San Diego, CA - It is getting very phreaky. Miscreants incessantly phishing and pharming on the phone and over the internet, looking for credit card numbers, personal identification numbers (PIN) and the three to seven digit security numbers off of the backs of cards.
 
The ICFE became aware of a new, clever, telephone approach where the caller asks a few questions, and tells the targeted consumer they are processing a credit of almost $500 because one of their credit cards may have been improperly used. Wow, a $500 credit will make most cardholders take notice and initially listen to the unknown caller.

In this scheme, the caller has already acquired the victim's credit card number(s), name, address, telephone number, and etc. They are calling because they need just one more thing to begin spending the remainder of an available credit line, and that is the security PIN on the back of the card, a seven digit number. The last three are the PIN and therefore the most important for a thief to possess.

This newly uncovered phishing scenario plays out this way: The individual calling says, "This is (gives a name), and I'm calling from the security and fraud department at VISA. My employee ID badge number is 3736214."

Next comes an omnious warning. "Your VISA card has been flagged for an unusual purchase pattern, and I'm calling to verify some things. This would be on your VISA card which was issued by (the name of your bank)." The victim gradually lowers their guard because the caller knows the name of their credit card issuer. "Did you purchase an anti-virus software program with a personal firewall for $497 from a sales and marketing company based in Georgia?" the caller asks.

When the target consumer responds "No", the caller will continue with, "Then we will be issuing a credit to your account. This Georgia based telephone boiler room outfit is a company we have been watching. The bogus charges range from $297 to $497, which just under the $500 purchase pattern that flags most cards," the caller authoritatively explains. "Before your next statement, the credit will be sent to (then gives the card holder their address), is that correct?"

The cardholder says "yes". The caller continues - "I will be starting an internal fraud investigation. If you have any questions, you should call the 1-800 number listed on the back of your card (1-800-VISA) and ask for the security department. You will need to refer to this control number." The caller then gives the victim a six digit number. "Do you need me to you read it again?" the caller politely inquires.

The main event, when the consumer gets phished, is next. The caller then says, "I need to verify you are in possession of your card". He or she will ask the cardholder to "Turn the card over and look for some numbers. There are seven numbers; the first four are part of the card number, the next three are the security numbers' that verify you are the possessor of the card," the caller calmly explains. "These are the numbers you may sometimes use to make Internet purchases to prove you have the card in your possession." Then the caller will ask the victim to read the three numbers back to them.

After the cardholder tells the caller the three numbers, the caller will say, "That is correct, I just needed to verify that the card has not been lost or stolen, and that you still have your card in your possession. Do you have any questions?" After the cardholder responds, the caller then thanks them and states, "Don't hesitate to call back if you do," and disconnects.

The victim cardholder actually says very little, and is never asked to tell the caller their debit or credit card number. The cardholder usually feels secure this was a legitimate call and rarely calls back. Those intuitive cardholders who do call the bona fide VISA Security Department are told the call was bogus and just another scam. More upsetting however, during that call the cardholder is often told a new purchase of $497 was recently charged to their card.

If you are on the receiving end of such a call, do not give out ANY security numbers. Make verifiable fraud report to the issuer involved and immediately close the account(s) in question. VISA or MasterCard will reissue a new number. What the crooks really want is the three-digit Security PIN number on the back of the card. Don't give it to anyone who calls you.

Instead, tell the caller(s) you will call VISA or MasterCard directly for verification of their conversation. VISA and MasterCard security departments tell the ICFE they would never ask for anything on the card as they already know the information because they issued the card! This writer recently received a call from the security department at my bank about a number of transactions made within a two hour span, which is unusual for me. They asked me to about usage to verify they were legitimate, but never asked me for any sort of ID PIN numbers on the backs of the card.

When the scammers on the phone get a three Digit PIN Number, the victim cardholder may think they're going to be receiving a credit. However, by the time they get their statement they'll see charges for purchases they didn't make, and by then it may be too late and, perhaps, much more difficult to actually file a fraud report and undo the bogus purchases.
Should you receive a call like this, hang up immediately.