A Threat Actor Got MY Information…Almost

I spend a good portion of my days helping organizations deal with cyber incidents. I’m constantly talking about preparation, being vigilant and recognizing the warning signs before one crisis becomes another. Then I found myself in a hotel room, listening to a fraudster explain how he was going to protect my bank accounts.

I’m sharing this because fraud can happen to anyone, including those of us who work around it every day. A convincing story can get your attention, earn your trust and keep you engaged longer than you might expect.

Fortunately, I questioned what was happening before providing my login information. But I could easily see someone else following the same instructions, believing they were protecting their money. That’s why these experiences are worth sharing. Someone you know may receive a similar call, and recognizing the story could help them avoid becoming the next victim.

It started with a reassuring call

I was traveling and had just sat down in my hotel room when someone claiming to be from my bank called. Several potentially fraudulent charges had been flagged, he said. Had I made them? I hadn’t.

He assured me the charges would be canceled and I wouldn’t be responsible. Then he added something more concerning: Someone had apparently walked into a branch in Florida and opened an account using my Social Security number.

I told him I hadn’t opened any new accounts. No problem, he said. The account was being flagged and I wouldn’t be responsible for those charges either. Then he asked whether I worked with any other banks. He offered to contact their fraud departments to alert them.

That seemed helpful. I told him where else I banked. For this story, let’s call the first bank Bank A and the second Bank B. He put me on hold for a couple of minutes, then returned and said he had contacted Bank B’s fraud department. After again assuring me that I wouldn’t be responsible for any fraudulent charges, he ended the call.

Throughout the conversation, he never asked for account numbers, passwords or other login information. His focus appeared to be entirely on helping me avoid becoming a victim of fraud. He explained what he was doing and kept reassuring me that I would be protected. Without a request for sensitive account information, I had less reason to question whether he was who he claimed to be.

I went online to check my accounts at both banks. Nothing looked unusual. Before I could finish, my phone rang again.

The second call fit the story

This caller said he was with Bank B’s fraud department. He asked whether I had made several suspicious charges. I told him I hadn’t and explained that I had just spoken with my other bank about the same issue.

He said that wasn’t unusual because someone had clearly obtained my information and was opening accounts in my name. At this point, I was trying to figure out what was happening. Two banks appeared to be describing the same problem. The first caller had even told me he had contacted the second bank.

For the first couple of minutes, this call also focused on what appeared to be the bank’s efforts to stop further fraudulent charges. The caller asked about the suspicious activity and reassured me that he was helping resolve the problem. Coming immediately after the first call, it felt like the next step in protecting my accounts. The first caller had already lowered my guard, and this caller was building on that trust.

Then came the request

I asked the second caller to close the fraudulent accounts. He repeatedly reassured me my accounts were FDIC protected and I wouldn’t be responsible for any charges over the next 24 hours.

That 24-hour reference caught my attention. Something didn’t sound right.

Only after spending those first few minutes building my trust did he shift the conversation. He said the person committing the fraud still had online access and we needed to terminate it. By then, this sounded like another step in the process of protecting my accounts. Of course, I wanted that access stopped.

He told me to respond to a text message with my account username. Now my Spidey sense was at full alert. Why would he need my username to terminate someone else’s access?

He didn’t give me a satisfactory answer. Instead, he kept repeating I wouldn’t be responsible for the charges and we needed to act quickly. I told him I would call back and asked for a number. He wouldn’t provide one. He continued pressing me to follow his instructions.

He explained I needed to send my username by text in a specific format: UserID/cancel. I would then receive a text verifying the user ID.

Questioning the interaction at this point, I sent a made-up username via text. A check mark image arrived by text, apparently confirming it. A completely invented username had just received what looked like validation.

That settled it. This was a convincing attempt to trick me into providing my login information. I hung up and called both banks directly. Neither had called me and neither found unusual account activity. As an extra precaution, I changed the user IDs on both accounts. The calls didn’t establish my login credentials had been compromised, but I wanted to take that additional step.

Looking back, I should have ended the conversation sooner. You don’t need to test a suspicious caller with made-up information. Once you have doubts, hang up and contact the institution yourself.

My curiosity had kept me on the phone. I hear about these calls regularly and this was a chance to see how one unfolded. But it also helped me understand how someone could get caught in the story. These criminals were convincing, and between the two calls, I’ guessing they kept me engaged for almost ten minutes.

How the two calls worked together

The two calls were clearly coordinated by the same group attempting to commit the fraud. Each caller had a role in building my trust and moving me toward providing account information.

The first caller created concern while offering reassurance. Someone supposedly had my Social Security number, but my bank was handling it. He appeared helpful, never asked for login credentials and offered to alert my other bank. In the process, he got a useful piece of information: where else I banked.

He also gave me a reason to expect the next call. When someone claiming to represent Bank B contacted me, the conversation already had credibility. What appeared to be two banks independently identifying the same problem was one fraud operation reinforcing its own story.

The second caller then used the concern established by the first to push me toward action. He combined repeated assurances my money was protected with pressure to act immediately.

That combination is important to understand. He made his instructions feel safe while suggesting questioning them would allow the fraud to continue. Even the check mark was part of the performance. It looked like confirmation, but the fraudsters controlled both the request and the supposed validation.

The request for a username also deserves attention. A username alone generally isn’t enough to access an account, but it can be the first piece of a larger attempt to obtain a password or verification code. I ended the call before finding out what he would have asked for next. Calling it a cancellation step didn’t change the fact that he was asking for login information.

Looking back, the warning signs are much easier to recognize:

• An unexpected warning that my money and identity were at risk.
• Repeated pressure to act immediately rather than verify the story.
• A request for login information presented as a way to stop fraud.
• Resistance when I said I wanted to end the call and contact the bank myself.

The FDIC references were misleading, too. FDIC deposit insurance protects covered deposits if an insured bank fails. It does not cover losses from theft or fraud. Other protections may apply to unauthorized transactions, but the caller’s assurances were no reason to trust him.

Give yourself permission to end the call

I understand how someone could get caught in this. When you hear someone has your Social Security number and access to your bank accounts, you want to fix the problem. A caller who sounds helpful and tells you exactly what to do can keep you focused on following instructions.

The most useful response is to stop the conversation and verify the story yourself. Call your bank using the number on your bank card, a statement or its official app. Find the number independently, even if the caller offers one. Don’t rely on a phone number in an unexpected text or a sponsored search result.

Caller ID is not proof of who is calling. Scammers can make a call appear to come from a legitimate bank number. Knowing your name or other personal details doesn’t establish their identity either.

Don’t share usernames, passwords, PINs or one-time verification codes with an unsolicited caller, or approve an unexpected login prompt at their request. A code sent by the real bank may be authorizing access to your account rather than canceling fraud.

If you’ve already shared information, contact your bank immediately through a trusted channel and explain exactly what you provided. Ask the bank to secure your accounts, reset any exposed login credentials and check for unauthorized activity. Changing a username alone is not a substitute for those steps. You can also report the attempt at ReportFraud.ftc.gov.

For those of us who talk about cyber preparedness, this is also a reminder that awareness requires more than telling people to “be careful.” We need to explain how these interactions unfold, including the seemingly helpful conversations that come before anyone asks for sensitive information.

Share this story with your family, friends and employees, especially anyone who might hesitate to question someone claiming to be from their bank. Make sure they know they can end the call, even if the caller insists there’s no time.

I deal with cyber incidents every day, and I still stayed on the phone longer than I should have. The next person receiving that call may have no reason to recognize the setup. Sharing what happened could give them one.