Phishermen use call-forwarding scam to avoid detection when bank notes suspicious activity

Most of get a lot of phishy e-mails requesting personal and financial information from criminals pretending to be a trusted brand. Now they are adding a devious twist designed to beat fraud detection software, which is used by a lot of companies as a means to detect fraudulent transactions, early on.

Herb Weisbaum of KOMOTV.com (Seattle) reports:

The mass e-mail I saw claimed to be from Bank of America -- big banks are a prime target for these scams because they have so many customers.

The e-mail says, "During our regular update and verification we could not verify your current phone number. Either your information has been changed or it is incomplete.

"The message tells you to confirm your phone number right away “or your account will be suspended indefinitely.”

Not only are you supposed to give them you phone number, you're instructed to forward your calls to the Bank of America Security Department, and they give you that number.

Herb's full story, here.

When the institution notes suspicious activity and calls, the now forwarded call goes to the scammer, who assures them "all is well."

Call-forwarding being used to defraud people isn't exactly new, but this is a new twist. In the past, scammers have called the telephone company and told them that a business line was having problems, then instructed them to forward the call to another number (theirs). This is normally done to businesses, who accept payment information over the telephone.

Of course, the goods, or services are never received and the information is later used for criminal purposes, or to steal money.

This practice is enabled by telephone companies not verifying (authenticating) information when a call forwarding request is placed. Most telephone companies allow the owner of a line to protect it with a password, however unless the owner does so, they are open to this sort of attack.

It's probably a good idea (especially for businesses) to have a password placed on their account!

Consumer Affairs wrote about another variation of the call-forwarding scam -- which is designed to charge the victim for long distance calls (possibly used by fraudsters, or even inmates to commit crimes) -- where the victim is tricked into call-forwarding their number.

Note that the command for call forwarding at most telephone companies is "72#" or "*72," then the telephone number. The inmate or fraudster will normally pose as a telephone tech, who tells you there is a problem with the line. Call-forwarding can be disabled by entering "72#" or "*72."

Please note, at some businesses, the command is "90#".

This scam is frequently used by prisoners in correctional institutions to make free calls and targets both personal and business lines. Another good reason for businesses to password protect their telephone account and consider disabling call forwarding. Most telephone companies charge extra for this service, anyway.

Consumer Affairs story, here.