Warning Bank Fraud (2 Viewers)

[CraigT78]

Hey y'all - just wanted to warn everyone of a fraud that I fell for today. I'm pretty security conscious and this one got me. Received a call from Wells Fargo today claiming they were with the fraud department and wanted to verify that I had written a large check. He started the call by sending a verification text that came in on a text number that had several former verification codes from Wells Fargo. I read the code back, and he confirmed the dollar amount of the check (he read it to me) and the check number. I verified that we did indeed authorize that. He said we were all set and hung up. There were no red flags - no broken English, caller ID said Wells Fargo as it is stored in my contacts (only reason I answered it) and he had the check number and dollar amount.

Flash forward an hour later and my Gmail is blowing up with spam for all these websites I have signed up for. Hundreds. Knowing that I did not do anything out of the ordinary, I immediately checked my financial sites. Guess what? There was a wire out of my checking account for the amount of $5,000.

Apparently they spoofed the 800 number, and the verification code was them initiating the wire (although it did not say that in the text). Ironic thing is that when I called to report the fraud, they sent the same verification message - so not sure where I could have learned my lesson here

Not sure how access to my account was gained - I use secure strong passwords and a unique password for every site on the internet. But figured I would post this warning - if it helps one person to not have to deal with this fiasco - it was worth my time typing it out.

 

[Mongoose]

Damn, sorry to hear you’re going through this. The scams get more sophisticated all the time. It sounded legit. However, someone told me the best thing to do is hang up and then call the bank (whoever) yourself and ask if this is true. Hope things shake out okay for you!

 

[abby99]

Inside job?

I've never had someone call me and ask me to read back a texted verification code. When I had an issue with my Chase credit card, they sent me a text and an email and asked me to reply by text/email or call them at the number on the back of my credit card.

I think the standard advice is to say you need to call them back, and use a phone number that you know to belong to the bank.

I'm so sorry to hear about this. The crooks are so good these days and have so many tools to fool us with, that an extra dose of paranoia wouldn't hurt any of us. The real bank personnel will understand our caution. The crook won't.

Thank you for the warning!

 

[v1pe]

Wow, I'm a bit confused as to what actually might have happened...but thanks for the heads up!

What kinds of emails were you getting? Like someone was signing up for accounts using your email for a bunch of sites?

I'm confused about how the phone call you were on could have authorized a wire transfer, if they were just having you re-read a text message number.

The check that they were calling about was indeed one that you had written? I hope that you can get your money back!

 

[EnjoyLife]

Sorry to hear this. The only thing that would have alerted me was that they called you and then sent a verification code to that same phone. I only get requested a verification code, if I initiated the transaction. Hopefully you don't have to put up much of a fight and the wait to get your funds back isn't too long.

 

[Mongoose]

The fact that they were able to gain access to your account is scary Maybe I’ll change my password again now!

 

[ruskba]

Wow, I'm a bit confused as to what actually might have happened...but thanks for the heads up!

What kinds of emails were you getting? Like someone was signing up for accounts using your email for a bunch of sites?

I'm confused about how the phone call you were on could have authorized a wire transfer, if they were just having you re-read a text message number.

The check that they were calling about was indeed one that you had written? I hope that you can get your money back!

The callers needed the verification code, so they pretended to be the fraud dept so he’d read them the code.

 

[Tommy]

Sorry to hear this Craig. Thanks for the head up.
Could be a number of ways they got your info but public wifi and infected mobile apps are at the top of the list lately.

The callers needed the verification code, so they pretended to be the fraud dept so he’d read them the code.

Was just thinking that.

 

[ReallyGoodUsername]

Really sorry to hear that happened. I’ve heard of spoofing contact numbers before unfortunately so it looks like it’s getting more popular.

My only thought on the verification code is if somehow they had already broken into your account and while on the phone with you triggered the verification code from (the real) Wells Fargo then typed in the code as you were saying it. Aka bypassing the 2-way verification via you.

FYI about another scam: My sister’s work’s email server got hacked so the fraudsters knew everyone’s title in the company and schedule. They used this to pinpoint one of the head financial employees, texted her via another finance employees number, used their access to their work calendars to make it seem like it was the actual contact whose number they were spoofing, saying something like “I can’t make that 2pm meeting on Wednesday with the vendor” then saying that the employee whose being scammed needs to wire $$$$ to a new vendor ASAP.

Really hard to spot stuff. Luckily just by chance the scammed employee before getting back to the scammers called the other employee (not even about the wire) and mentioned it on the call where the other employee of course said wtf are you talking about.

 

[arch3r]

The callers needed the verification code, so they pretended to be the fraud dept so he’d read them the code.

This.

The caller got access to to well fargo site. Wanted to issue the transfer but needed the 2-step verification code that got sent to the phone number on record. Call the number, and pretend to be fraud dept, asked about a check which they can see since they have access to account. Begin transfer. Access code sent to the phone and then ask for the verification code. It's given to them and then then use that to 'prove' they are the account owner and have access to the phone. Pretty good scam. Would get most people I would assume. Would have fooled me. Thanks for sharing so we can all be on the lookout for shit like this and I'm very sorry and mad that this happened to you Some people just suck.

 

[CraigT78]

My only thought on the verification code is if somehow they had already broken into your account and while on the phone with you triggered the verification code from (the real) Wells Fargo then typed in the code as you were saying it. Aka bypassing the 2-way verification via you.

This is what they suspect has happened - but it raised no flags because Wells Fargo sends the verification code every time I call. The only difference was they called me. And that's the difference that I missed.

 

[ReallyGoodUsername]

This is what they suspect has happened - but it raised no flags because Wells Fargo sends the verification code every time I call. The only difference was they called me. And that's the difference that I missed.

I would have fallen for the same thing hook line and sinker.

 

[ruskba]

Yea the whole thing is fucked. Not much you can do when they’ve already got full access to convince you they’re legit.

 

[Zmasterben]

This.

The caller got access to to well fargo site. Wanted to issue the transfer but needed the 2-step verification code that got sent to the phone number on record. Call the number, and pretend to be fraud dept, asked about a check which they can see since they have access to account. Begin transfer. Access code sent to the phone and then ask for the verification code. It's given to them and then then use that to 'prove' they are the account owner and have access to the phone. Pretty good scam. Would get most people I would assume. Would have fooled me. Thanks for sharing so we can all be on the lookout for shit like this and I'm very sorry and mad that this happened to you Some people just suck.

And then flood the OP's email with spam so the verification email that the money has been transfered gets buried and OP can't see it in time if ever.

Still need a 1-800 number showing up as Wells Fargo on caller ID though. This is the one part I don't really get but it is probably a case of this is easier to do than the average person realizes.

 

[CraigT78]

And then flood the OP's email with spam so the verification email that the money has been transfered gets buried and OP can't see it in time if ever.

This is what alerted me. And it did cause me to miss the wire transfer email. Thankfully it alerted me to check my accounts, and we caught it same day.

 

[Lemonzest]

Damn that sucks. These guys are getting too good.

 

[Mongoose]

Sophisticated scam=pros. Ass*****!!!

 

[ReallyGoodUsername]

Still need a 1-800 number showing up as Wells Fargo on caller ID though. This is the one part I don't really get but it is probably a case of this is easier to do than the average person realizes.

They can spoof any number they want 000-000-0000 to 999-999-9999 so all they needed to do was know the Wells Fargo Fraud number which I'm sure is listed on their website and spoof that number.

 

[TheWhiteJZ]

That is crazy. Sorry and thanks for the warning!!

I sat on a jury prosecuting a guy who lead a ring of ppl who scammed people with underwater mortgages in like 2010. They are sophisticated and I learned so much about how they operate. Since then technology has really changed and the scammers are crazy clever.

 

[Zmasterben]

They can spoof any number they want 000-000-0000 to 999-999-9999 so all they needed to do was know the Wells Fargo Fraud number which I'm sure is listed on their website and spoof that number.

And I just learned how to do it after 4 minutes of googling.

(EDIT: Oh and BTW it is technically 100% legal. The intent to do it is the part that is potentially illegal, like to commit fraud in the OP's example)

Glad to see security is really keeping up with technology.

MY ID was just stolen 4 times as I wrote this.

 

[Highli99]

Wow thanks for sharing this. Good luck and very sorry this happened.

 

[arch3r]

My paypal was hacked about 6-8 months ago. And since it was linked to my checking account, they were able to drain almost $10k from me. Luckily I caught it pretty quickly with all the emails and phone alerts and called paypal right away. They were really helpful and reverse all the transactions and put the $10k back into my checking account the next day. Then they went after the person(s) who scammed me.

Hopefully Well Fargo is a good with their customers.

 

[One Eyed Dollar]

Wow, thanks for sharing the story. This reminded me of something in a text from Capital One with my verification code, so I went back and looked. My last 2 texts from them, going back to June 17th, both start with: "Capital One won't call you for this code. The temporary code you requested is..." So I guess these guys have been running this kind of scam for over a month and doing it often enough that Capital One updated their message to start with that warning. My messages before June did not have that warning.

 

[CraigT78]

What kinds of emails were you getting? Like someone was signing up for accounts using your email for a bunch of sites?

 

[CraigT78]

The actual Wells Fargo Fraud department said they only send the verification code on inbound calls. They will not send the code when they call out to a customer. Good to know......now.

 

[Señor Tony]

What's the process like for getting your funds back??

 

[ReallyGoodUsername]

The actual Wells Fargo Fraud department said they only send the verification code on inbound calls. They will not send the code when they call out to a customer. Good to know......now.

If I get one of these I'm just going to keep making up codes or giving them colors instead of numbers fuck scammers!

Here's a guy who led scammers on until they realized it he was fucking with them and flipped out. It's quality stuff:

 

[Zmasterben]

Wow, thanks for sharing the story. This reminded me of something in a text from Capital One with my verification code, so I went back and looked. My last 2 texts from them, going back to June 17th, both start with: "Capital One won't call you for this code. The temporary code you requested is..." So I guess these guys have been running this kind of scam for over a month and doing it often enough that Capital One updated their message to start with that warning. My messages before June did not have that warning.

Just checked too. Looks like Capital One has been doing the "Capital One won't call you for this code" message since at least January 2019.

For all of their flaws, Capital One has always had good fraud protection. I've had my credit card info stolen once and they caught it immediately from a $2 vending machine purchase and shut my card down and sent me a new one next day.

 

[WedgeRock]

The callers needed the verification code, so they pretended to be the fraud dept so he’d read them the code.

Yep, that is what I was thinking. They initiated the wire and the legit Wells Fargo sent him the code. The scammers called him and conned him into reading them the legit authorization code.

They can spoof any number they want 000-000-0000 to 999-999-9999 so all they needed to do was know the Wells Fargo Fraud number which I'm sure is listed on their website and spoof that number.

I just ported my family's cell phone numbers and while I am waiting for the last one to port, I'm putzing around in my account. I see the option to make my outgoing Caller ID to say anything I want it to say. If I can do that legitimately, it must be pretty easy to do illegitimately.

BTW, if your Caller ID says "All The Chips," please answer. That's me.

 

[FDLmold]

Time to put all my assets in cash. Can't scam me for electronic things I don't have! Hello E*Trade? Yes I want you to send me the stock certificate. Yes I realize nobody has requested that since 2001.