Your phone rings. Your caller ID shows the name of your bank, so you answer. A concerned customer service worker tells you that, to ensure your government stimulus funds get to you, he needs to confirm a few bits of information. You gladly hand it over, reassured to know your bank is looking out for you.
Congratulations. You’ve just been robbed.
The Secret Service and Visa say that, since the beginning of the coronavirus pandemic, they’ve seen a rise in sophisticated phone scams in which fraudsters imitate victims’ banks to obtain key security information, then drain their accounts. They’re urgently warning Americans to be even more cautious than usual about sharing sensitive information, even if they think they’re talking to someone trustworthy.
Above all, they warn victims that no bank or government agency will ever call them and ask for sensitive information, making such questions a sure sign of a fraud attempt.
Con artists are revving up operations of all sorts that exploit coronavirus fears or steal relief funds directly. But bank impersonation may be the most frightening: The combination of crisis-driven anxiety and highly sophisticated fraudsters mean even cautious people can become victims.
“It’s anyone and everyone,” says Lori Hodges, vice president of risk for Visa in North America. “Students, professionals, the elderly.” Hodges says she’s even aware of fraud-prevention professionals who have fallen victim.
The con’s opening gambit—using a caller ID that appears to come from the target’s bank—can be accomplished using a variety of methods, including through Internet-based phone services, or VoIP. From there, the thieves, posing as bank representatives, will claim they need to confirm the victim’s identity, either to speed delivery of relief funds, or even to help stop fraud. But the information they ask for is really intended to help them divert funds or gain access to your bank account.
The scam, a form of “voice phishing,” is so insidious in part because fraudsters have access to huge amounts of information about their victims.
“They already know enough about you to get a conversation going,” says Thomas Edwards, a special agent in charge with the Secret Service. That can include even sensitive information such as Social Security numbers, quickly convincing victims that the call is legitimate.
Criminals have the info thanks to the many data breaches over the past decade. Hodges specifically cites incidents like the 2017 Equifax hack as a source of data fraudsters can now leverage to gain victims’ trust.
“Then they’re going to try and get other information,” continues Edwards. That may include asking for the answer to your bank security questions, your ATM personal ID number, the three-digit security code on a debit or credit card, or a one-time security code sent by your (real) bank.
Once they get that information, thieves will drain your account “as fast as they can, through multiple channels,” says Hodges. That can include simply pulling out cash through an ATM using a fake debit card, or taking over your bank account directly and transferring funds out.
Luckily, there is a simple way to avoid being a victim.
“Do not give any personal information to people who are calling you inbound,” says Hodges. “If you have questions about that call, hang up and call your bank back directly.” While banks may ask you to verify your identity in some way if you call them, she says, they will not request security information if they’re calling you.
The same goes for any caller claiming to be from a government agency, says Edwards. “The government, IRS, or Treasury are not going to contact businesses to arrange a stimulus check. There’s no reason to entertain these calls.”
Attorney General William Barr has directed U.S. law enforcement and federal attorneys to focus efforts on catching coronavirus scammers during the crisis. To aid that effort, Edwards urges any victims, even of relatively small scams, to report crimes to the National Center for Disaster Fraud, a special agency in the Department of Justice.
“Losing $300 or $500 might not seem like a big deal to some of us,” says Edwards. “But we’re trying to put together pieces of the puzzle. Every piece of data counts.”
More must-read tech coverage from Fortune:
—How the coronavirus stimulus package would change gig worker benefits
—Zoom meetings keep getting hacked. How to prevent “Zoom bombing”
—Why China’s tech-based fight against the coronavirus may be unpalatable in the U.S.
—Hospitals are running low on the most critical supply of all: oxygen
—Listen to Leadership Next, a Fortune podcast examining the evolving role of CEO
—WATCH: Best earbuds in 2020: Apple AirPods Pro Vs. Sony WF-1000XM3
Catch up with Data Sheet, Fortune’s daily digest on the business of tech.
