Beware: Identity-Theft Scam (With A Twist)

You've got to hand it to identity thieves for their diabolical ingenuity, but it sure would be nice if they would channel their energies into something more productive. Here’s the latest scam making the e-rounds, but this one has an unusual, and unfortunately effective, twist to it.

A scam message appeared in millions of Inboxes earlier this month disguised as a message from a national bank that was quickly refuted by the bank. The name of the original bank isn’t important because the scam has now spread to other banks. What is important is to be on the alert for any email received from any banking institution. The first bank in question responded to the scam with the following message:

"A fraudulent email has circulated to some of our customers claiming that we have temporarily suspended account activity due to ‘Billing Failure.’ The message instructs recipients to click an enclosed link to complete an account update to unlock their account."

This legitimate message from the bank goes on to state that the fraudulent messages received, which appear to come from the bank, are not legitimate, and it further recommends that they be deleted upon receipt. It advises recipients not to click any included links. Doing so will transport prospective victims to a bogus site where they will be asked to reveal username, password, and other sensitive data.

So far so good, right? It sounds like a legitimate warning, issued by a legitimate bank, about a potential scam.

Here comes the twist: Millions of additional messages are now arriving, also purporting to be warnings from several banks about this very scam. That’s right, the bad guys are sending out bogus warnings about their own scam! (Confusing, isn’t it?)

The latest bogus-yet-official-looking email warns that the first warning received was a scam (it wasn’t) and states, “Customers may be in receipt of an email that appears to be from this bank. It is not. The email received is a fraud attempt designed by hackers to obtain your personal information. The email has a link that sends you to a site similar to our Internet site and requests you to supply personal information. We urge you not to follow the link nor enter any account information."

If you’re scratching your head over this one, you’re in good company. Let’s recap what’s what and who’s who: First, a scam message was received by many people, some of whom were customers of the initial bank in question. The bank then sent a legitimate warning message to prospective victims. The scammer followed up by sending another message, that also appeared to be from the bank, only this message claimed that the previous message from the bank (which was legitimate), was part of the original scam. Whew.

Now, the twisted plot thickens: The bogus email goes on to state, “For your security, your online banking profile has been locked. Unlocking your profile will take approximately one minute, but you must call--” and the bogus email (that looks legitimate) provides a toll-free number to call.

Unfortunately, thousands of banking customers have called the bogus toll-free number. And what’s the first thing they’re asked when they call? That’s right, they’re asked to provide their account number, username, password, Social Security number and other sensitive information.

So this is a scam that’s delivered in the form of a warning about the scam itself. (I think my head is going to explode.)

As convoluted as this is, the only thing you need to remember is this: Neither your bank nor any other legitimate organization is ever going to contact you and ask you to verify your account information. Ever.

If you receive an informational request of this type, and if, despite my admonition, you're the least bit concerned that it might be legitimate, never, never, NEVER use a telephone number (or link) that's provided in the notification.

Instead, if you need to initiate contact with your bank or other institution, use a phone number as it appears on one of the monthly statements you receive, or call Information, or visit the institution’s Web site using an address obtained from legitimate correspondence. Do not trust any phone numbers provided to you in email.

It’s a jungle out there, so protect yourself at all times.