Islanders and bank targeted in a new telephone scam

By Steve Myrick
Published: October 16, 2008

The phone rings, maybe in early afternoon, maybe a few minutes before midnight. A computer generated voice, several generations behind current voice generating technology, offers a digitalized "Hello," and pitches directly into an ominous message. "This is a message from Martha's...Vineyard...Savings...Bank. Your card has been suspended. For verification to reactivate your card, please press one, and you will be transferred to the security department."

It is all a sophisticated scam, intended to trick Island residents into transmitting sensitive information about their bank accounts. Those who continued further with the recorded message were asked to key in their account number, card expiration date, and personal identification number (PIN). Anyone who did, heard the numbers read back by a recorded voice with a vaguely British accent, and was asked to verify that the numbers were correct. At the end of the process, they got an official sounding confirmation.

"Your card has been reactivated. "Thank you for your time. Goodbye."

It is impossible to confirm how many Vineyard homes received the bogus calls last Thursday and Friday. But local police departments were swamped with reports of the scam, and he Martha's Vineyard Savings Bank fielded many inquiries. The Martha's Vineyard Times received many reports of the calls, and received at least 10 of the scam calls on various numbers in its Vineyard Haven newsroom early Friday afternoon.

Some knew immediately it was a scam. "No bank is going to call you at midnight," said Rob Gatchell of Oak Bluffs, who got the call at 11:51 last Thursday night. "There's no savings account that's that much of an emergency."

Yet others, even the most cautious of consumers, were nearly fooled by the official sounding message.

Niki Patton, who operates a computer consulting company called User Friendly, often advises her clients on various computer scams. She had just opened an account at the Martha's Vineyard Savings Bank, so the recorded message seemed like it might be legitimate at first.

"I was ready to go," said Ms. Patton. "It's rare that something is good enough that I might punch into it. Some intuitive thing in my head said wait a minute."

Protect yourself

"Vishing" scams are not always easy to spot, but there are several common themes that should alert you to fraud.

Most communications will include something that will concern or excite the victim. In this case, it was a card suspended, in others it will be news of a lawsuit, or notification that you've won a lottery or prize.

The calls will also require some urgent action, but may not immediately try to get your personal information. Some calls may direct you to a phone number where scammers will try to talk you into giving up your information.

Though the calls may have some elements of truth, they usually do not include specific personal information about the victim, such as your name or account number.

To verify whether the call is legitimate, call your bank or visit its website, using phone numbers or Internet addresses from you bank statement or account documentation. Do not call back a number provided over the phone, or click on a link in email.

Never give personal information to someone who contacts you. Make sure you initiate the contact, and the institution verifies your identity with questions only you would know.

For more information on protecting your identity and financially sensitive information, the Federal Trade Commission (FTC) maintains a helpful website. The page with advice to avoid phone and e-mail scams is http://www.onguardonline.gov/topics/
phishing.aspx.

You can call the FCC at 1-877-ID-THEFT (1-877-438-4338), to file a complaint about identity theft.

If you have been the victim of a scam, file a complaint at the Internet Crime Complaint Center (IC3) by email at www.IC3.gov.

Accounts secure

Richard Leonard, chief operating officer for the Martha's Vineyard Savings Bank, assures customers there has been no breech of account security, and a spokesman for the bank said no customer lists were compromised. Scammers apparently targeted the bank by automated random dialing of Island phone numbers, he said, and many who received the calls were not customers of the bank.

"There has been no breach," said Mr. Leonard, speaking on Friday afternoon. "We've had two customers that entered information, and we cancelled their cards and issued new ones."

The bank spent much of Friday dealing with concerned customers. "Our staff and customers have handled it very calmly," said Mr. Leonard. "It hasn't been a major headache, but we're concerned."

The bank moved quickly to head off the scam by posting an alert on its web site. (http://www.dukesbank.com/Fraud-Alert.asp)

Other Island banks also received calls about the confusing messages. "They're simply targeting Island residents," said Greg Berks, chief operations officer for the Edgartown National Bank. "We have had no reports that they are using our bank name."

Anatomy of a scam

The Internet Crime Complaint Center (IC3), a joint effort of the FBI and other federal agencies, issued an intelligence note about this kind of scam in January.

"These attacks against US financial institutions and consumers continue to rise at an alarming rate," said the statement. Similar scams have popped up in hundreds of places across the United States, often targeting small community banks or credit unions.

Investigators say the scammers are taking advantage of a relatively new technology called Voice over Internet Protocol (VoIP) to make the scam virtually untraceable. They may be based outside the United States. The scam is common enough to have a new name: vishing, or voice phishing. VoIP technology allows people to make voice phone calls over the internet, instead of more traditional land lines. It is not difficult for the scammers to create phone numbers far removed from their actual location, or even use a computer infected by a malicious virus, without the computer owner even knowing about the scam.

Once the scammers have an account number, PIN, and expiration date, they could easily make purchases over the phone, and in some cases make cash withdrawals from the account. There is also a lively trade among scammers in selling bundles of stolen bank or identification information to other con artists.

The scammers design their pitch to include a nugget of truth, and depend on a large number of calls tricking just a few people. When someone who has an account and a debit card with the Martha's Vineyard Savings Bank received the random calls, they sounded authentic, though it was simply a coincidence.

"The bank is the largest bank on Martha's Vineyard with the most deposit relationships," said Mr. Leonard. "Statistically, our customers are going to get the most calls."

Mr. Leonard worked with their phone company Friday to trace the calls, but that effort proved fruitless.

As always, the best protection, is to guard personal information closely.

"People have to realize," said Mr. Leonard. "a bank would never ask you for information they already have."