While parking her car in a bustling shopping mall, Susan Haroldson (not her real name) received a call from someone who claimed to be from her bank. The caller mentioned that there had been unusual activity on her account.

Initially, Susan did not find the first transaction (a purported purchase from Takealot) suspicious. However, when the caller mentioned a payment of R10,000 to an overseas account she became not only convinced that the caller was not truly from her bank but also that she wanted to stop this fraudulent transaction immediately.    

Because he was so convincing and because she was distracted, the fraudster managed to convince Susan to share her one-time pin (OTP), allegedly to stop the international transaction. Unfortunately instantly an amount of R15,000 was transferred to an unknown account. Realising the deception, Susan visited the bank branch at the mall to close her account. Regrettably, Susan never recovered the lost money, as she authorised the payment by sharing the OTP with the fraudster on the line.      

Legitimate or not?

It is difficult to determine if a bank is contacting you or not, especially when fraudsters already have access to so much of your personal information. “Unfortunately, some of our details are already out there,” asserts Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 AFRICA. “This is because your personal details may have been compromised in previous data breaches such as the ones at credit bureaus. If you have ever received a loan, fraudsters will probably have access to your name, address and ID number.”

But Collard says a bank will never ask for your password or OTP. If they do phone you—to promote a new banking product, for example—they will verify your details through an automated function, never over the phone. “Asking for your password or pin is a big red flag that you need to watch out for,” she says.

Likewise, banks won't send you emails or SMSs with links to click on or files to download. These are also warning signs that should put you on your guard. “These could be phishing attempts to install malware on your device or steal your banking log-in details,” cautions Collard.

Red flags to watch out for

If you receive a phone call and are worried that money may have been taken from your account, it is better for you to contact the bank directly. “If you feel suspicious, end the call right away and instead contact your bank by calling them or using your banking app,” advises Collard.

Another red flag to watch out for is a sense of panic or feeling rushed. “Scammers are highly skilled and understand that when you are feeling pressured, your ability to think clearly may be compromised,” comments Collard. “They get you into a state of mind where you will hand over the keys to your bank account to get them to help you, even though they are actually robbing you blind.”

Susan says the experience has made her paranoid about any communication that purports to be from her bank. “If an email or SMS looks suspicious, I delete it,” she says. “If someone phones me and says they are from the bank, I hang up.” She feels more comfortable using the chat application on her banking app to do banking.

The most important thing to remember, says Collard, is that banks will never ask for your password or OTP over the phone. She reiterates, “Do not be conned by the local accent or the personal details they have about you. Banks seldom phone their customers and prefer to do most of their communication via the banking app.”

She recommends trusting your instincts and hanging up the call if you have any doubts. “A quick call to your bank can resolve any uncertainties and provide reassurance, potentially preventing you from losing your hard-earned money,” she concludes.