Was I the target of a fraud attempt? You tell me.
I received a call during dinner this evening from a number that showed up on my caller ID as being from Morgan Stanley. The person on the line told me he was calling about a check I had entered into the online banking system a day ago. He was concerned because it was going to an individual instead of a corporation. (Strange, right? Why does sending money to a person trigger an alert?)
The day before, I had logged into the system, entered the address of a friend who had helped me with a business matter and indicated I wanted a check sent. The amount was less than $5k, far below the legal reporting limit. The caller asked me about the check and I confirmed I had entered it into the system. At this point, he asked me about my relationship with the recipient and the reason I was sending him a check. I politely replied that it was none of his business.
It’s my money and I was sending it to someone I’ve known for years, and who had helped me. The details (other than the name, address, and amount are none of their business). There was no illegal activity and no hint of such. I appreciate Morgan Stanley doing a fraud check. I don’t appreciate them asking me personal questions once I’ve confirmed the transaction. Then, the caller told me he was going to text me a code to confirm my identity. He wanted me to read the code back to him.
WHAT?!
This is what people who commit fraud do. They call you, tell you there’s an issue with your account. Then, they say they’re sending you a code. At the same time, they submit a 2FA request to the company. When you give the fraudster the code, they can use it to gain access to your account. DO NOT DO THIS!!!
I told the caller that I had no idea who he was and that what he was asking me to do represents worst-practices for digital security. He reassured me that if I logged onto my account, I’d see his name and could know that he was indeed calling from Morgan Stanley.
WHAT?!
I don’t know this person. He could have been calling from a spoofed number. He could have said his name was Mike Johnson and the Morgan Stanley website could have also indicated I had an account rep named Mike Johnson. That doesn’t mean the person on the phone is actually Mike Johnson. He called me – I didn’t call him.
Again, I told the caller that I had no idea who he was and that finding a name on a website isn’t proof of identity. He replied that as a result of my non-cooperation, he couldn’t guarantee the check would be sent. So, caller: If you are a fraudster, I’m not falling for this. If you were indeed calling from Morgan Stanley, my friends are none of your business, asking me for my 2FA code on a phone call is not secure, and telling me you are who you say you are isn’t verification.
Note that this comes from a company that insists I give all kinds of personal identification to validate myself before they’ll talk to me when I call them. I can’t just say, “I’m Gary Brode and if you look at my account, you’ll see the name on it is Gary Brode.” I still don’t know if the call was valid or fraud. But for everyone reading this, please be careful. There were red flags all over this. Protect your identity and your accounts to the best you’re able. Be skeptical and don’t let the threats from a bank pressure you into giving the wrong person access to your bank account.
Information contained in this report is believed by Deep Knowledge Investing (“DKI”) to be accurate and/or derived from sources which it believes to be reliable; however, such information is presented without warranty of any kind, whether express or implied and DKI makes no representation as to the completeness, timeliness or accuracy of the information contained therein or with regard to the results to be obtained from its use. The provision of the information contained in the Services shall not be deemed to obligate DKI to provide updated or similar information in the future except to the extent it may be required to do so.
The information we provide is publicly available; our reports are neither an offer nor a solicitation to buy or sell securities. All expressions of opinion are precisely that and are subject to change. DKI, affiliates of DKI or its principal or others associated with DKI may have, take or sell positions in securities of companies about which we write.
Our opinions are not advice that investment in a company’s securities is suitable for any particular investor. Each investor should consult with and rely on his or its own investigation, due diligence and the recommendations of investment professionals whom the investor has engaged for that purpose.
In no event shall DKI be liable for any costs, liabilities, losses, expenses (including, but not limited to, attorneys’ fees), damages of any kind, including direct, indirect, punitive, incidental, special or consequential damages, or for any trading losses arising from or attributable to the use of this report.
