The call that says it is us
Caller ID is a label the caller chooses. It has never been evidence of anything.
The most effective fraud we see does not involve hacking. It involves a phone call that appears to come from us, from someone calm and professional who says there has been suspicious activity on your account and they need to verify a few things.
They know your name. They may know the last four of your card, or where you shopped last week, because that information leaks from a hundred places that are not us. The knowledge is what makes the call credible, and it is the cheapest part of the operation.
The one question
Everything that follows is designed to get one thing: a one-time code, a password, a PIN, or a full card number. That is the entire purpose of the call. The alarm, the urgency, the account numbers they recite back to you — all of it exists to get you to the moment where you read six digits aloud.
A real one-time code is something you just requested and are typing into our app yourself. If someone is on the phone asking you to read one out, they are sitting at a login screen with your username, and the code you give them is the door.
What to do, every time, without exception
Hang up. Then call a branch yourself, using a number you found on your own — from your card, your statement, or by walking in. Do not call back the number that called you and do not use a number the caller gives you.
If the call was real, nothing is lost by hanging up. A real fraud department will have the case waiting when you call back. Nobody at Greendale will ever be annoyed that you hung up on them to verify. We would rather you did it every single time.
Urgency is the tell
Every version of this scam runs on time pressure, because thinking is what kills it. Your account will be frozen. The transfer must be reversed in the next ten minutes. Do not tell anyone or you will compromise the investigation — that last one is aimed squarely at the branch employee or family member who would otherwise stop it.
No legitimate institution needs you to act within minutes, and none will ever ask you to move money to keep it safe. More in the security center.