Bank scammers using genuine push notifications to trick their victims


You receive a call on your phone. The polite call centre worker on the line asks for you by name, and gives the name of your bank. They say they're calling from your bank's fraud department.

"Yeah, right!" You think. Obvious scam, isn't it? You tell the caller to do unmentionable things to a goat. They sigh.

"I can assure you I'm calling from Chase bank. I understand you're sceptical. I'll send a push notification through the app so you can see this is a genuine call."

Your phone buzzes. You tap the notification and this pops up on screen:

`In app popup. "Are you on the phone with Chase? We need to check it's you on the phone to us. Let us know it's you and enter your passcode on the next screen. @ Not you? Your details are safe. Just tap 'No, it's not me' and we'll end the call."`

This is obviously a genuine caller! This is a genuine pop-up, from the genuine app, which is protected by your genuine fingerprint. You tap the "Yes" button.

Why wouldn't you? The caller knows your name and bank and they have sent you an in-app notification. Surely that can only be done by the bank. Right?

Right!

This is a genuine notification. It was sent by the bank.

You proceed to do as the fraud department asks. You give them more details. You move your money into a safe account. You're told you'll hear from them in the morning.

Congratulations. You just got played. Scammers have stolen your life savings.

How the scam works

This is reasonably sophisticated, and it is easy to see why people fall for it.

  1. The scammer calls you up. They keep you on the phone while...
  2. The scammer's accomplice calls your bank. They pretend to be you. So...
  3. The bank sends you an in-app alert.
  4. You confirm the alert.
  5. The scammer on the phone to your bank now has control of your account.

Look closer at what that pop is actually asking you to confirm.

We need to check it is you on the phone to us.

It isn't saying "This is us calling you - it is quite the opposite!

This pop-up is a security disaster. It should say something like:

Did you call us?
If someone has called you claiming to be from us hang up now
[Yes, I am calling Chase] - [No, someone called me]

I dare say most people would fall for this. Oh, not you! You're far too clever and sceptical. You'd hang up and call the number on your card. You'd spend a terrifying 30 minute wait on hold to the fraud department, while hoping fraudsters haven't already drained your account.

But even if you were constantly packet sniffing the Internet connection on your phone, you'd see that this was a genuine pop-up from your genuine app. Would that bypass your defences? I reckon so.

Criminals are getting increasingly good at this. Banks are letting down customers by having vaguely worded security pop-up which they know their customers don't read properly.

And, yes, customers can sometimes be a little gullible. But it is hard to be constantly on the defensive.

Further reading

You can read the original story from the victim on Reddit. See more comments on Mastodon.


Share this post on…

8 thoughts on “Bank scammers using genuine push notifications to trick their victims”

  1. says:

    "05 The scammer on the phone to your bank now has control of your account."

    It's not quite as bad as that as I understood the original description. The scammer may use the phone button click to get past something, but it may be purely to give the victim confidence for the next step... which is they need to persuade you to tell them your full card number (not just last 4 digits) and get you to authorise a transfer to another account.

    So what I mean is, there's another step in the scam, which offers another opportunity for the victim to spot something's wrong however....

    I'm not saying I'm far too clever and sceptical. If it were me (prior to hearing about this) I would have my guard down by the time it gets to that last step. It's surprising how many smartasses there are on the reddit group reckoning they wouldn't have fallen for this, and offering no sympathy. Seems like a lack of empathy and imagination, or just arrogance.

    Reply
  2. said on mastodon.social:

    @Edent

    And then a ummm "successful" Australian bank texts an elderly customer saying they'd like to speak with them.
    The SMS included a phone number and a password.

    [invective directed against that bank's dipshit customer communication manager]

    Yes it was genuinely from the fking bank.

    Great way to train customers up to be scammed. Dickheads.

    Reply | Reply to original comment on mastodon.social
  3. said on floss.social:

    @Edent I believe their are smart ones out there, but a lot must be filtering for idiots by including obvious flags early in the conversation. "VISA and MasterCard fraud detection department" is not a plausible thing but it has been used multipletimes on me and when I mention it they hang up.

    The high quality scammers probably only bother targeting bigger fish than me I guess.

    Reply | Reply to original comment on floss.social

What are your reckons?

All comments are moderated and may not be published immediately. Your email address will not be published.Allowed HTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <p> <pre> <br> <img src="" alt="" title="" srcset="">