Clever scammers and HSBC
Discussion
My wife's debit card was subject to a fraud attempt today. HSBC spotted it, called her and stopped her card. So far, so good.
This evening, "HSBC fraud department" texted her asking her to call them back. She got through to a young English sounding chap, who went through security with her. She was suspicious and would not give him any details outside of her name, just because she knows that there are a lot of scammers about. So he offered to give her some digits from her DOB and again some letters of her password, she was to give him the rest. The numbers and letters her gave her were correct. So she gave him the remaining digits.
She was still suspicious, so she gave me the phone and I spoke to him. He was cool as a cucumber and said all the right things, notably that he could only speak to the card holder but gave me some general details about her account to reassure me. I did not suspect him, and I speak to banks most days.
The only point at which we both became suspicious was when he came back and asked for information that he had asked for only moments earlier - though to be fair, HSBC has done that to me many times - and he seemed to be stalling.
I tried to call HSBC whilst she was talking to him, but as usual there was a long queue. Simultaneously, I googled the 0800 number he was calling from and the "Who Called Me" site said it was an HSBC number. Except, when you read down the comments other people said it was a scam. https://who-called.co.uk/Number/08000852401
So,
1. The scammers knew that my wife's debit card had been scammed (presumably because they did it) and they texted her about her credit card, using a spoofed number for which they have created a "Who Called Me" entry to legitimise.
2. Somehow, they also had her DOB and password.
3. The "HSBC agent" who took the call was absolutely word perfect. Like he works in a bank.
4. The scammers know how long it takes to contact HSBC and rely upon that fact, so that people don't just try to call back on HSBC's main number.
Fortunately, when the REAL HSBC answered they had spotted what was going on and bounced transactions to Flannels (clothing shop) and Deliveroo. Not a penny has gone missing, though my wife has transferred her account balance to me to be sure.
I have to admit to being quite impressed with how convincing it all seemed.
This evening, "HSBC fraud department" texted her asking her to call them back. She got through to a young English sounding chap, who went through security with her. She was suspicious and would not give him any details outside of her name, just because she knows that there are a lot of scammers about. So he offered to give her some digits from her DOB and again some letters of her password, she was to give him the rest. The numbers and letters her gave her were correct. So she gave him the remaining digits.
She was still suspicious, so she gave me the phone and I spoke to him. He was cool as a cucumber and said all the right things, notably that he could only speak to the card holder but gave me some general details about her account to reassure me. I did not suspect him, and I speak to banks most days.
The only point at which we both became suspicious was when he came back and asked for information that he had asked for only moments earlier - though to be fair, HSBC has done that to me many times - and he seemed to be stalling.
I tried to call HSBC whilst she was talking to him, but as usual there was a long queue. Simultaneously, I googled the 0800 number he was calling from and the "Who Called Me" site said it was an HSBC number. Except, when you read down the comments other people said it was a scam. https://who-called.co.uk/Number/08000852401
So,
1. The scammers knew that my wife's debit card had been scammed (presumably because they did it) and they texted her about her credit card, using a spoofed number for which they have created a "Who Called Me" entry to legitimise.
2. Somehow, they also had her DOB and password.
3. The "HSBC agent" who took the call was absolutely word perfect. Like he works in a bank.
4. The scammers know how long it takes to contact HSBC and rely upon that fact, so that people don't just try to call back on HSBC's main number.
Fortunately, when the REAL HSBC answered they had spotted what was going on and bounced transactions to Flannels (clothing shop) and Deliveroo. Not a penny has gone missing, though my wife has transferred her account balance to me to be sure.
I have to admit to being quite impressed with how convincing it all seemed.
My roommate at uni fell for a similar scam involving a text from HSBC 'alerting' him to possible fraudulent activity, etc. He logged in using the link from the text and few hours later his account was empty, luckily the actual HSBC fraud team worked their magic and he got all his money back. He's a bright lad so I'm surprised he fell for it, I guess anyone can slip up after a long day, good to hear all ended well for you and your wife 
On the other hand, I tried to pay a deposit for some roofing work. It was like the Spanish Inquisition to set them up as a payment. The bank had to phone me and grill me. It made me feel totally guilty, and stumbling over my words. I know they are protecting me, but god was it a trial.
ghamer said:
Not really that clever banks dont call and discuss details.They just don't.So don't engage these plebs.
Except they do. They did this morning, when my wife's debit card was compromised. Much the same dialogue as this evening, except the genuine HSBC agent was Indian and difficult to understand, whereas this evening's scammer was British and articulate.
Perhaps my wife should have spotted that it wasn't HSBC when she got through immediately and the person answering was both English and seemed to know what he was doing.
SuperNads said:
Have you considered that both calls were part of the scam?
Yes.But the HSBC agent I spoke to this evening confirmed that this morning's call wasn't a scam.
Furthermore the Lady Balfour's money was still in her account this evening. That was until I persuaded her to transfer it all to me for safe keeping.... mmmmmmwahahahaahahahaha.
Louis Balfour said:
Yes.
But the HSBC agent I spoke to this evening confirmed that this morning's call wasn't a scam.
Furthermore the Lady Balfour's money was still in her account this evening. That was until I persuaded her to transfer it all to me for safe keeping.... mmmmmmwahahahaahahahaha.
Ah, so you're in on it But the HSBC agent I spoke to this evening confirmed that this morning's call wasn't a scam.
Furthermore the Lady Balfour's money was still in her account this evening. That was until I persuaded her to transfer it all to me for safe keeping.... mmmmmmwahahahaahahahaha.
ghamer said:
Not really that clever banks don't call and discuss details.They just don't.So don't engage these plebs.
I would not be so confident in that, although not a bank, credit card companies do.My wife received a text asking her to confirm a recent transaction on her credit card. She hadn't made the transaction and I can't remember the exact sequence of events. She may have had an option on the text to reject the transaction. The next thing her phone rings with someone claiming to be from the credit card company. She confirms her name and then they ask for other information, she looks as me and then asks the caller how she can be sure this isn't a scam? The caller advisers her to hand up and call the number on the rear of her credit card.
Sure enough, call the number of the rear of credit card and fraudulent transactions were being made on her credit card.
Lesson for me here is, if you haven't called them and you mention you are concerned about being scammed and they don't tell you to hang up and call a number you can get independently, then it's a scam. Either way, hand up on them and call the number a number you are confident is legitimate.
I'm super cautious, but it's easy to get caught out. And HSBC do call you. If you phone them to organise a large transfer for a car purchase for example, at some point they'll say they have to go off and make checks and as part of their process to check you are who you are.
Chicken and egg. They can't trust that you're not a scanner and you can't trust that they aren't.
Bert
Chicken and egg. They can't trust that you're not a scanner and you can't trust that they aren't.
Bert
Years ago I got call from mbna asking me where my card was, it’s in my pocket I replied, no it’s not they said. I checked and indeed it was there but they then explained a new card had been issued to me and mine was now cancelled.
Turns out that some scammer had reported my card lost, somehow intercepted the replacement that was sent to my address and accessed my online banking which was protected by a proper long random password.
8k went on it over 3 days in the apple shop in Greys, miles away from where I live, and the highest amount that had previously ever been on that card was just 2 - 300.
They also had a couple of copies of my paper statement.
Once mbna put a stop to it, they even tried calling up to get it reactivated. I spoke to the same fraud person at the bank that the scammer had, and she caught them out by asking which non uk country the card had recently been used in, they got that wrong.
No idea how they did it, but guess it must have had inside help.
Turns out that some scammer had reported my card lost, somehow intercepted the replacement that was sent to my address and accessed my online banking which was protected by a proper long random password.
8k went on it over 3 days in the apple shop in Greys, miles away from where I live, and the highest amount that had previously ever been on that card was just 2 - 300.
They also had a couple of copies of my paper statement.
Once mbna put a stop to it, they even tried calling up to get it reactivated. I spoke to the same fraud person at the bank that the scammer had, and she caught them out by asking which non uk country the card had recently been used in, they got that wrong.
No idea how they did it, but guess it must have had inside help.
Pedro Raynard said:
ghamer said:
Not really that clever banks don't call and discuss details.They just don't.So don't engage these plebs.
I would not be so confident in that, although not a bank, credit card companies do.My wife received a text asking her to confirm a recent transaction on her credit card. She hadn't made the transaction and I can't remember the exact sequence of events. She may have had an option on the text to reject the transaction. The next thing her phone rings with someone claiming to be from the credit card company. She confirms her name and then they ask for other information, she looks as me and then asks the caller how she can be sure this isn't a scam? The caller advisers her to hand up and call the number on the rear of her credit card.
Sure enough, call the number of the rear of credit card and fraudulent transactions were being made on her credit card.
Lesson for me here is, if you haven't called them and you mention you are concerned about being scammed and they don't tell you to hang up and call a number you can get independently, then it's a scam. Either way, hand up on them and call the number a number you are confident is legitimate.
ClaphamBoxS said:
Be sure to use a different phone than the one you received the scam call on…they can keep the line open so when you think you have hung up and dial a number in reality it is still live on the scam call…nearly got caught out on that a while ago…
I only have one phone so wouldn't have that option. However, if I was suspicious I'd simply call a completely different number from my contacts - if some random answered as if they were my bank / credit card company that would be proof enough.I think the reason yesterday's attempt was so effective was that it appears to have been complex. They had pulled together a number of factors to make it work and then executed it well.
They
1. Leveraged a genuine fraud attempt to persuade Lady B that another was happening on another card.
2. Spoofed HSBC's fraud department number, or otherwise created a "Who Called Me" page suggesting that the number was legitimate.
3. Had her card details.
4. Had her date of birth.
5. Had her password.
6. Had a very practised "HSBC agent" who was extremely calm and well-rehearsed.
I have been subjected to many fraud attempts and they have generally been fairly easy to spot. But not this one. I am not quite sure what information they lacked to complete the fraud.
They
1. Leveraged a genuine fraud attempt to persuade Lady B that another was happening on another card.
2. Spoofed HSBC's fraud department number, or otherwise created a "Who Called Me" page suggesting that the number was legitimate.
3. Had her card details.
4. Had her date of birth.
5. Had her password.
6. Had a very practised "HSBC agent" who was extremely calm and well-rehearsed.
I have been subjected to many fraud attempts and they have generally been fairly easy to spot. But not this one. I am not quite sure what information they lacked to complete the fraud.
Louis Balfour said:
I think the reason yesterday's attempt was so effective was that it appears to have been complex. They had pulled together a number of factors to make it work and then executed it well.
They
1. Leveraged a genuine fraud attempt to persuade Lady B that another was happening on another card.
2. Spoofed HSBC's fraud department number, or otherwise created a "Who Called Me" page suggesting that the number was legitimate.
3. Had her card details.
4. Had her date of birth.
5. Had her password.
6. Had a very practised "HSBC agent" who was extremely calm and well-rehearsed.
I have been subjected to many fraud attempts and they have generally been fairly easy to spot. But not this one. I am not quite sure what information they lacked to complete the fraud.
How do you know they had her password? If they went through standard security then they would be asking her for the password.They
1. Leveraged a genuine fraud attempt to persuade Lady B that another was happening on another card.
2. Spoofed HSBC's fraud department number, or otherwise created a "Who Called Me" page suggesting that the number was legitimate.
3. Had her card details.
4. Had her date of birth.
5. Had her password.
6. Had a very practised "HSBC agent" who was extremely calm and well-rehearsed.
I have been subjected to many fraud attempts and they have generally been fairly easy to spot. But not this one. I am not quite sure what information they lacked to complete the fraud.
If they told her her password, then that's a true shocker.
I could be wrong, but I had assumed that even the bank staff can't access that. they only get to input it to confirm, or know a small selection of characters?
ghamer said:
Not really that clever banks dont call and discuss details.They just don't.So don't engage these plebs.
Interestingly HSBC fraud did call me (though it was a few years ago) and did want security questions, I refused and called back the number on the back of my card, using a different phone to avoid the line camp scam, and indeed it was HSBC questioning some flights I had just paid for, then cancelled and paid for again (due to my f
kup).They were suitably apologetic about calling and asking for details.
Forums | Speed, Plod & the Law | Top of Page | What's New | My Stuff