What's the scam? Fraudulent bank accounts inside.
July 5, 2023 2:44 PM Subscribe
Someone opened two new accounts under my name at the bank I use. What's the scam?
I started getting emails a few days ago like "Congratulations, your application was successful!" from my normal bank. I figured they were some kind of mistake or phishing and just ignored them. (I have a long history of getting emails sent to my gmail address for someone else who has the same name.) But then I kept getting more messages about "Set up your new accounts!" and "your new debit card is on the way!" and I started getting more concerned. I checked on my banking app and there were two new accounts listed - both with zero dollars - one checking and one savings. And these accounts were set up with my home address etc. - not some guy with a wrong email address. I called the bank and they shut down the accounts and the cards. They say the accounts were opened with my name and SSN, but, otherwise, they have no info. The accounts were "associated" with my existing bank accounts, which seems like the dangerous/fraudulent part. The customer service person did not have much information on how the fraudster did the "association" - she said the person may been able to log into my account on the web, but the website does not show any weird logins in the log, and, also I have 2FA and didn't get any alerts. There were no transactions of any kind in the new accounts over the ~5 days they were open.
So, what's the scam here? Steal the new cards out of my mail, somehow move some money from my real accounts into the new accounts, and then use the cards to access the cash? This seems like not a great scam because of the number of emails/alerts I received before they got to that step. And if they were able to log into my accounts on the web, why not just direct some type of transfer/ACH from my existing accounts rather than creating brand new accounts? Or if the scam is to open an account in my name and do bad deeds with it, why open it at the bank I use and associate it with my existing accounts, which sent me all kinds of alerts? Bottom line: what kind of scam is this, or is some kind of a non-fraudulent glitch more likely (i.e., guy with my name was just trying to open his own accounts)?
Also, should I call the credit report agencies and do a freeze or fraud alert?
I started getting emails a few days ago like "Congratulations, your application was successful!" from my normal bank. I figured they were some kind of mistake or phishing and just ignored them. (I have a long history of getting emails sent to my gmail address for someone else who has the same name.) But then I kept getting more messages about "Set up your new accounts!" and "your new debit card is on the way!" and I started getting more concerned. I checked on my banking app and there were two new accounts listed - both with zero dollars - one checking and one savings. And these accounts were set up with my home address etc. - not some guy with a wrong email address. I called the bank and they shut down the accounts and the cards. They say the accounts were opened with my name and SSN, but, otherwise, they have no info. The accounts were "associated" with my existing bank accounts, which seems like the dangerous/fraudulent part. The customer service person did not have much information on how the fraudster did the "association" - she said the person may been able to log into my account on the web, but the website does not show any weird logins in the log, and, also I have 2FA and didn't get any alerts. There were no transactions of any kind in the new accounts over the ~5 days they were open.
So, what's the scam here? Steal the new cards out of my mail, somehow move some money from my real accounts into the new accounts, and then use the cards to access the cash? This seems like not a great scam because of the number of emails/alerts I received before they got to that step. And if they were able to log into my accounts on the web, why not just direct some type of transfer/ACH from my existing accounts rather than creating brand new accounts? Or if the scam is to open an account in my name and do bad deeds with it, why open it at the bank I use and associate it with my existing accounts, which sent me all kinds of alerts? Bottom line: what kind of scam is this, or is some kind of a non-fraudulent glitch more likely (i.e., guy with my name was just trying to open his own accounts)?
Also, should I call the credit report agencies and do a freeze or fraud alert?
I think calling the credit report agencies would be a good thing. Something funky is going on. Put a stop to it. Try to figure out, from your bank, who allowed it to happen, how was this allowed to happen?
posted by Windopaene at 3:56 PM on July 5, 2023
posted by Windopaene at 3:56 PM on July 5, 2023
The danger is someone with credentials for the OTHER account may be able to convince the bank employee to gain access into YOUR account instead.
posted by kschang at 3:56 PM on July 5, 2023 [1 favorite]
posted by kschang at 3:56 PM on July 5, 2023 [1 favorite]
Not to threadsit, but get on the phone with someone at your bank. Ask how this could happen? Make an appointment to go to your bank, (unless it is some online thing) Meet that person, and get some answers. Show your ID to that person, etc.
posted by Windopaene at 4:01 PM on July 5, 2023
posted by Windopaene at 4:01 PM on July 5, 2023
Response by poster: This was all an online thing. It’s one of the giant banks. The rep said only that the person used my name and SSN to open the accounts.
posted by Mid at 4:13 PM on July 5, 2023
posted by Mid at 4:13 PM on July 5, 2023
If they did it all online, they may be able to "recover" access to your account by talking the ears off the customer support agent, as they seem to have your credentials in order.
Not sure if your bank supports this, but I would go down to a local branch of that bank, show ID, ask them to look up the extra accounts that were added (history of such), and ask them to stop ANYONE (including yourself) from any online account adding or such, unless you are physically there at the branch and verify ID and all that. Basically make a note in the file to limit account changes to in-person visits only.
posted by kschang at 4:17 PM on July 5, 2023 [7 favorites]
Not sure if your bank supports this, but I would go down to a local branch of that bank, show ID, ask them to look up the extra accounts that were added (history of such), and ask them to stop ANYONE (including yourself) from any online account adding or such, unless you are physically there at the branch and verify ID and all that. Basically make a note in the file to limit account changes to in-person visits only.
posted by kschang at 4:17 PM on July 5, 2023 [7 favorites]
As a matter of basic financial hygiene, you should freeze your credit at the major credit reporting bureaus ASAP. This is a good idea in any case, but now that you know your SSN is compromised, it's especially important.
If you're not getting good answers from your bank about how this happened and what they'll do to prevent it in the future, then I'd strongly recommend finding a different bank or credit union to do business with.
posted by Aleyn at 4:32 PM on July 5, 2023 [6 favorites]
If you're not getting good answers from your bank about how this happened and what they'll do to prevent it in the future, then I'd strongly recommend finding a different bank or credit union to do business with.
posted by Aleyn at 4:32 PM on July 5, 2023 [6 favorites]
Are you of retirement age? If so, be aware that there was a data breach of numerous organizations not that long ago. I myself was caught up in it, so somewhere in Russia there's some a-hole who has my name, date of birth and SSN.
Helpfully, my pension plan notified me of this and provided me with a two-year credit security protection plan, free of charge. You might consider enrolling in such a plan so that you can monitor your credit situation. In particular, you can be alert for new credit cards being issued in your name.
posted by SPrintF at 6:06 PM on July 5, 2023 [2 favorites]
Helpfully, my pension plan notified me of this and provided me with a two-year credit security protection plan, free of charge. You might consider enrolling in such a plan so that you can monitor your credit situation. In particular, you can be alert for new credit cards being issued in your name.
posted by SPrintF at 6:06 PM on July 5, 2023 [2 favorites]
Might also be worth an hour of a local lawyers time.
posted by Windopaene at 6:10 PM on July 5, 2023
posted by Windopaene at 6:10 PM on July 5, 2023
A lot depends on what "associated" means. Hopefully not that it was possible to transfer money between them.
From a social engineering standpoint I would guess they wanted to have full information about one of the accounts "associated" with yours and use that to talk a representative into resetting passwords, changing addresses, phone numbers etc. for all of the accounts.
posted by Tell Me No Lies at 8:44 PM on July 5, 2023
From a social engineering standpoint I would guess they wanted to have full information about one of the accounts "associated" with yours and use that to talk a representative into resetting passwords, changing addresses, phone numbers etc. for all of the accounts.
posted by Tell Me No Lies at 8:44 PM on July 5, 2023
If this happened to me I would go in person to my local bank branch, ask to speak with the branch manager, and would not leave until I fully understood how this had happened and what the bank was doing to make sure it didn't happen again.
Also, what Blue Jello Elf said. My first suspicion would be that the new accounts originated with a bank employee; it's a common fraudulent move banks do. It wasn't just Wells Fargo who was caught doing this; last year U.S. Bank was fined $37.5 million after a decade of doing the same thing:
Minneapolis-based U.S. Bank, the country's fifth-largest bank...accessed unsuspecting customers' credit reports and opened checking and savings accounts, credit cards and lines of credit without customers' authorization in order to boost sales, the CFPB found in a five-year-long investigation.
U.S. Bank knew its employees were opening the unauthorized accounts but failed to regulate them, according to the agency. The bank imposed sales goals on workers and introduced an incentive-compensation program that financially rewarded employees for selling its products like deposit accounts and credit cards, the CFPB said.
"For over a decade, U.S. Bank knew its employees were taking advantage of its customers by misappropriating consumer data to create fictitious accounts," CFPB Director Rohit Chopra said in a statement Thursday.
posted by mediareport at 9:31 PM on July 5, 2023 [2 favorites]
Also, what Blue Jello Elf said. My first suspicion would be that the new accounts originated with a bank employee; it's a common fraudulent move banks do. It wasn't just Wells Fargo who was caught doing this; last year U.S. Bank was fined $37.5 million after a decade of doing the same thing:
Minneapolis-based U.S. Bank, the country's fifth-largest bank...accessed unsuspecting customers' credit reports and opened checking and savings accounts, credit cards and lines of credit without customers' authorization in order to boost sales, the CFPB found in a five-year-long investigation.
U.S. Bank knew its employees were opening the unauthorized accounts but failed to regulate them, according to the agency. The bank imposed sales goals on workers and introduced an incentive-compensation program that financially rewarded employees for selling its products like deposit accounts and credit cards, the CFPB said.
"For over a decade, U.S. Bank knew its employees were taking advantage of its customers by misappropriating consumer data to create fictitious accounts," CFPB Director Rohit Chopra said in a statement Thursday.
posted by mediareport at 9:31 PM on July 5, 2023 [2 favorites]
You need to put a freeze in with ChexSystems to keep bank accounts from being opened. A regular credit freeze through the credit bureaus won’t impact the person’s ability to make accounts in your name. Banks use ChexSystems for verification and that’s what needs to have the freeze.
posted by Bottlecap at 6:26 AM on July 6, 2023 [7 favorites]
posted by Bottlecap at 6:26 AM on July 6, 2023 [7 favorites]
I'm having exactly the same issue.
In my case, the new accounts were not associated with my regular accounts with that bank, but a search for my SSN brings it up. I strongly suspect it was a bank employee/the bank doing it similar to the US Bank and Wells Fargo practices. I filed a police report and the officer taking the report told me they have seen it happening more frequently.
Seconding that you should freeze your SSN at ChexSystems. It was news to me that the banks use a different system until a fraud specialist told me about it. The fraud specialist at the bank also helped me to change my username (I had already changed my password and instituted 2FA).
Also suggesting that you freeze your credit and put a fraud alert with all three reporting agencies, and make sure you have a login with each one, in part to prevent anyone else from opening one. The agencies also have advice pages for fraud that I found helpful to go through.
Identitytheft.gov also lets you file a report and walks you through a recovery plan.
posted by Preserver at 10:56 AM on July 6, 2023 [4 favorites]
In my case, the new accounts were not associated with my regular accounts with that bank, but a search for my SSN brings it up. I strongly suspect it was a bank employee/the bank doing it similar to the US Bank and Wells Fargo practices. I filed a police report and the officer taking the report told me they have seen it happening more frequently.
Seconding that you should freeze your SSN at ChexSystems. It was news to me that the banks use a different system until a fraud specialist told me about it. The fraud specialist at the bank also helped me to change my username (I had already changed my password and instituted 2FA).
Also suggesting that you freeze your credit and put a fraud alert with all three reporting agencies, and make sure you have a login with each one, in part to prevent anyone else from opening one. The agencies also have advice pages for fraud that I found helpful to go through.
Identitytheft.gov also lets you file a report and walks you through a recovery plan.
posted by Preserver at 10:56 AM on July 6, 2023 [4 favorites]
More evidence that this is common fraud from banks themselves:
Bank of America Fined for Fake Accounts
posted by mmoncur at 9:26 PM on July 11, 2023 [1 favorite]
Bank of America Fined for Fake Accounts
posted by mmoncur at 9:26 PM on July 11, 2023 [1 favorite]
Response by poster: Quick follow-up:
I received the (canceled) banks cards in the mail from the new accounts. Apparently nobody tried to lift them from the mailbox.
I put in a credit freeze and the 3 big reporting agencies and also ChexSystems.
A couple of days ago (about two weeks after the first incident) I got an email from my bank saying "Sorry, your attempt to open a new account online has been rejected." So, it seems that the scammer tried again to open an account using my gmail, if not also my SSN, but the credit freezes must have blocked it.
It's all weird - my money is on some kind of glitch or bank insider misconduct that creates duplicate accounts. Nobody tried to charge anything or do anything with the fake accounts. Though perhaps it was all a longer con that involved convincing customer service to let the fraudster access my real accounts. Thanks all.
posted by Mid at 10:58 AM on July 18, 2023 [1 favorite]
I received the (canceled) banks cards in the mail from the new accounts. Apparently nobody tried to lift them from the mailbox.
I put in a credit freeze and the 3 big reporting agencies and also ChexSystems.
A couple of days ago (about two weeks after the first incident) I got an email from my bank saying "Sorry, your attempt to open a new account online has been rejected." So, it seems that the scammer tried again to open an account using my gmail, if not also my SSN, but the credit freezes must have blocked it.
It's all weird - my money is on some kind of glitch or bank insider misconduct that creates duplicate accounts. Nobody tried to charge anything or do anything with the fake accounts. Though perhaps it was all a longer con that involved convincing customer service to let the fraudster access my real accounts. Thanks all.
posted by Mid at 10:58 AM on July 18, 2023 [1 favorite]
You are not logged in, either login or create an account to post comments
posted by Blue Jello Elf at 2:49 PM on July 5, 2023 [28 favorites]