Fraudsters pose as bank employees, police to steal debit, credit card details, CVV, OTP; how to identify a 'fraud' call

A new type of bank fraud has been making rounds, especially targeting debit and credit card users. This fraud at first starts with a pre-recorded call informing you about a certain large-value transaction that has been conducted using your debit or credit card. Moreover, as a goodwill gesture, the fraudster impersonating a bank officer will offer to 'assist' you in lodging a cyber complaint in regard to this transaction. To do this you need to press #9 on the dialer. In reality neither the bank which issued the card nor anybody from the bank initiated this call and the whole thing is a fraud.

Here's how the fraud happens

The scam starts with a simple automated voice call to your mobile number. Through this automated call, you are informed that a certain high-value transaction, say Rs 2 lakh, etc. was spent using your credit card, press #1 to confirm or #9 to speak with bank representatives and report this 'supposed' transaction. Banking on your fear of losing money, the fraudsters hope that you press #9 and when you do, that is when the scam turns into a fraud.
When you press #9, a person claiming to be from the credit card issuing bank offers to help you with the supposed high-value transaction, he/she (the fraudster) builds up a fake story. He may tell you that this particular transaction (Rs 2 lakh) happened a few minutes ago in a retail outlet in a city. They have called you to verify whether you have done this transaction or not.

The fraudster may even go one step further and inform you that another high-value transaction, say Rs 1.5 lakh, took place using your credit card a few hours back.

The scamster will try to convince you that you have already lost Rs 1.5 lakh. Now if you don't take any immediate action, you are going to lose another Rs 2 lakh. The fraudster, the alleged representative of the bank, will also pressurise you to file a complaint immediately to stop the alleged transaction of Rs 2 lakh. Naturally, you will be a little anxious to know that you have been scammed and somebody is using your credit card for high-value transactions. Sensing your fear and anxiousness, the fraudster will jump into the occassion to help you with the fraud. Now he will offer you help to lodge a complaint on your behalf with the bank and police.

"The scamster is essentially trying to assure the customer that the fraud detection worked here and that he is trying to help the customer with the transaction. The narrative is that of fear and immediacy. They are building a story here that they have to act quickly otherwise this transaction will go through. Since the amount is large this also creates some fear in the customer's mind," says Ashok Hariharan, Co-founder & CEO, IDfy, an Integrated Identity Platform.

Sharing his experience, Somasroy Chakraborty, a senior communications professional based in Mumbai said on LinkedIn, "This afternoon, my lunch was suddenly interrupted by an unexpected phone call. An automated voice informed me that Rs 45,515 was spent on my credit card. "Please press #1 to confirm, or #9 to report. I immediately pressed #9 to report the incident. Mukesh Chauhan, the customer service executive, followed the routine process of confirming my name and date of birth before explaining that my credit card was used minutes ago in a mobile shop in Chennai. He further informed me that the card [XX3345], which I never received, was issued to me on July 19, 2024, from the bank's Andheri branch and has already been used for transactions worth Rs 1,46,554. Don't worry, sir! We are immediately blocking this card and initiating an investigation. Meanwhile, kindly file an FIR with the cybercrime cell of Mumbai police," Mukesh said to calm me down. He shared his employee code [CCS40328] and branch [Church Gate] before transferring the call. The call was connected to the cybercrime cell but there was so much background noise that I was hardly able to hear. The police representative advised me that we should continue our conversation on WhatsApp since he could not hear anything. That's when I realised that I was being conned on the pretext of an imaginary fraudulent transaction on an imaginary card and disconnected the call."

"Bank officials or its representatives will never ask for any OTPs, Passwords, PINs, Card details or any other sensitive information when assisting customers with lodging a cyber complaint or any other customer service-related issue. such payment request are clear signs of a fraudulent attempt. Bank has strict protocols in place, ensuring that no sensitive information is requested. If a customer receive such request or demand of payment , it is a red flag and should be treated with suspicion," says Manish Agrawal, Senior Executive Vice President – Credit Intelligence and Control, HDFC Bank.

How to prevent such banking frauds: Key things to keep in mind to avoid scams

According to Vikram Babbar, Partner, EY Forensic & Integrity Services - Financial Services, here is what you should do to prevent such frauds:

• Avoid clicking on unfamiliar links and never disclose your banking OTP to anyone.
• Be vigilant when conducting digital transactions and verify the authenticity of the transaction details.
• Obtain phone banking numbers directly from your bank's official website or documents to avoid falling prey to fraudulent numbers posted by scammers on search engines.
• Seek guidance from a tech-savvy family member or friend, particularly if you are a senior citizen and unfamiliar with digital banking practices.
• Create a separate bank account exclusively for online transactions, including digital payments, UPI, and e-wallets, and maintain only a modest balance to minimise financial risk.

Shikha Goel IPS, Director General of Police (DGP), CID & Women Safety Wing, Director Telangana Cyber Security Bureau & Telangana FSL says, "If you get a video call from a supposed police officer, remember that no police or any other law enforcement agency ever makes a video call. Also, if this officer shows you his/her ID, note down the details and call up the Police control room and ask them to verify the details. This is because fraudsters pretending to be police officers might attempt to scam you."

Says Agrawal, "HDFC Bank's Vigil Aunty campaign plays a pivotal role in educating a broad audience about safe banking practices, particularly in the digital era. As digital banking becomes increasingly common, it is crucial for customer to remember following points to protect themselves from unknowns:

1. Do not click on unknown links in SMS/Email/Messages as they may be a phishing link to steal your data and money.

2. Do not download screen sharing Apps from unknown sources as this can be used to steal data from devices and install malware

3. Do not share personal bank details like OTP, CVV, PIN, Password and Card Details with anyone. Bank or its representatives do not ask for such personal details.

4. Do not fall prey to schemes/jobs/discounts/help offers which require a payment to be made or requires you to share your personal banking credentials.

5. Do not fall for unknown calls, SMS, Email, Social Media accounts and advertisements offering rewards, investment opportunities, part-time jobs, commissions or easy money for task completion and remote work. The customer's needs to be aware of "Too good to be True" offers and they should pause, think before they act and click on links to download any unknown applications, fill any forms or register on unknown sites to avail any offers or initiate investments. Fraudsters collect the customer's confidential and bank related information to misuse it for fraudulent purposes. "

According to Babbar who is also the chairman of Association of Certified Financial Crime Specialists (ACFCS) India chapter, people in certain age groups are the target audience for this type of scam. "Certain vulnerable groups such as the elderly, students, and those less familiar with technology may not be aware of the existence of such scams or may lack the technical knowledge required to identify fraudulent calls. Scamsters tend to target customers who have stressful jobs or have to meet tight deadlines, as they may be more susceptible to deception during stressful times. Moreover, Fraudsters craft compelling stories that seem credible. They may gather detailed information about a customer, such as their profile, age, transaction habits, and account details, from the bank's records to make their pitch appear more convincing," he says.

What are banks doing to combat this problem?

According to Anis Ahmed, chair of the MENA chapter for the Association of Certified Financial Crime Specialists (ACFCS) and the host of The Fraud Fellas, an anti-fraud forum, "Some large banks in the Middle East and Asia deploy robotic calls as a security measure to alert customers about potential fraudulent transactions. However, it's important to distinguish these legitimate calls from the fraudulent ones used by scammers to trick victims. While robotic fraud calls might not be a global problem, they remain a prevalent tactic employed by criminals. Banks and institutions are increasingly aware of the threat posed by fraud calls and are implementing various measures to combat them. For this MO, awareness is the most effective way, providing customers with information about common fraud tactics and how to protect themselves. Additionally, some institutions deploy multi-factor authentication and biometrics to enhance account security."

"The problem of fraudulent calls has arisen in India lately. I have seen several cases where the fraudsters managed to dupe people of multiple of crores of Rupees. I would like to inform people that no law enforcement officer ever asks for transfer of any money to any account for any purpose including for verification purpose for alleged involvement in any crime/ illegal activity," says Goel.