It usually starts with a text that looks exactly like the fraud alerts your bank really sends:
FRAUD ALERT: Did you attempt a purchase of $1,849.00 at an electronics store? Reply YES or NO.
You didn’t buy anything, so you reply NO. Two minutes later, your phone rings. The caller ID shows your bank’s name. A calm, professional voice says he’s from the fraud department. He knows your name and the last four digits of your card. Your account has been compromised, he says, and he’s seeing attempts to move money. To protect your savings, you need to move it right now, into a secure account the bank has set up for you. He’ll stay on the line while you do it.
Every word of that is a lie. And it works on careful, experienced people every day.
Why it almost works
In my new book, a retired school secretary I call Carol gets exactly this call on a Saturday morning. She’s careful. She checks everything. She nearly went along anyway, because the scam is built for careful people:
- The alert looked real, and her honest “NO” told the scammers she was a real person paying attention.
- Caller ID proved nothing. It’s easy to fake.
- He knew some of her information. After years of data breaches, bits of almost everyone’s information are out there.
- He created fear, then offered rescue. It’s very hard to think clearly when someone tells you your money is in danger.
- He cut her off from help. He told her not to talk to anyone at her branch, because “someone there might be involved.”
That last line is what saved Carol. She’d known the tellers at her branch for twenty years. She said, “I’m going to hang up and call the number on the back of my card,” and she did. There was no suspicious charge. There never had been.
The one rule
The Federal Trade Commission’s warning on this scam is about as plain as consumer advice gets: never move your money to “protect” it. That’s a scam. As the FTC puts it, “Moving it means you’ll lose it, not protect it.”
No one legitimate will ever ask you to move money to keep it safe. Not your bank, not the government, not the police, and not a tech support company. A “safe account” is always a scam.
Two more rules go with it:
- No one gets the code. Banks send one-time codes so you can prove it’s you, in the real app or website. No real bank employee, including one from a fraud department, will ask you to read one to them.
- Call back on a number you already know. Hang up, and call the number on the back of your card or on your statement. Never use a number from the text or the caller.
Lock the doors, before anyone calls
A few free steps make you much harder to target:
- Turn on account alerts in your bank’s real app, and check any alert by opening the app yourself, never by replying.
- Turn on two-step verification for your bank and your email.
- Name a trusted contact at your bank, someone they can call if they’re worried about fraud. That person can’t see or move your money.
- Freeze your credit at Equifax, Experian, and TransUnion. It’s free, and you can lift it when you need to.
If you already moved money
Call your bank immediately, at the number on your card, and tell them it was fraud. Speed matters. Report it at ReportFraud.ftc.gov. If you’re 60 or older, the Department of Justice’s National Elder Fraud Hotline, 1-833-372-8311, can help you report it and find support. Then tell someone you trust. Scammers count on embarrassment to keep people quiet, and every story told makes the next person a little safer.
