Receive a text from your bank letting you know your account’s been locked? You might want to think twice before following its instructions.
That’s because scammers are using a combination of fake texts and cardless ATMs to steal thousands of dollars from unsuspecting people, according to Krebs on Security. The scam’s made them a killing in a fairly short window of time: Per Krebs, scammers have stolen $68,000 from around 125 Fifth Third Bank customers in Illinois, Michigan and Ohio in fewer than two weeks.
Here’s how it works: Fraudsters text banking customers, claiming that their bank accounts have been locked. The texts include a link that sends customers to a lookalike of the bank’s website, where they enter their account credentials, “including usernames, passwords, one-time passcodes and PIN numbers,” reports Krebs. Once the scammers have this info, they can use it at the cardless ATMs to steal the customers’ money.
Cardless ATMs let customers use their smart phones to get cash, rather than relying on a debit card. They’re not incredibly common yet, but are used by most of the big banks such as Chase as well as regional banks like Fifth Third as a convenience to customers. They’re reportedly more secure than standard ATMs—or at least that’s what the financial industry is saying—but, as with all new financial innovations, scammers have found a way to exploit them. As the Fifth Third example illustrates, scammers need only a username, password and PIN to steal cash in some cases.
As Krebs suggests, never “respond to requests for personal or financial information sent via email, text message or over the phone.” If you receive a confusing message or phone call, hang up or ignore it, and contact your bank or financial institution directly.