2

I recently got a call from my “bank” telling me that there have been several fraudulent transactions on my credit card.

Naively I believed them and gave them he last four digits of my credit card number, the last 4 digits of my ssn, and my zip code.

Can they do anything with this information, and is there anything I can do to protect myself? For example freezing my credit report.

  • 3
    Whenever I get a call of this nature, I tell them I'll call back on the number printed on the back of the card, and request a case number, department or extension to connect to. Substantially safer that way. – ceejayoz Mar 22 at 20:56
11

Those three numbers are the most common ones used to verify the identity of someone who already has an account with the company in question. If you call customer service for a company that has your credit card, they'll ask for your last four to "confirm" that it's you, and possibly your zipcode. If you call your bank, or a government agency, they may ask for the last four of your social.

With just that information, they won't be able to open a new account in your name anywhere, or charge anything to your card. But they can use it to "prove" that they're you to some other organization which then may give them more details, which they can then use to do something more malicious.

See this article and this one for some high-profile examples of how a small amount of personal information was used to convince companies to give more and more, until the attackers were able to completely take over.

Unfortunately, unlike when your numbers are outright stolen, there's not a lot you can do directly to protect yourself. You should enable two-factor authentication on any service you use that permits it (especially your email), and possibly contact your service providers and see if they can put a note on your account with them that they shouldn't permit any changes or provide information (and then don't get into a situation where you would normally need it).

  • Also the information can be used to combine information that has been acquired separately. If there's a large breach on social security numbers (like the equifax hack), and credit card numbers (like some online store hack) you could link those together (not easily, but still). – xyious Mar 22 at 19:07
  • I think this one actually turned out to be a legitimate call (afaik) but thank you; I'll keep all of this in mind and use 2-step verification. – Shalop Mar 24 at 5:38
  • 2
    @Shalop To be sure, you should call the bank yourself and confirm that they called you. It never hurts to double check. Good luck! – Bobson Mar 24 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.