It Can Happen to Anybody and It Just Happened to Me

About an hour or so ago my mobile phone rang - it was an 800 number calling. I was dubious, but answered just in case (I've got a couple of things on the go right now). It was a recorded message from Visa Security advising me of two charges to my credit card today. It listed the amounts, mentioned that one was for gift cards and the fact that I had no history of purchasing gift cards had triggered the call. Press 1 to accept the charges, press 2 to decline (or the reverse... I can't remember.). It was clear, professional, and so absolutely convincing that I hung up and called my bank. They were quite interested and eventually confirmed that it was indeed a phishing call.

I don't know what would have happened if I'd pressed the decline number but I suspect I'd have been connected to an agent who would have confirmed my details, etc.. and then they'd have owned my credit card. (assuming I gave them my details, that is) The call was convincing enough that I'll bet many people do.  I'm lucky - I work in IT Security and I learned long ago not to trust anything, especially when it's a phone call and it involves my personal / financial information.  Even then, it was hard. 

So...what should you do?

Start by listening very carefully to what is being said.  You'll likely pick up clues that suggest the call is random; things that a real caller should know.  Second, especially if the caller is a real person and not a recording, take note of all the instructions, details, etc. and then hang up and call your bank (or whomever the caller impersonated) on a number you get from a bank statement, Internet search, etc.. Do not call back using a number provided by the caller.   Your bank  WILL be very  happy to hear from you and they will confirm for you whether or not the call was legitimate.   If the suspicious caller is a real person, and they're a scammer, they will try very hard to keep you on the line. A legitimate caller will understand your plan and will encoiurage you to hang up and call back via a published phone number.  Don't let yourself be bullied.

What happens if you realise, after the fact, that you may have been scammed?  Your first call is to your financial institution  (or whomever the caller was impersonating) to report what happened.  After that you may, depending on what happened, end up reporting the incident to your local law enforcement agency.  It's very important that you do so.  Behind the scenes, law enforcement at different levels are compiling / sharing intelligence on the gangs that do these sorts of crimes and every bit of information they receive is helpful so please make the call and report what happened.