WBEZ and the Chicago Sun-Times are taking your questions about all things money. Then, every Monday, we answer your personal finance-related question.
This week, we’re solving a problem sent in by Dan in Irving Park:
I was contacted in early April from an 855 number that said they were from AT&T and that there were fraudulent charges on our account. They already had the account number and the phone numbers attributed to that account. The only things I gave them over the phone were multiple authentication codes. They, in turn, used those codes to hack into the account and transfer the data of the phone line attributed to my sister. Within 24 hours, she lost access to her phone.
Scams like this one are becoming more common — and harder to detect. How do they happen? And how can you suss them out?
Scammers usually have a plan
Steve Bernas, president and chief executive officer of the Better Business Bureau of Chicago and Northern Illinois, says scammers often build profiles on their victims and have a lot of information before attempting a scam like the one experienced by Dan.
“They just don’t say, ‘I’m going to go after this person,'” Bernas says.
Thieves often get information through data breaches or email phishing — that’s when they send emails that aim to trick people into clicking on a compromised link and following the directions there to provide personal information that a scammer will then use.
Rise of two-factor identification scams
Convincing people to give information that will help a scammer obtain a security code as part of a two-factor identification process is a recent scam that’s being seen across the country, according to Bernas, who says it’s been reported on the BBB’s “Scam Tracker.” The tracker lets people check on the likes of pet scams, consumer fraud lawyers, pyramid schemes and Cash App scams as well as report their own experiences being taken for a ride.
“The scammers found a way to manipulate the two-factor authentication,” Bernas says. “Basically, that is what I call the ‘master key.’ Once they get that information, they can manipulate your account, take control of your phone, and basically your phone will be useless and not available at all.
“They take control over your cellphone without having your cellphone. So I think consumers don’t realize the magnitude of this particular scam and how devastating it could be.”
Hang up
The key advice here is that you should never do what someone calling out of the blue asks you to do in response to a supposed hacking of one of your accounts or another problem that the caller says requires you to give information to prevent further harm.
Bernas says scammers call this “the tipoff to the ripoff.”
The caller says they’re going to help you and might even have arranged to make it seem, through caller ID, to be phoning from a legitimate business.
But Bernas says scammers can change the caller ID to make it look like it’s coming from a real business, then make you think you’re a victim of a scam and push you to act — right away.
That push to act quickly should raise an immediate red flag.
“That’s when they start taking advantage of you because you put your guard down,” Bernas said. “When it’s actually the criminal going after your information. And you’re allowing them access into it.”
So, if you get a call out of the blue from someone saying your account has a problem, hang up immediately.
And then, Bernas says: “Contact your carrier, contact your bank, your mortgage company directly on the numbers you know — 99 times out of 100, it’s going to be a scam.”
If it really was the company, Bernas says, the caller should be able to help you immediately — and not need you to provide a security code to get into your account.