I was surprised. She is by no means stupid, but she got relieved of £450 in an "unusual activity on your account" scam. They caught her when she was hard at work on an important project (she works mostly from home) and I must say, they were good!
The first danger sign (distinct foreign accent, poor English) was not there. The caller seemed to be not just British, but English.
They had her full name, her address, her bank card details down to the security code on the back and told her (didn't ask for) what bank she used, the sort code and I think she said they even had her account number. The "unusual activity" was an Airport hire car rental. Unfortunately, because she was flustered she fell for the "we need the one-time code, to stop this transaction" spiel. Unlike me she doesn't have time to watch programmes such as Scam Interceptors and the like or she would have known better. When I get such a call, I say "Thank you for telling me. I will contact my Bank directly" and put the phone down - as I know this will really upset the scammers.
She was wondering afterwards how all her details had leaked. Her card was still safely in her bag. She shreds anything with her name and address or other sensitive information on when it is finished with. She doesn't bank online and only uses trusted sites when purchasing online.
Her efforts at figuring out how this had happened led to an unsettling discovery, although whether the two are connected is uncertain.
After a bit of Googling, she dived into the depths of her Facebook account. Hidden deep in the depths, she discovered they have been keeping not only what she has knowingly told them but so much more besides. Every purchase she has made on Amazon and other sites, for instance. There was information there she knew she had not imparted to Facebook directly or had not expected them to keep. Every site she had visited in the last month was listed. She had no idea. She always goes for the "Essential cookies only" option on sites. Perhaps they have a different view of what is Essential and why was Facebook trawling that information anyway? She found just about everything a scammer would need to know.
Finding out how to stop them hoarding this information took even more effort.
Thankfully, her bank made good the loss very quickly, but it has really shaken her up. I don't think they will catch her out again with that particular scam and I hope she will be more wary generally, in the future.
One puzzle (apart from their identity) remains. As far as I can make out, the scammer must have called her on her work phone. She doesn't have a land line and she told me she had to go and fetch her own phone, with the "required one-time code" from another room. How did they get the number? But that is a question for the Security people where she works.
So, people out there, be very, very careful. Those nasty pieces of scum, the scammers, are getting really good.
