Let’s talk about a scam that reminds us why it’s important to verify unexpected requests even when they appear to come from a trusted source.
A recent victim shared how they received a phone call from someone claiming to be from their bank. The caller knew their name, bank, and even that they were travelling. They explained that the account had been compromised and offered to help secure it.
The conversation sounded convincing. Security checks were performed, verification codes were requested, and the caller remained on the phone for hours to build trust.
It was all a scam.
The attacker wasn’t trying to steal a password. Instead, they manipulated the victim into authorizing transactions and adding new payment recipients by convincing them the verification codes were part of a security process.
Even someone with a strong technology background fell victim.
How the Attack Works
This is a form of social engineering known as vishing (voice phishing).
Instead of attacking systems, criminals target people by pretending to represent trusted organizations such as banks, government agencies, or even your employer.
Their goal is to create urgency, build trust, and persuade you to take actions that compromise your own account.
Warning Signs to Look Out For
Be cautious if someone unexpectedly:
- Claims your account has been compromised.
- Creates a sense of urgency or pressure to act immediately.
- Asks you to read out or enter verification codes.
- Requests that you approve transactions or security prompts.
- Encourages you to stay on the phone while completing security steps.
- Claims to be from your bank, Microsoft, or another trusted organization without prior contact.
Legitimate organizations will never ask you to disclose verification codes or approve actions you did not initiate.
How to Protect Yourself
If you receive an unexpected call about your account:
- Stay calm and do not feel pressured to act immediately.
- Never share verification codes, one-time passwords (OTPs), or authentication prompts.
- End the call if you are unsure.
- Contact the organization using an official phone number, such as the number on the back of your bank card or the company’s official website.
- Report any suspicious calls or messages to the appropriate team.
Taking two minutes to verify could prevent significant financial loss.
Common Thinking to Avoid
- They knew my personal details, so they must be genuine.
- They sounded professional.
- They’re trying to help protect my account.
- They already know so much about me.
Attackers often gather publicly available or previously compromised information to make their stories more believable.
Final Reminder
Cybercriminals no longer rely only on malicious links or fake websites.
Sometimes, the attack begins with a convincing phone call.
Trust should never be based solely on what someone says or what they appear to know.
Pause before you act.
Verify before you trust.
A quick call to an official number could save you from becoming the next victim.
🔐 CyberDesk – Protecting Our Digital Workplace
