Who's calling whom?

Image: Wikipedia

"Hello, you're speaking with Peter Flight from HomeBank*. I'd like to go over a few things with you regarding your new mortgage."

So far, so normal — at least if you actually have taken out a new mortgage with that bank. What the customer did find odd, however, was that the bank employee also wanted to go through some contact details for verification purposes. "They're calling me, so surely they know it's me?"

Did you know that phishing doesn't only happen via email and text message, but also over the phone? In that case it's called vishing (with a v for voice), but the goal is the same: to extract information. Suppose that Peter Flight is a criminal. He probably won't open with a mortgage, because there's a good chance his intended victim hasn't applied for one. So he'll start with something more general — a savings account, say, or a bank card.

Suppose his story sounds plausible. He then asks a series of questions of the kind you hear all the time when you call a company or organisation: your address, date of birth, perhaps even your bank account number or national insurance number. Perfectly logical when you're the one calling — though I'm often surprised by how little information they're satisfied with. But when they call you, the situation is quite different.

Why would they need to verify your identity in that case? They have your file right in front of them, and it includes the phone number they're calling. Yes, someone else could theoretically pick up your phone, but in the age of the mobile that's not very likely (back in the day, dear youngsters, you had one telephone in the house — the kind that could only travel as far as its cord would allow). So if someone calls you on behalf of a company and asks for identifying information, you should be on your guard. Because with that information in hand, a criminal can easily call a company and pretend to be you. With all the consequences that entails.

No, when they call you, you need to turn the tables: ask the questions yourself. What's my date of birth? What's my address? What are the last four digits of my bank account number? If they're unwilling — or unable! — to answer, you're better off hanging up. Not sure whether the call might have been legitimate after all? Call the company back using a number you already know or find on their website or in their letters. They'll be able to tell you whether they called you.

But of course I also heard stories from people who had received good old-fashioned phishing, via email. Take the colleague who received a fantastic offer from Amazon: trainers from a well-known brand for £8 instead of £80. If you've ever attended one of my presentations, you'll probably recognise this piece of wisdom: if something seems too good to be true, it usually is. The colleague initially thought the email looked genuine — he was even addressed by his first name. But because something still felt off, he asked AI for help. Verdict: phishing! The main reason, it turned out, was that the Amazon logo was missing. The fact that this was the clincher is worrying, because any half-decent phishing operation invests precisely in look and feel. What would AI have said if the logo had been there?

How did the criminal behind this email know our colleague's name? Because of data breaches — large-scale incidents at well-known companies where vast amounts of data (including email addresses and names) were stolen. The old rule of thumb that the absence of a personal salutation is a red flag — and implicitly that a personal greeting is a green flag — can safely be thrown out.

Whether they're trying to phish, smish, vish or quish** you: outsmart the criminals. Let people like Peter Flight crash and burn thanks to your alertness.

*: These names are fictitious.

**: smishing = phishing via text message, vishing via phone, quishing via QR codes.