A new bank scam, claiming to originate from HSBC bank, has started circulating in the latest of a chain of fake convincing text messages and emails that are defrauding up to 20 people daily.
In this most recent scam text message, victims receive a message claiming to originate from HSBC reading: “A new payee has been added today. If this was not you, visit…” They are then redirected to a link from where they are asked for personal and confidential information.
The scam HSBC text message.In a Facebook post to customers, HSBC said: “We have had reports of customers receiving suspicious SMS that appear to be from our bank and contain link to a website urging you to provide confidential, personal or financial information… Protecting yourself is simple. Do not reply to or, click on a link from any SMS that you are not sure is genuine. If you have already received such SMS and accidentally clicked on the link please do call us.”
The bank goes on to add it would never ask customers to disclose personal information via SMS or SMS a link to its login page.
“HSBC will never request information that could be used to make a payment (such as account numbers, passwords, security device details other than the serial number on the back, etc). Under no circumstances will HSBC ever ask you to divulge any of your security details over the phone, by text message or via email.”
But, for victims of the scam, the line between what is legitimate and not can be blurry. One woman said she received the scam message as part of the legitimate HSBC mobile message notification chain. Others received the message even though they do not bank with HSBC.
This is the second bank notification scam that started circulating since April. In another BOV scam, victims are deceived into providing their credentials after they are informed of a “suspicious transaction”. They are requested to press on a link designed to steal their details.
Earlier this week Times of Malta reported that police are receiving up to 20 reports a day from victims of convincing emails and text messages about parcel deliveries or bank scams.
The parcel delivery scam has been around since April but intensified in recent weeks with messages being sent in Maltese and English and purporting to come from a range of delivery groups including MaltaPost and DHL.
The scam message asks people to click on a link to pay a delivery charge. While victims think they are authorising the debit of a small amount – such as €1.60 – fraudsters use their details to debit a much bigger sum. Scammers are typically taking between €800 and €1,800 per victim with the highest amount defrauded from one single person reaching €5,000, the police said.
A police spokesman said investigators have established that the scammers are operating from outside the EU. Similar scams have been reported in France.
Speaking about the HSBC scams, Police Inspector Timothy Zammit said police and encountered this form of scam with various local banks. “Fraudsters try their luck with one bank and when the word is out that there is a scam, they target another one,”.
He said scammers were using a number allocation method to make it seem that their text message originated from the number used by the bank, when in reality it did not.
Asked if police were ruling out that scammers hijacked the bank’s numbers, he said this was unlikely since messages were not personalised and even targeted people who did not bank with particle banks.
Police are investigating how fraudsters are obtaining numbers. While not ruling out that they got hold of data from companies hacked in the past, they could also be using general knowledge of Malta’s prefix system and adding random number. He once again called on people to exercise caution and to not access banks’ websites by clicking on links.