Your Card, Their Payment
Scammers no longer need to steal your payment card or know its details to use it. They only need to convince you to install a malicious app and hold your card near your phone. They can then make a payment remotely without ever physically having your card.
Summary
A few steps following the caller's instructions can be enough for the scam to work. Your payment card can remain in your possession the entire time.
- The scammer poses as a bank employee and tries to gain your trust.
- They convince you to install a fake app on your phone.
- Under the pretext of verification, they ask you to hold your payment card near your phone.
- The app relays communication with the card to the scammer, who can use it to make a remote payment.
- If you have followed similar instructions, contact your bank and block your card as soon as possible.
A Fake Banker Calls
The scam starts with what seems like an ordinary phone call. The caller poses as a bank employee and claims there is an urgent problem with your account or payment card. This is known as vishing – a type of scam in which an attacker tries to manipulate the victim over the phone.
Once the scammer has gained the victim's trust, they convince them to install an app that supposedly helps verify or secure the card. In reality, the victim is installing malicious software on their phone.
Your Card Is Used Remotely
After the app is installed, the fake banker asks the victim to hold their payment card near the phone for verification, just as they would when making a contactless payment.
The malicious app uses NFC, the technology behind contactless payments, and relays communication with the card to the scammer. The scammer can then use it to make a payment on another device.
The card remains with its owner the entire time. The scammer does not need to steal it or even know its card number. All they need is for the victim to follow their instructions.
How to Avoid This Scam
The safest approach with suspicious calls like these is not to rush into anything. If you are unsure who is really calling, end the call and contact your bank directly.
Never:
- Install apps at the request of an unknown caller.
- Hold your payment card near your phone for supposed verification.
- Share your PIN or card details.
- Approve payments you did not initiate yourself.
If you have already installed the app or followed the scammer's instructions, contact your bank and block your card as soon as possible.
Attackers are constantly finding new ways to deceive their victims. On the Redamp blog , we keep track of current cyber threats and show you how to recognize them before they cause harm.