"May I Ask Who's Calling?"
Caller ID Spoofing Scam
My stomach tightened as I listened to the caller.
“Mrs. Rice, we’ll need your username and a few other details,” he said. “The sooner we can confirm your information, the better. The longer you wait – well, let’s just say – these criminals are good. Real good. They’ll have your card maxed out before you know it.”
“What’s your name again?” I could barely keep up with everything he’d said. All I knew was that he had me concerned. My best friend Jackie had her purse stolen last year, and it was a nightmare to get it all straightened out. Those crooks not only used every credit and debit card in her wallet but they tried to steal her identity too.
“It’s Phil Smith, security officer with your credit union. You can check the caller ID on your phone and see the call is from Alpha Credit Union.”
I looked at my phone again. Yes, he was right. The caller ID read “Alpha Credit Union.” But something still felt off. Why was he asking for my private information? My Visa debit card wasn’t stolen. It was in my wallet – at least it was the last time I checked.
“What do you need my information for? I haven’t reported anything.”
Without missing a beat, Phil told me there had been some questionable activity on a few of the member debit card accounts, so they were randomly checking on other accounts to make sure their system was secure.
“We can also try your password challenge questions if you feel more comfortable with that,” he offered.
“Hmm, I don’t know if I should do that,” I hesitated. “Can’t I just come to the branch and talk to you there?”
“At Alpha Credit Union, your account safety is our priority. We need your cooperation to keep your Visa card safe. That’s what you want, isn’t it?” When I didn’t say anything, he continued. “This is for the card ending in 5307. You have a card ending in those numbers, don’t you?”
I felt like I’d swallowed a marble.
I reached for my wallet. There it was - my card ending in 5307. A feeling of relief washed over me.
“Are you still there Mrs. Rice?”
“Yes, I’m here.”
“We don’t have much time to protect your card. The sooner you can confirm your information, the quicker we can make sure it stays out of the hands of criminals.”
I didn’t know what to say. I’d heard about scammers calling people pretending to be someone else, but this couldn’t be the case. After all, the caller ID confirmed the call was from my credit union. Just something in Phil’s voice made my blood run cold.
“Can I call you back?”
“Why? We need to take care of this now,” Phil pressed.
“I just need to check on something,” I said as I held my breath. “I’ll call you back in a few minutes.”
“No! – Um, I mean – Mrs. Rice, we need to take action now. Your card is in jeopardy. If you don’t give me the information now, we’ll need to put a hold on your card, and you won’t be able to use it.”
“I – I don’t think so.” I hung up not knowing if I’d done the right thing.
Mrs. Rice was correct in suspecting the caller. Phil was using fake caller ID information, AKA “caller ID spoofing,” to fool Mrs. Rice into providing confidential information. This is a way for scammers to appear to represent a particular company or person. The caller’s name, phone number or both can be spoofed, which can make it look like a legitimate call. Phil made it seem as if he were calling from her credit union by disguising his true identity.
While Phil did not have Mrs. Rice’s physical Visa debit card, her card number had been stolen and he attempted to contact her to obtain more information. While Mrs. Rice’s debit card was in her possession, the card number may have been stolen virtually via malware on her computer, a skimmer device at the gas pump, or via a merchant data breach. The fraudster was now attempting to gain more information so he could access her financial accounts.
The next day, Mrs. Rice visited her credit union and found there was indeed fraud on her card. Her card number had been stolen, and the fraudster was contacting her to gain further access to her account information.
Since relying on caller ID to verify a caller’s identity can put you at risk, protect yourself by following these tips:
- Don’t confirm or provide your personal or financial information to an unexpected caller regardless of what is displayed on your caller ID.
- Call the company’s phone number directly or visit the location if there is a request for personal or financial information.
- If the caller expresses a sense of urgency in obtaining the information, hang up.
- Contact the company the caller was spoofing to report the incident.
- Report caller ID spoofing to the Federal Trade Commission and the Federal Communications Commission.
If an unexpected caller claims to represent F&A Federal Credit Union, please take these steps if the caller is requesting personal or account information:
- Record the person’s name.
- Confirm the purpose of the request.
- Do not give out any personal or confidential information regardless of how time sensitive the caller makes it seem.
- End the call.
- Contact F&A Federal Credit Union at 800-222-1226 for immediate assistance.
Always trust your instincts.
If something doesn’t feel right, it’s probably not.