Key FraudTalk^SM

[00:00:09] Kolt: Hello, welcome to the KeyBank FraudTalk podcast. I’m Kolt.

[00:00:12] Stacie: And I'm Stacie.

[00:00:14] Kolt: We've launched this new series to help our audience stay current on the continually evolving and increasingly sophisticated fraud scene. In each episode, we'll bring on subject matter experts to discuss a new fraud topic or an emerging threat to help listeners like you be aware of trending scams, the red flags to watch out for, and measures you can take to help protect your personal data and financial accounts. Thank you for joining us today.

[00:00:36] Kolt: So let's get started. Stacie.

[00:00:38] Stacie: Yeah.

[00:00:39] Kolt: Things that we’re seeing across the industry. Bank impersonation scams. Can we talk about those? Tell me what those are and how they evolve?

[00:00:46] Stacie: Sure. So the typical bank imposture scam will start with a text message, typically from your bank, right or reach out, a phone call. But a lot of these start with the most impersonated area of a bank right now as part of these social engineering scams is the Fraud Department, and so you might get a text message that asks you to authorize a $900 transaction at Walmart, for instance, right at any retailer. And you'll say, oh, no, I didn't do that. And then they'll call you immediately. And say we're from, you know, the bank fraud department and we're going to get you all cleared up, right. And the entire time, all they're doing is phishing information out of you, right? Getting credentials, yeah.

[00:01:38] Kolt: So we've seen this evolve and kind of talked about this years ago you would get these and they'll be some bank that you never banked with. And be like, I don’t bank with that mega bank, nice try, right, they did say no and they were really just trying to spray and pray is what we call it and hit somebody with that. Now, they’re getting a lot more targeted. How is it that these bad actors know who I bank with and they can impersonate that financial institution?

[00:02:05] Stacie: Sure, there's lots of ways Kolt, so it could be as simple as stealing your mail and seeing that you have a statement. Right? And then Googling your phone number for on any of the, you know, just Googling your phone number, finding your information and giving it a whirl. But sometimes it's through breach data, right. So if your card number was breached, the first 6 digits of your card number are indicative. It's called a bin number and it's indicative of the bank from which that card was issued so fraudsters can figure that stuff out. They're pretty savvy and they know exactly which bank they need to be impersonating in order to perpetrate their scheme.

[00:02:46] Kolt: Right. So that the data breach notification that I just got from my telco provider that said my payment information was compromised and maybe my name, but none of my personal information, that's enough for them to start sorting out, this is bank A. This is bank B, this is bank C and being able to target those. That's pretty interesting as long as we're on this. So a lot of times it's a text message that is coming to me. What should I be looking for in those text messages that might kind of brought me to know that it's not my financial institution and I'm going to talk about short codes that are being used.

[00:03:24] Stacie: Yeah, your bank, your financial institution is not going to reach out to you from what looks like a personal phone number or a personal e-mail address. Yes, you're going to receive financial institution notifications from short codes, right? So it could be a 5 digit number at the top. It could be that you get all of your messages from you know typically or it could be a three digit number with a dash and two more digits, something like that. So it's not going to be your typical phone number and it certainly is not going to be an international phone number that’s extremely long. So I think it's really fair to say if you're receiving text messages asking you to click on a link or take some action and it comes from a standard phone number of any kind or an e-mail address, don't respond. Right, don't. Don't reply. Just report as junk and delete is the safest way to go.

[00:04:18] Kolt: All right, so you've heard about direct contact via phone, right? So I spoofed the phone number. It looks like my bank is calling me and they'll say something like my bank’s fraud department, there's always a sense of urgency with. So whenever I answer that call, what's typically going to happen if it's a fraud actor or bad actor, what are they going to start trying to solicit from me? Like from an emotional state or information?

[00:04:47] Stacie: Sure. They're going to try and collect personal information that they can leverage to perpetrate their scheme. So let me give you a little bit more info. So the first, they're going to try and get your username and password right. Sometimes they might actually try to get your pin number. They're going to ask for information like your Social Security number. They're going to ask for, maybe your mother's maiden name, your date of birth. They're going to do things, and they're going to do it under the guise of I need to authenticate you. Right. So they're going to ask you the questions that a real bank would ask you if you called the bank and they needed to authenticate you. So they need those elements to be able to pass our authentication when they commit the fraud. So this is really important. Point is not giving information out to people who call you.

[00:05:36] Kolt: You said something that I’d like to touch on. Whenever you call us as a bank, we’re going to ask you for those things. When we’re calling you, we're not going to ask you. Either way, we’re not going to ask you for your password or your pin number right? The PIN numbers in the IVR, but we're never gonna ask for that kind of info.

[00:05:51] Kolt: So that's really good. OK, so on these and that I wanted to talk about a real-life use case that actually a fellow fraud fighter, who is a professional, actually fell in. He had reached out just like you talked about and he knew better. And one of the things he's always been taught is if my financial institution calls me, it is to hang up and call my financial institution so that I don't become a victim of this and I think we would tell everybody. We were we will never get upset with you. We actually encourage you to say that like let you call and we will get you redirected back to the Fraud Department if you call in and on some of these you'll find out like we never called you. But there's a little and you talked about social engineering like working on your emotions, giving you a sense of urgency or putting something in front of you that you just don't realize got put in front of you and on this one scenario is our fellow fraud fighter said. Hey, I'm going to call back the bad actor. Very polished, very well, skilled said we agree with you. That's exactly what we want you to do. Encourage them to do so. That said, let me just double check to see what the hold times are, so that you know what you’re getting into whenever that occurs and I cannot block your account until we hear back from you. The hold times are 75 minutes.

[00:07:06] Kolt: And all logic went out of his head, thinking if this is legit and everything sounded pretty good here. I could have a lot of fraud happening on my account, before they can get this closed up.

[00:07:18] Kolt: He fell for that and started giving them his information. I think he ended up losing like $1,500 with that, but that's the type of social engineering that we're talking about the level of sophistication and evolving fraud has really advanced over the last 5-10 years or even the last 18 months.

[00:07:36] Stacie: That's exactly right. They're savvier than ever. We talked about how the misspellings and the language problems with some of the schemes back in the day with AI being able to help you right, measurably better. We're just not seeing it looks, it sounds it.

[00:07:52] Stacie: Feels everything feels like it's legitimate, which is why you need to stop. Think, hang up and call your bank.

[00:07:59] Kolt: Listen, Stacie, I really appreciate the time today. That's all for today's episode. We hope you found this discussion on bank impersonation informative if you're a KeyBank client or not visit our Fraud Protection Center at key.com/fraud and please share this podcast with others.

[00:08:16] Kolt: If you're a KeyBank client and you think you may have been a victim of fraud. Contact the KeyBank Fraud Client Service Center at 1-800-433-0124. For those that use TTY or TRS, dial 711.

[00:08:29] Kolt: Don't forget to subscribe to Key FraudTalk for more insight on cybersecurity and financial protection. As a reminder, this content is for informational purposes only. It's not financial, legal, or investment advice. For guidance specific to your situation, please consult a qualified professional.