San Diego, CA - It is getting very
phreaky. Miscreants incessantly phishing and pharming on
the phone and over the internet, looking for credit card
numbers, personal identification numbers (PIN) and the
three to seven digit security numbers off of the backs of
The ICFE became aware of a new, clever, telephone approach
where the caller asks a few questions, and tells the
targeted consumer they are processing a credit of almost
$500 because one of their credit cards may have been
improperly used. Wow, a $500 credit will make most
cardholders take notice and initially listen to the
In this scheme, the caller has already acquired the
victim's credit card number(s), name, address, telephone
number, and etc. They are calling because they need just
one more thing to begin spending the remainder of an
available credit line, and that is the security PIN on the
back of the card, a seven digit number. The last three are
the PIN and therefore the most important for a thief to
This newly uncovered phishing scenario plays out this way:
The individual calling says, "This is (gives a name), and
I'm calling from the security and fraud department at
VISA. My employee ID badge number is 3736214."
Next comes an omnious warning. "Your VISA card has been
flagged for an unusual purchase pattern, and I'm calling
to verify some things. This would be on your VISA card
which was issued by (the name of your bank)." The victim
gradually lowers their guard because the caller knows the
name of their credit card issuer. "Did you purchase an
anti-virus software program with a personal firewall for
$497 from a sales and marketing company based in Georgia?"
the caller asks.
When the target consumer responds "No", the caller will
continue with, "Then we will be issuing a credit to your
account. This Georgia based telephone boiler room outfit
is a company we have been watching. The bogus charges
range from $297 to $497, which just under the $500
purchase pattern that flags most cards," the caller
authoritatively explains. "Before your next statement, the
credit will be sent to (then gives the card holder their
address), is that correct?"
The cardholder says "yes". The caller continues - "I will
be starting an internal fraud investigation. If you have
any questions, you should call the 1-800 number listed on
the back of your card (1-800-VISA) and ask for the
security department. You will need to refer to this
control number." The caller then gives the victim a six
digit number. "Do you need me to you read it again?" the
caller politely inquires.
The main event, when the consumer gets phished, is next.
The caller then says, "I need to verify you are in
possession of your card". He or she will ask the
cardholder to "Turn the card over and look for some
numbers. There are seven numbers; the first four are part
of the card number, the next three are the security
numbers' that verify you are the possessor of the card,"
the caller calmly explains. "These are the numbers you may
sometimes use to make Internet purchases to prove you have
the card in your possession." Then the caller will ask the
victim to read the three numbers back to them.
After the cardholder tells the caller the three numbers,
the caller will say, "That is correct, I just needed to
verify that the card has not been lost or stolen, and that
you still have your card in your possession. Do you have
any questions?" After the cardholder responds, the caller
then thanks them and states, "Don't hesitate to call back
if you do," and disconnects.
The victim cardholder actually says very little, and is
never asked to tell the caller their debit or credit card
number. The cardholder usually feels secure this was a
legitimate call and rarely calls back. Those intuitive
cardholders who do call the bona fide VISA Security
Department are told the call was bogus and just another
scam. More upsetting however, during that call the
cardholder is often told a new purchase of $497 was
recently charged to their card.
If you are on the receiving end of such a call, do not
give out ANY security numbers. Make verifiable fraud
report to the issuer involved and immediately close the
account(s) in question. VISA or MasterCard will reissue a
new number. What the crooks really want is the three-digit
Security PIN number on the back of the card. Don't give it
to anyone who calls you.
Instead, tell the caller(s) you will call VISA or
MasterCard directly for verification of their
conversation. VISA and MasterCard security departments
tell the ICFE they would never ask for anything on the
card as they already know the information because they
issued the card! This writer recently received a call from
the security department at my bank about a number of
transactions made within a two hour span, which is unusual
for me. They asked me to about usage to verify they were
legitimate, but never asked me for any sort of ID PIN
numbers on the backs of the card.
When the scammers on the phone get a three Digit PIN
Number, the victim cardholder may think they're going to
be receiving a credit. However, by the time they get their
statement they'll see charges for purchases they didn't
make, and by then it may be too late and, perhaps, much
more difficult to actually file a fraud report and undo
the bogus purchases.
Should you receive a call like this, hang up immediately.
About the ICFE:
The Institute of Consumer Financial Education (ICFE) was founded in 1982 by the late Loren Dunton (creator of the Certified Financial Planner (CFP) designation). The ICFE is dedicated to helping consumers of all ages to improve their spending, increase savings and use credit more wisely.
The ICFE is an award winning, nonprofit, consumer education organization that has helped millions of people through its education programs and Resources. It publishes the Do-It-Yourself Credit File correction Guide, which is updated annually. The ICFE has distributed over one million Credit/Debit Card Warning Labels and Credit/Debit Card Sleeves world wide.
The ICFE became an official partner with the Department of Defense/Financial Readiness Campaign in June of 2004.The ICFE was an active partner in the California Student Debt Resource Awareness Project (CASDRAP) which resulted in a new web site: (studentdebthelp.org). CASDRAP disbanded in 2010, shortly after the web site project was completed. In 2011 the ICFE assumed the single sponsorship of the (studentdebthelp.org) web site and is now responsible for its content and operation.
The ICFE is also an on-line help for consumers who spend too much. ICFE's spending help was featured in PARADE Magazine in the Intelligence Report section. The money helps and tips are from the ICFE's Money Instruction Book, our course in personal finance.
Visit the ICFE's other web sites at: www.financial-education-icfe.org and studentdebthelp.org. Both sites helps consumers and students with mending spending, learning about the proper use of credit, budget and expense guidelines, how to set up and implement a spending-plan and also how to access financial education courses and how to teach children about money. Other ICFE services include: Ask Mr. G, a free eNews, and an online resource center for students, parents and educators, plus financial education learning tools and a book store.