Why scammers pick a bank
Scammers impersonate brands people already know and trust, and banks are among the most effective disguises available to them when trying to catch out people and businesses.
“Scammers love to impersonate known brands, known entities,” said Shannon Brown, CommBank's Fraud and Scams Industry, Intelligence and Disruption Senior Manager. “But they also really like to impersonate banks.”
The reason is emotional rather than technical. Money is a subject that can make someone act before they think.
“By using a bank, and having a conversation about money being at risk, you’re eliciting normal reactions of fear and stress from people, because people can get stressed when they're thinking about their money,” Brown said.
That stress changes the question a person asks themselves. “If they get a call or an SMS or a message telling them that something is potentially wrong with their account or their money, straight away they're going to be thinking, ‘how do I fix this problem?’ rather than, ‘how can I verify that this problem actually exists?’”
Familiarity does a lot of the heavy lifting. According to Brown, using a trusted brand like a bank means “people have a level of familiarity, which helps them to trust the message that's coming from it”.
“There's a really common misconception that if you receive a scam call, SMS or email impersonating CommBank, scammers already know that you're with CommBank,” Brown said. “That's just not necessarily the case for a lot of scammers and a lot of scam campaigns.”
“It's really a numbers game,” she explained. The messages go out in bulk, in hopes that some people who receive them are customers and respond to the scam.
What it looks like
The clearest example is the callback scam, and it starts with a message that doesn't ask you to click anything.
“Customers may receive an SMS or an email asking them to call a number to fix a problem,” Brown said. Ringing a number feels like the cautious thing to do, which is part of why it works.
What happens on that call is the part that can catch people out.
“When the customer calls that number, they actually hear hold music and an automated voice asking them to select an option to talk with a phone specialist,” Brown said. “It sounds really legitimate and really mimics that call centre experience that most of us are familiar with.”
How they build trust
Once you are connected to a person, they start trying to prove that they work for the bank. Naming CommBank is the first move, and offering up a piece of personal-sounding information is the second.
“In a lot of these scam calls, we hear scammers say, hey, I know the first six digits of your card,” Brown said. “People take that as a sign of familiarity. They think, obviously you must work for the bank because you know my card number.”
Those six digits are not personal information. They can often be a bank identification number, which is standard across a card range, so the same six digits sit on many cards. Brown says scammers may already know them from publicly sourced information.
What they want once they have it
With trust established, the conversation turns to whatever gives the scammer access.
Brown says they will ask for details such as a client number, a password, multi-factor authentication codes, or a full card number, anything that helps them take over an account or gain unauthorised access. They may even ask you to download remote access software to access your computer.
The other version is a direct request for money, and it tends to arrive in the same words.
“Often they'll use language like, make a payment to a safe account, and that's a really big red flag,” Brown said.
What you should do
If you are contacted out of the blue and asked for personal information, to call a number, to click a link or to make a payment, our advice is to always stop, check and reject, even if it looks or sounds legitimate.
Stop. If a call or text claiming to be CommBank seems suspicious, take a breath so you can think clearly before you act.
Check. Look for a different way to verify it. If the contact claims to be from CommBank, hang up and reach us through official channels like the CommBank website, CommBank app or the number on the back of your card.
Reject. Cut off the contact, don't make a payment and don't hand over your information.
Find out more about the latest scams and security alerts.
