Almost every week at the Tech Clinic somebody shows me a message on their phone and asks whether it is real. That is exactly the right instinct, and asking somebody is the single most useful thing you can do. Nobody should feel silly about it. These messages are written by people whose full time job is making them convincing, and they catch bank managers and computer engineers as readily as anyone else.
Here is what they look like, and the one rule that beats all of them.
The one rule
Never act on a message or call that came to you. Go to them instead.
If a text says there is a problem with your bank account, do not tap the link. Ring the number on the back of your bank card. If an email says your parcel is held up, do not click. Go to the courier’s own website and put the tracking number in yourself. If somebody rings claiming to be from your bank, hang up, wait five minutes, and ring the number on your card.
Nothing legitimate is ever lost by doing this. A real bank will not mind you ringing them back. A real courier will still have your parcel. If somebody objects to you checking, that tells you everything.
The three that catch the most people
The delivery text
“Your parcel could not be delivered. Please pay the £1.45 redelivery fee.” It is a small enough amount that you do not think twice, and most of us are waiting for something. The fee is not the point. The card details you type into their page are the point, and the real charge comes later.
Royal Mail and the couriers do sometimes text about deliveries. They do not ask for card details by text message.
The bank message or call
“A payment of £780 to a new payee has been authorised. If this was not you, press 1.” Or a call from somebody calm and helpful who says your account has been compromised and they need to move your money to a safe account while they investigate.
There is no such thing as a safe account. Your bank will never ask you to move money to one, never ask for your full PIN or password, never send somebody to your house to collect a card, and never ask you to install software so they can look at your computer. If any of those things is being asked for, it is a scam, however plausible the person sounds.
The pop up that says your computer is infected
A loud warning fills the screen, sometimes with a siren, saying your computer has a virus and you must ring a number immediately. It usually claims to be Microsoft or Apple.
Microsoft and Apple do not do this. They do not know your computer has a problem and they would not ring you about it. What happens if you call is that a very polite person asks to connect to your computer to fix it, and then either charges you for nothing or helps themselves to whatever is on there.
The pop up itself is usually harmless. It is a web page pretending to be an alarm. Close the browser, or if it will not close, hold the power button until the machine turns off and start it again.
Four things that give it away
- Urgency. Act now, within 24 hours, or your account will be closed. Real organisations give you time. Panic is the whole technique.
- The address is nearly right. Not
hsbc.co.ukbuthsbc-secure-login.com. On a phone, press and hold a link to see where it really goes before you tap it. - An odd way to pay. Gift cards, vouchers, cryptocurrency or a bank transfer to a person’s name. No real organisation asks for any of these.
- They contacted you about money you did not know about. A refund you were not expecting, a tax rebate out of the blue, a parcel you did not order.
If you have already clicked
Do not spend any time feeling foolish about it. Speed matters more.
- If you entered card or bank details, ring your bank immediately on the number on your card. They deal with this every day and they can freeze things quickly.
- If you entered a password, change it on the real website, and change it anywhere else you used the same one.
- If you let somebody connect to your computer, disconnect it from the internet and get somebody to look at it properly before you use it for anything else, especially banking.
- Report it. Forward scam texts free to 7726, forward scam emails to report@phishing.gov.uk, and report fraud to Action Fraud on 0300 123 2040.
If you are reading this about somebody else
A word on how to raise it, because this is where well meant conversations go wrong. Telling a parent to be careful because they are getting on tends to land badly, and it makes them less likely to mention the next one.
What works better is treating it as something that catches everybody, because it does. Show them one you nearly fell for. Agree between you that anything at all suspicious gets forwarded to you before anybody taps anything, no matter how obvious it might turn out to be. The aim is that they feel able to ask, rather than quietly dealing with it alone and being embarrassed if it goes wrong.
Bring it to the clinic
If you are at Wadswick Green, bring your phone to the Tech Clinic on a Friday morning and I will look at it with you. If you are elsewhere in Wiltshire or Berkshire and something has worried you, ring me on 07816 970 768. Checking a message costs nothing.