"Thank you for your payment" scams

Phishing for your information from your inbox

 

March 31, 2022

We’ve all heard the term Phishing before. Phishing typically occurs in an email or text where a scammer tries to get you to give them your information. They may ask you to click a link that seems legitimate and enter account information. Sometimes the page contains other security risks. However, now, we’re seeing scammers with a new type of phishing: the “Thank You for Your Payment” Scam.

Here’s how it works:

Digital banking users at any financial institution may be contacted by these social engineers via email or text with a fake page that thanks the user for their “recent purchase.” This can be rather alarming if you didn’t order something. In the email, it lists a phone number to call “if there has been a mistake” with the transaction. Of course, when you call that number, the scammers are waiting on the other end to “investigate the transaction” and will ask you for digital banking login information to verify your account or assist you in the matter. They also may ask you for your debit card number to verify your account. This gives them access to your digital banking or debit card where they can get in and transfer funds out of your account into their own pockets.

Many of these emails appear to be from big name security companies like Norton™, Lifelock™, Microsoft, and McAfee^®. They often state that a charge of a several hundred dollars was made for some type of security product like antivirus software or malware protection. It will list a phone number in the email. These emails change all the time, so the key is to be aware. Here’s an example of a scam email you may receive below.

 

They want you to give your digital banking access or debit card information to them when you call. They may even try to get you to install a remote access or tech support type of app on your PC so they can “help you remove the software” that was purchased by mistake, otherwise they cannot authorize the refund. At this point, they may be installing malware on your computer.

How can you avoid these situations?

Never call a phone number listed in an email that states you owe money. Instead, go to your financial institution website, or the website of the recognized company the email is claiming to be from, and look up the official, published number and call directly. No legitimate company will ask you for remote access to your PC to get a refund. That’s a huge red flag. At that point, you can safely assume it’s a scam.

Here are some other red flags:

• Emails that urgently request personal or payment information
• Non-personalized emails
• Links to the wrong sites – the link text may say one thing but direct you to a different area
• Be sure you’re on a secure site, one that begins with https:// not just http://
• Check your transactions in your digital banking app
• If you’re dating online, watch for those who ask for money (for more information on this topic, read our blog about Sweetheart Scams)
• Never give out your debit card, account, or personal information to those you do not know or are unsure of.

For more information, check out security tips from the FTC which can be found here.