Pin-stealing credit union ‘staff’

What’s the threat?

Scammers are posing as staff of credit unions in sophisticated scams to steal PIN codes from victims. They phone you claiming to have blocked dubious-looking charges made to your debit or credit card, and read the last four digits of your card to appear genuine.

The caller then says there’s no need to immediately cancel your card because the credit union will block future payments. However, they also ask for your address so they can send a new card, and ask you to confirm personal details like your mother’s maiden name and the three digits on the back of your card (known as the card security code, or CSC).

Up to this point, the scammer doesn’t have enough information to steal money from your account. But they then ask for your PIN, so they can apply it to the new card being sent. If you give this info, scammers will be able to use it to make fraudulent purchases.

How can you stay safe?

Never, ever give your full PIN over the phone. If you’re asked to give two of the four digits, make sure you don’t get fooled into revealing all four (a trick skillfully pulled off by the scammer in this Barclays advert: www.snipca.com/29293, pictured).

The scam described above was reported on the excellent Krebs On Security site ( www.snipca.com/29292), run by US investigative reporter Brian Krebs. The victim in this case was web programmer Matt Haughey, who was suspicious about the call he received, but gave his PIN anyway. Checking his account later, he found the scammer had withdrawn $500 from a cash machine, and made a purchase of $2,900 from a department store. There’s no reason why this type of scam couldn’t happen in the UK, so be warned.