I practiced what I preach.
The other day, I got a call from my bank. They wanted to talk to me about a suspicious transaction.
They said it was my bank, but was it? It certainly started with the hallmark of a scam.
So, here’s what I did.
Did my bank really call me?
A call claiming to be from your bank can look totally real, caller ID and all. Hang up and call your bank back yourself before sharing anything. If the caller balks at that, then they’re a scammer, and you’ve just dodged a bullet.
The call
The call came in on my cell phone, and caller ID identified it as my bank1. The woman at the other end indicated she was from my bank and wanted to talk to me about a specific transaction that looked a little suspicious.
So far, she:
- Clearly had my telephone number.
- Was either with my bank or knew where I banked.
- Had identified a specific transaction amount — $500 — that was, indeed, in my recent activity.
It sounded like she was about to ask me for more information when I came to a halt. I realized that there were a few red flags (at least orange flags).
I decided it was time to take my own advice.
Help keep it going by becoming a Patron.
Never trust an incoming call
I say it often: you cannot trust an incoming call, particularly when it’s about something important like banking.
- My phone number is easy to get.
- Caller ID is easily faked.
- Where I bank could easily be leaked or available somewhere. (To anyone to whom I wrote a check or made some other form of payment, for instance.)
- $500 is a nice round number, likely to show up in most people’s accounts. Had I said I’d not found it, perhaps some crafty questioning would lead me to identify a “close enough” transaction.
There was nothing at that point that absolutely confirmed that I was talking to my bank and not a scammer.
My reaction
Once I realized the situation, I told the person:
Let me research this a little and then call my local branch to straighten it out.
This was the moment of truth. A scammer would balk and try, perhaps desperately, to keep me on the line. That’s not what happened. Instead, the person replied:
OK, that’s fine. I’ll forward the information on to your branch and they can help you.
Perfect. Not the response of a scammer. This likely was my real bank.
Nonetheless, I said thank you and terminated the call.
My next step
I emailed my bank2.
To: My Bank Contact
Subject: Got a call from {bank} about a billpay
Given that cold calls FROM a bank are often step one of a scam, I told them I’d contact you. 🙂
Since they were OK with that and would forward the info to you, I suspect it’s not a scam, but better safe than sorry.
Anyway, they were asking about a $500 bill pay I added I think yesterday. If it’s to “Revolut”, it’s legit, and I’m topping off a prepaid backup credit card. If there’s some other kind of problem, let me know.
It didn’t take long for a response to arrive.
From: My Bank Contact
It was a legit call, but I definitely understand the apprehension. Apparently there is a lot of fraud with Revolut cards. The criminals open the card under a pseudonym and then load them with stolen funds. You don’t think that way because you aren’t a crook. Revolut is also a great way to have an extra payment option when you travel. We will make sure the payment is made.
Confirmed and dealt with.
But something surprised me.
Wait, fraud?
This statement caught me by surprise:
Apparently there is a lot of fraud with Revolut cards. The criminals open the card under a pseudonym and then load it with stolen funds.
While my contact said I don’t think that way, I feel that, given the job I do, I really should think that way, just not act that way. 
To be clear, this is not an issue with Revolut3. They’re quite legit, and I’ve used them for years. I suspect any independent prepaid credit or debit card could be used for the same thing: money laundering.
But when you add that possibility to the equation, my bank’s caution makes total sense.
Do this
What I want you to take away from this is pretty simple but very important.
- Don’t trust incoming calls.
- Instead, contact the claimed institution, like your bank, directly.
- If the call is legit, the caller won’t mind. (But do it anyway.)
- If they balk and try to keep you on the line, hang up and contact the institution to find out if there’s anything to be concerned about.
It’s unfortunate that this is the world we live in, but those rules are one step to keeping you safe.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Podcast audio
Footnotes & References
1: I love my bank, for reasons you’ll see, but I’m not going to mention them by name. Being what I refer to as a “Z-list” celebrity publishing on the internet, I don’t want a few trolls trying to contact them and impersonate me.
2: Yes, email. One of the reasons I love smaller, local banks is that type of personal service; it’s not a thing of the past.
3: See how easy it is for information to leak? You now know I have a Revolut card. With a $500 balance, to boot!
Why did you email your bank instead of phoning? I always phone my bank with questions. The banker on the other end resolves it while we’re talking, and I know the resoultion instantanly.
I have a good relationship with the banker (branch manager). It’s just how we most commonly communicate.
I had this happen many years ago with my bank calling me. They would always ask for my full name, DOB and my address. I always declined and said I don’t give that information over the phone. Then I would ask them to prove they are from the bank. They would just say that they already told me that, so I would say then I have already told you who I am, if it’s good enough for you to just say you are the bank, then it’s just good enough for me to say who I am. They would then say that they would give me a number to call, I would say, so you are going to give your mate’s number so you can continue to scam me? They never had an answer to that. In the end I went to my local branch and told them if the bank ever wanted to call me, I would ask them for a password, one that I gave them to put on file. Anytime someone rang from the bank, I would ask them for the password, then I would know if it was legit or not. My attitude has always been that if I ring you, I am happy to give you the information you want to identify me, but if you ring me, I treat you as a scam until I hear the password.