The scam is quite a production and includes several acts. Act 1 starts when scammers send someone an automated text message similar to the following: “Free Msg- (Insert financial institution name here) Bank Fraud Alert- Did You Attempt an Instant Payment in the amount of $5,000.00? REPLY YES or NO or 1 To STOP ALERTS.”
The agency says the payment amount and financial institution name changes from victim to victim. If a target replies to the text message with “No,” then a follow-up message is sent out by the scammers that says, “Our fraud specialist will be contacting you shortly.”
Act 2 begins when the victim takes the bait and answers a call from the so-called “fraud specialist.” One thing a target might notice is that the scammer seems to know a lot about them.
“In these schemes, background information on the victims appears to have been well researched. In addition to knowing the victim's financial institution, the actors often had further information such as the victim's past addresses, social security number, and the last four digits of their bank accounts,” IC3 officials said.
Things get tricky when we get to Act 3. It starts when the scammer instructs the victim to remove their email address from their digital payment app. The actor also asks for the victim's email address and adds it to a bank account that they control.
“After the email address has been changed, the actor tells the victim to start another instant payment transaction to themselves that will cancel or reverse the original fraudulent payment attempt,” the IC3 officials warn. “Believing they are sending the transaction to themselves, the victims are in fact sending instant payment transactions from their bank account to the actor-controlled bank account.”
After the curtain comes down and the money is in the scammer's bank, agency officials say the scammers have been known to stay engaged with victims for several days to leave them with the feeling that they did nothing wrong.
Recommendations
The FBI suggests that everyone use the following precautions when getting any text message that seems to come from their bank or a payment application company:
Be wary of unsolicited requests to verify account information. Scammers are good at using email addresses and phone numbers; that's why it might seem like a message is coming from a legitimate financial institution. The IC3 says anyone who receives a call or text message regarding possible fraud or unauthorized transfers should NOT respond directly. Instead, they should contact the institution through a verified source.
“Contact the financial institution's fraud department through verified telephone numbers and email addresses on official bank websites or documentation, not through those provided in texts or emails,” the agency suggests.
Enable Multi-Factor Authentication for all financial accounts. Enabling multi-factor authentication can help protect your account, but make sure you do not provide your code or password to anyone over the phone. PayPal users can use this guide to help set up multi-factor authentication, and Venmo users can use this resource.
Be skeptical of unsolicited messages. Financial institutions will never ask customers to transfer funds between their accounts. Even if the source seems to have a lot of personal information about you, that doesn't mean that they're legitimate. The IC3 says the proliferation of large-scale data breaches over the last decade has allowed criminals to compile mountains of personal data to use in their schemes.