I got a call from my bank claiming that they're discontinuing physical credit card statements and asking for my email to send statements via email. Then they proceeded to also ask for my date of birth and home address to "verify details" after making the unsolicited call. It felt off but the call came from within the bank. When I said I don't want to give the information over this call, they implied that I'll be inconveniencing myself and will have to go to a physical branch to verify my details and be able to receive credit card statements via email.
If the bank is actually initiating this, they shouldn’t be asking for personal info like DoB or home address over unsolicited calls. To the person receiving the call, it sounds like a phishing or social engineering attempt.
My assumption is that the bank's process is flawed and this wasn't a phishing attack. Can anyone recommend what best practices banks can follow to ensure safety for both customers and banks in such cases?
If they cannot do that then its a scam or you should change banks
Don't do this either. If the caller was a scammer, they can give you a number that would call them back, and now they have you "hooked" because you think you've called your bank, when you really called the scammer back.
Call them back on a number printed on your statements or a number you retrieve, independent of this caller, from the bank's website.
Scammers can spoof calling numbers to make it look like it came from your bank. Basically everything they say on the call should be treated as being fraudulent. The scripts have been tailored to use a variety psychological tricks to fool you.
Anyone who threatens you with fines/arrest/whatever for ending the call early is a scammer.
For example Equifax's TheWorkNumber won't do this (companies that don't do background references/verification of employment use this service), and their representatives and processes seem to follow similar practices employed by scammers.
Anyways. Remember, you are in charge. You can always say you need to hang up and call the branch. If the service issue is serious, it can be handled at the branch or via an officially published bank phone number.
Trust no inbound call.
Imagine the cost of calling every single client individually. If something like this would change, they would send a letter.
Don't forget that spoofing caller ID of telephone numbers is possible.
Their contact info should be easy to find.
https://www.patelco.org/financial-wellness/fraud-center/fina...
Biggest take-away:
3. Don’t share your personal information when you didn’t initiate the conversation
Whether by text, email, or phone, WE will never call you for personal information like:
We may call you to verify something, but we won’t ask you for the information above unless you initiate the conversation or request we contact you.They would call you and then want to verify themselves to you. You would be asked to open the companies app. The app noticed you were in a support call and had a link at the top taking you to the support section of the app. The caller would then read you a code you would type in and it would let you know if the call was legit.
The only proper way is to send push to that app with the information about the issue.
This kept going on for about a year, the legal limit they can chase a debt, so at that point they gave in and share the details and as it happens, it wasn’t me. Don’t even own a car, which I mentioned multiple times.
Anyways, I’d never share my details over the phone if I’m not fairly certain who’s in the other side. This company was legit but had very suspicious tactics.