November 16, 2006: Vishing

A new effort to illicitly obtain credit card information is called “vishing,” and involves VoIP phone calls. You should (1) not respond when an e-mail requests that you call an 800 number regarding your account and (2) be highly suspicious of phone calls purporting to be from a financial institution and requesting account information, even if Caller ID shows a local area code and familiar prefix.

Vishing uses a telephone instead of an e-mail to extract information from you:

• You may receive a spam e-mail saying their account has been compromised and they need to verify information. Rather than clicking on a link, you are asked to call an 800 number, which is actually a spoofed VoIP number. The messaging service that answers will request credit card information.

• You receive a call requesting that you verify credit card information. Caller ID may show the call coming from the same area code and prefix of a financial institution. (With VoIP, anyone can request any area code and prefix, if available, to use.) Sometimes these calls leave a message referencing a spoofed 800 number to call back.

Once the criminals obtain the information, they quickly cancel the phone number they've been using and register another one. It's very difficult to track them down using the phone numbers.

Awareness of these schemes is very important since many people tend to be less suspicious of phone calls. There are ways to distinguish between a vishing call and legitimate call. For example, we, or other financial institutions, will never ask for a card number or Social Security Number. If one is asked for this data, he or she should not provide it. Another clue is that the criminal will often not know the member's name.

If you are suspicious of a call, hang up and contact us or the number on the back of your credit card to check the legitimacy of the call.