This week a client called with a question we hear more and more: "Can you check if we've been hacked?" Here's what happened, what we found, and what to do if it happens to you.
What happened
Two charges hit the client's business debit card, one for $2,000 and one for $3,000. Soon after, he got a text that looked like it came from his bank's fraud department, asking whether he'd made the purchases. He replied "no," and a moment later "the bank" called him.
It wasn't the bank. The scammers already had his card number. The fake fraud alert was the second half of the scam, aimed at getting more information or more money out of him.
What he did right
- He didn't give them any personal information on the call.
- After hanging up, he called his local bank directly. The bank confirmed the texts and calls were fake.
- Because he reported it right away, the bank cancelled both charges and the card.
What we checked
Once a client's card is used, the next question is how the scammers got the number. We collected the details of the incident and checked:
- The company computers, for malware or signs that someone had remote access
- The email accounts, for suspicious sign-ins, forwarding rules or messages sent from the account
Everything came back clean.
Where the card was actually stolen
Working back with the bank, we found that a local sandwich shop he'd recently visited had just reported its card machines were compromised. He had paid there with the same card. The number was stolen at the counter, not from his computer or email.
How the fake "fraud department" scam works
This is one of the most common text scams out there. The FTC has reported that fake bank texts were the most reported type of text scam (CBS News on FTC data). The pattern is simple:
- You get a text that looks like a fraud alert from your bank: "Did you make this purchase? Reply YES or NO."
- You reply, and someone calls from the "fraud department."
- They ask you to "verify" your card number, PIN, a one-time code, or to move money to a "safe" account.
The FCC is clear on this: banks never call or text to ask you to move money to protect it (FCC consumer alert).
What to do if it happens to you
- Don't reply to the text and don't click its links.
- Hang up and call your bank yourself, using the number on the back of your card or on your statement.
- Never share your PIN, passwords, one-time codes or Social Security number.
- Report it fast. For personal debit cards, federal rules limit your loss to $50 if you report within two business days, and up to $500 if you report later (CFPB, Regulation E). Business accounts may have less protection, so check your bank's terms.
- Use credit cards instead of debit cards for everyday purchases. Fraud on a credit card doesn't drain your checking account while you sort it out.
- Turn on transaction alerts in your banking app so you see charges right away.
- Forward scam texts to 7726 (SPAM) and report them at ReportFraud.ftc.gov.
Not sure if you've been hacked?
Card fraud doesn't always mean your computers were breached, but it's worth checking. If you get a suspicious charge, text or call, contact NexGenGuard or call 210-979-1886. We'll check your devices and email accounts and help you work through it with your bank.
