with "you'll lose access to the app and online banking, you'll need to go to a branch to reset everything" ... I hung up on one of them, but a few minutes later I had another call using the same wrong email address, with a similar spiel.

After the first call I immediately froze my card in the bank app, and contacted the bank via the app (which didn't stop working!) web chat, and requested a replacement card, which I also froze, intending to unfreeze it when it arrived... Only it didn't.

I don't know if the lack of replacement debit card was linked to the calls, or if that was coincidence but I had to pick up the replacement's replacement in branch with ID - which I was more than happy to do.

I had more calls to which I responded with f**k off you scammers, it only took a couple of them before I was clearly taken off the list as a possible "victim".

chubsta

I’m not the brightest person in the world but what is the scam here? I accept it was a scam but don’t understand why they contacted you to tell you about the transactions and ask you to cancel the debit card? What did they gain by going this she they clearly are able to make transactions?

Emmia

chubsta said:

I’m not the brightest person in the world but what is the scam here? I accept it was a scam but don’t understand why they contacted you to tell you about the transactions and ask you to cancel the debit card? What did they gain by going this she they clearly are able to make transactions?

I imagine they'd have moved onto things like the OTP for authorisation. This call might also have been to work out if you're scammable. Your details would then be sold on... To other scammers.

UnsureAboutthis

brighouse55 said:

marcia_ said:

 Your details may have been obtained by a hack on a website you have used in the past 

I never use a debit card online, its always a credit card which gives far better protection as often said on this website

Agreed and as I said in my initial post here, the only time we use our debit card is for purchases like a car or cash withdrawal from a machine we trust and it's always been in the uk.

Two points. Try to use your CC rather than debit.
If you get a call/text, and you have the slightest doubt. Take their name, location, Dept/etc and tell them you will call them back via a number you have, ie look it up yourself.