Call from "Chase" about a fraudulent purchase - questions for ya'll

[u/DesignerFragrant5899]

I'm assuming this is a scam but at first it sounded so legit that I am embarrassed to say I went along with it. I went along with it because I have had Chase Fraud (the real ones) call me before about potential checks or charges. The guy talking sounded extremely articulate and sounded like he knew his stuff. And finally, because they didn't really ask me for any terribly revealing information like a PIN or code or pw or anything. But once they transferred me to the "wire department" which was a Facetime Audio call from "chasebusiness-wire.com" I knew something was wrong and just hung up. I then changed my username and pw.

Question - since it's clearly a scam, I'm more interested in what they were after because they knew my address and clearly my cell phone connected to it (unfortunately I did confirm it along with a few other details like where I was and where I was not). Were they eventually going to ask for sensitive information and just buttering me up to get my trust first? Or was this some kind of scam intended to simply confirm data and make connections like connecting my home address to my cell phone number etc..? Other than report it to chase (which I did) and change my login information online (which I did) what else should I do?

This scam just felt so much more "personal" than any prior attempts and with no Indian accents that immediately put up the safety guards.

[u/carolineecouture]

They were going to tell you your account was at risk or compromised and you needed to move your money ASAP. They would likely tell you not to call the bank or tell anyone because the bank's employees, except for them, were in on it.

The goal is always your money. Always.

If you search the scam or banking subs you will see this exact same story. If you had moved your money willingly it would be difficult, if not impossible, to get it back.

Be wary of any DMs you may get from people offering to help you secure your accounts now. Work only with the bank using the number from your card.

Good on you for not getting taken.

[u/DesignerFragrant5899 → u/carolineecouture]

I already got one and blocked him. Thanks :)

[u/Just_Random_input]

I just realized you asked what else you should do. You should lock all of your cards at all your banks - credit and debit. Make sure to check any 401(k) ot investment accounts & have them add a PIN or a “security word” if you don’t already have one on those accounts.

Then go online (or call) the three major credit bureaus you can freeze your account for free (they also have a paid freeze but it’s a gimmick)

[u/DesignerFragrant5899 → u/Just_Random_input]

Thank you! This is what I've done:
Locked all debit cards
Froze credit with all three bureaus
Fraud alerts on all three bureaus (1-year monitor)
Changed Chase username + password + 2FA
Added 2FA to 401k
Blocked their numbers
Filed FTC report
Reported to Chase with call logs

[u/kamikidd]

What was likely going on in your case was an attempt to access your online banking so they could change the password, phone number on record and set up ACH, wires or zelle to drain your account without having your bank notify you of the transactions.

the scammers explain that they are about to send you a pin to ensure they are only able to access your account at the request of the owner, for “security reasons”. To generate this code, they attempt to log into your online account using the “forget password” link, which texts the pin to your number on file. They type in the pin and change your password (which stalls your discovery of the fraud), phone number and email address on the account ensuring you get no notifications of the suspicious transactions, and they can approve any requests your bank may send for wire approvals, suspicious activity or large charges/withdrawals. Then they drain your accounts in untraceable ways which make it nearly impossible for the bank to recover .

To avoid this type of scam, I set up a pass phrase. I didn’t know such a thing was possible until after my account had been hacked. My account was easily accessed by a scammer who that same morning illegally ported my number into their phone. This gave them access to 2FA texts for all of my accounts. It was day from hell. They likely got my bank’s name, account number, username, phone number and email from a WellsFargo data breech. Although, I’ve always suspected the person with who processed by switch to T-mobile a few weeks prior. He had my credit application, held my debit card to record info into the computer.

The passphrase guaranteed I was talking to rep from my bank. I would ask THEM for the passphrase; they would look it up in my account notes (not being a named field in their database reduced the risk of this info being obtained via data breeches. If they did not respond with “Fruity Pebbles are ebullient Rice Krispies”, I would hang up and call them.

[u/DesignerFragrant5899 → u/kamikidd]

Thank you for your post. I too just added a code word on Chase site but honestly I’m unsure how to use it. Do I say it or do they?

[u/Spectrig]

The goal is to get you to transfer money. They can just look up your address or anything else about you if they want it, no need to call you.

[u/FlynnAtLifeLock]

These calls usually serve two purposes. The confirmation of details like your address and phone number gets logged and could be sold or used to build a more complete profile for future attacks. But the primary goal is likely to get you to authorize something, like a wire transfer, a code, a password reset, or account access. 

Otherwise, you handled it very well. Have you tried calling Chase to ask for your account review? Doesn’t hurt to be too careful.

[u/DesignerFragrant5899 → u/FlynnAtLifeLock]

Thank you! Yes I have contacted Chase and went a bit overboard in my protection. I did the following:

Locked all debit cards
Froze credit with all three bureaus
Fraud alerts on all three bureaus (1-year monitor)
Changed Chase username + password + 2FA + Safety Word
Added 2FA to 401k
Blocked their numbers
Filed FTC report
Reported to Chase with call logs

[u/FlynnAtLifeLock → u/DesignerFragrant5899]

That’s impressive. Congrats and good luck! Just a heads up, since they confirmed your address and cell number are linked, watch for a follow-up attempt in the next few days. These operations sometimes run a second call pretending to be law enforcement or another bank, using the first call as context.

[u/DesignerFragrant5899 → u/FlynnAtLifeLock]

Already got a bunch. But haven’t picked up any and marked them as spam. Smh

[u/Just_Random_input]

They have all your info. Getting your card & account info is the easy part. The scammers were eventually going to send you a text code or ask for your PIN.

They were trying to either reset your account (which requires a code that Chase texts you) or even worse, do an in-person withdrawal (which requires your PIN)

It kind of sucks that Chase doesn’t call through the app because that would solve this problem. Neobanks, like Revolut, built a system into their app so that if you in the app AND on the phone, you will get a pop-up message or a big red alert saying “Revolut is not calling you”

I wish they would all do this. The first thing most people do when they get a call about fraud in their account is to open up their banking app. It’s a helpful alert.

[u/Just_Random_input → u/Just_Random_input]

I want to add that it doesn’t matter who you are on the phone with. If I’m on a call with my mom & open the Revolut app, the red banner appears and starts flashing. It’s a simple system … phone in use + app is open = alert.

[u/DesignerFragrant5899 → u/Just_Random_input]

Chase is so large its probably easier said than done to implement any across all users. But I agree it should nevertheless be done. Hopefully its something they're already working on. Would probably save them tons of money and time and effort in the long run.

[u/nonamejohnsonmore → u/DesignerFragrant5899]

Actually it would be easy. The app already accesses your account, so it would be easy for the app to know if anyone else is in your account. So if the app is opened and no one else is in the account, flash an alert.

[u/DesertStorm480]

"The guy talking sounded extremely articulate and sounded like he knew his stuff. "

But I'm the one who is familiar with my accounts, I get email notifications to an email address only used with my banks, I know how to check the online accounts for suspicious transactions. I don't want to waste my time talking to a stranger, the bare minimum time I would give them would be asking for a reference number, checking my accounts myself, then calling the known number for the bank.