Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It only takes a minute to sign up.
Sign up to join this community
I recently got a call from my “bank” telling me that there have been several fraudulent transactions on my credit card.
Naively I believed them and gave them he last four digits of my credit card number, the last 4 digits of my ssn, and my zip code.
Can they do anything with this information, and is there anything I can do to protect myself? For example freezing my credit report.
Those three numbers are the most common ones used to verify the identity of someone who already has an account with the company in question. If you call customer service for a company that has your credit card, they'll ask for your last four to "confirm" that it's you, and possibly your zipcode. If you call your bank, or a government agency, they may ask for the last four of your social.
With just that information, they won't be able to open a new account in your name anywhere, or charge anything to your card. But they can use it to "prove" that they're you to some other organization which then may give them more details, which they can then use to do something more malicious.
See this article and this one for some high-profile examples of how a small amount of personal information was used to convince companies to give more and more, until the attackers were able to completely take over.
Unfortunately, unlike when your numbers are outright stolen, there's not a lot you can do directly to protect yourself. You should enable two-factor authentication on any service you use that permits it (especially your email), and possibly contact your service providers and see if they can put a note on your account with them that they shouldn't permit any changes or provide information (and then don't get into a situation where you would normally need it).
