Key Talks Fraud^SM

[00:00:04] Kolt: Hello and welcome to the Key Talks Fraud podcast. In each episode, we bring on experts to talk about fraud trends, emerging threats, and steps you can take to help protect your financial accounts. We’re glad you’ve joined us today. Let’s get started.

[00:00:16] Kolt: By way of introduction, my name is Kolt. I’m the head of enterprise fraud services here at Key. On this podcast, we talk about fraud in a very real, practical way — what’s actually happening, how people get caught up in it, and what you can do to protect yourself. Today we’re going to talk about check fraud, and it might surprise some people because checks seem so old school, but check fraud is one of the most pervasive frauds that we see. I’m joined today by Stacie. Stacie leads our fraud solutions team here at KeyBank and spends every day thinking about how fraudsters and criminals are trying to exploit our clients in the financial services system. So Stacie, thanks for being here.

[00:00:51] Stacie: Yeah, thanks, Kolt. I’m really glad we’re talking about checks today because check fraud really catches people off guard when it does occur.

[00:00:59] Kolt: So let’s talk about this. Let’s just start with the basics. What is check fraud?

[00:01:03] Stacie: Well, at its simplest, Kolt, check fraud is really when either a physical check is stolen in the mail, or the information on a check is stolen — so your account information — and then the criminals use those items to obtain money that doesn’t belong to them. Again, it could be stealing a physical check; it could just be getting the information that’s on your check — your account number, whatever method they deem as the best, most practical way to steal your information. They’re going to use it, create checks, and take your money.

[00:01:42] Kolt: All right, so I’m pretty savvy. I know that fraudsters steal your mail out of your mailbox, and I don’t do that anymore. I take it to the post office. I’m safe that way, right?

[00:01:50] Stacie: Whoa, no — so it sounds like you’re going to be safe, but in actuality, there are lots of ways that checks can be compromised. If you drop it in the blue box — not safe. Criminals can fish it out. It’s like taking a fishing pole and fishing it out of the blue box. So the residential mailboxes are not safe, and the blue collection boxes are not safe either. They can steal the arrow keys.

[00:02:18] Kolt: I was going to ask you that. What if I take it into the post office branch — am I safe there?

[00:02:22] Stacie: No, not even into the postal branch — you’re not safe there because criminals have actually been targeting the arrow keys that postal service workers carry. Those keys open lots of different boxes, which allows them to steal lots of envelopes that hopefully — for them — contain their number one target: a handwritten check from you or me.

[00:02:45] Kolt: All right, so let’s talk about this. A check is not like other payment types like a debit card or a credit card that has just an account number. There are other really useful things that fraudsters can get off of that check.

[00:02:58] Stacie: Absolutely. They’re going to get your account number and your routing number for your bank, which is like gold. But you also have your name, your address, and your signature — so they can copy and counterfeit your signature. And some people put things like their phone number on checks so they don’t have to write it out when they write a check at their local grocery store. Back 20 years ago, Kolt, people were even putting their Social Security numbers on checks. Luckily we’ve come a long way, but everything a fraudster needs to perpetrate fraud is right there on that check.

[00:03:38] Kolt: And it seems so low-tech, right? But there’s a lot of information on there. It’s actually one of the most information-exposing payment methods out there, for all the things you just talked about. All right, so we’ve touched on writing checks — let’s talk a little bit about receiving checks. If I get a check, am I safe? Is there any risk in receiving one? Say I sold my mountain bike for $2,100 and someone sent me a check for $2,500 for shipping and handling — is there something I should be looking out for when I receive a check like that?

[00:04:12] Stacie: Yeah, absolutely. Those instances where you receive more money than what you were owed are typically what we call overpayment scams. What they want you to do is deposit that check, take the money, and send back the overpayment to the fraudster. And by the time you’ve sent that money out the door, guess what happens, Kolt — that check bounces. It doesn’t actually pay.

[00:04:42] Kolt: So explain that to me. If I deposit a check into my bank and they make the funds available, the check’s cleared, right? The funds are good.

[00:04:48] Stacie: No, absolutely not. That is not an indicator that a check has cleared, because checks really never “clear” in real time. A check clears when it is returned — or not returned. When a check goes bad, that’s when you know it’s bad. You cannot assume that because the money landed in your account that the check has actually paid in full.

[00:05:13] Kolt: This is a really important point, and I want to spend a little time on it. If you do get a check like that, deposit it, and then send money back — you are liable for what you’ve put into your account. One of the best things you can do, if the check is drawn off of another bank, is to actually take that check and cash it at the issuing bank. Let them know what happened; be forthcoming with them so it doesn’t look like you’re trying to pass a bad check. That’s a good way to secure the funds and make sure you’ve got them before you send merchandise, a car, or anything else. We actually had one recently where someone bought a car, the seller sent the car, and they never heard from the buyer again. So you can absolutely become a victim on the deposit side as well. Key lesson: funds being available does not mean the check is good.

[00:06:00] Kolt: Try to use other payment methods besides checks.

[00:06:03] Stacie: Well, Kolt, I think we need to be really direct here. People need to stop writing checks. While checks are one of the easiest payment methods to use, they’re also one of the easiest for criminals to exploit. Every time you write a check, all of your information is sitting out there for fraudsters to have at their disposal. The best thing we can do is really move from paper checks to digital payments — going through your online banking platform and using the digital payment options instead of keeping a paper checkbook around. I know it’s a shift for a lot of people, but it’s the safest way to protect your data, your information, and your bank accounts.

[00:06:55] Kolt: Yeah, the real truth is that those are more modern payment types than checks, which have been around forever — and they come with a lot more security built in. Great advice. Listen, this is a tough one. I struggle with it with my mom — she sends checks in the mail for the grandkids’ birthdays and Christmas, and I’ve really had to talk to her about the risks. While it might feel more tangible, an electronic payment is the preferred method for us now. So as we’ve talked about this: avoid public mailboxes, don’t put the “come steal me” flag up in your mailbox, secure any blank checks, and

[00:07:30] Kolt: whenever you write checks, don’t leave any blank space — fill it all in so that dollar amounts can’t be manipulated.

[00:07:36] Stacie: There are also certain pen types worth mentioning, Kolt. You can Google it, but there are specific pens that are resistant to washing. Some pens allow the ink on a check to be washed off quite easily, but others are much more durable. Do a little bit of homework and find a pen that holds up well on paper.

[00:08:00] Kolt: And I’ll say this — it sounds so simple, but we say it all the time: monitor your accounts. Whenever a check you’ve written posts to your account, actually review it. Make sure the payee hasn’t been altered. Make sure the dollar amount hasn’t been altered. You have limited windows to initiate a claim on that. So don’t just see “Check 1234 cleared” and assume it made it to the right area. If it gets stolen and someone else deposits it, they could have changed the payee and the amount. Monitor your accounts and look at those checks as they come through. Absolutely. So Stacie, if someone has become a victim of fraud, what should they do?

[00:08:45] Stacie: You need to act quickly, Kolt. Immediately report it to your bank. You can usually do that through the phone channel — the 1-800 number on the back of your debit card. You can go directly into your branch, or you can also file a claim through the online banking portal.

[00:08:56] Kolt: The faster you can do it —

[00:08:59] Stacie: The faster you can do it, the better.

[00:09:01] Kolt: — the more options you have for recovery. So if you’re a KeyBank client, you can always call our Fraud Client Service Center at 1-800-433-0124. If you use TTY or TRS, you can dial 711. So Stacie, as we wrap up, any final thoughts on check fraud?

[00:09:20] Stacie: You know, fraud is incredibly pervasive, and criminals are going to adapt — and they’re going to adapt quickly. But I do think check fraud is one that will never go away. We’ve been saying for the 26 years I’ve been in banking that checks are going to go away, but they never go away. It’s a great example of how fraudsters shift from the latest new things and go back to the old “reliable” method that’s always been there. They’ve come back to check fraud, and it’s more important than ever that we do everything we can to just get checks out of the marketplace and away from the fraudsters.

[00:10:05] Kolt: Fraud education and prevention is very important. If you’re listening to this podcast, do me a favor — find two other people that you know and talk to them. Make sure they understand the risks of writing checks and what they can do to reduce that risk and prevent fraud. Whether you’re a KeyBank client or not, you can always visit key.com/fraud. There’s a lot of helpful information, tips, and resources available to everyone.

[00:10:25] Kolt: And that’s going to wrap us up for today. Thank you for joining us. As a reminder, this content is for informational purposes only. It is not financial, legal, or investment advice. For guidance specific to your situation, please consult a qualified professional. We look forward to you joining us next time on Key Talks Fraud.

[00:00:09] Kolt: Hello, welcome to the KeyBank FraudTalk podcast. I’m Kolt.

[00:00:12] Stacie: And I'm Stacie.

[00:00:14] Kolt: We've launched this new series to help our audience stay current on the continually evolving and increasingly sophisticated fraud scene. In each episode, we'll bring on subject matter experts to discuss a new fraud topic or an emerging threat to help listeners like you be aware of trending scams, the red flags to watch out for, and measures you can take to help protect your personal data and financial accounts. Thank you for joining us today.

[00:00:36] Kolt: So let's get started. Stacie.

[00:00:38] Stacie: Yeah.

[00:00:39] Kolt: Things that we’re seeing across the industry. Bank impersonation scams. Can we talk about those? Tell me what those are and how they evolve?

[00:00:46] Stacie: Sure. So the typical bank imposture scam will start with a text message, typically from your bank, right or reach out, a phone call. But a lot of these start with the most impersonated area of a bank right now as part of these social engineering scams is the Fraud Department, and so you might get a text message that asks you to authorize a $900 transaction at Walmart, for instance, right at any retailer. And you'll say, oh, no, I didn't do that. And then they'll call you immediately. And say we're from, you know, the bank fraud department and we're going to get you all cleared up, right. And the entire time, all they're doing is phishing information out of you, right? Getting credentials, yeah.

[00:01:38] Kolt: So we've seen this evolve and kind of talked about this years ago you would get these and they'll be some bank that you never banked with. And be like, I don’t bank with that mega bank, nice try, right, they did say no and they were really just trying to spray and pray is what we call it and hit somebody with that. Now, they’re getting a lot more targeted. How is it that these bad actors know who I bank with and they can impersonate that financial institution?

[00:02:05] Stacie: Sure, there's lots of ways Kolt, so it could be as simple as stealing your mail and seeing that you have a statement. Right? And then Googling your phone number for on any of the, you know, just Googling your phone number, finding your information and giving it a whirl. But sometimes it's through breach data, right. So if your card number was breached, the first 6 digits of your card number are indicative. It's called a bin number and it's indicative of the bank from which that card was issued so fraudsters can figure that stuff out. They're pretty savvy and they know exactly which bank they need to be impersonating in order to perpetrate their scheme.

[00:02:46] Kolt: Right. So that the data breach notification that I just got from my telco provider that said my payment information was compromised and maybe my name, but none of my personal information, that's enough for them to start sorting out, this is bank A. This is bank B, this is bank C and being able to target those. That's pretty interesting as long as we're on this. So a lot of times it's a text message that is coming to me. What should I be looking for in those text messages that might kind of brought me to know that it's not my financial institution and I'm going to talk about short codes that are being used.

[00:03:24] Stacie: Yeah, your bank, your financial institution is not going to reach out to you from what looks like a personal phone number or a personal e-mail address. Yes, you're going to receive financial institution notifications from short codes, right? So it could be a 5 digit number at the top. It could be that you get all of your messages from you know typically or it could be a three digit number with a dash and two more digits, something like that. So it's not going to be your typical phone number and it certainly is not going to be an international phone number that’s extremely long. So I think it's really fair to say if you're receiving text messages asking you to click on a link or take some action and it comes from a standard phone number of any kind or an e-mail address, don't respond. Right, don't. Don't reply. Just report as junk and delete is the safest way to go.

[00:04:18] Kolt: All right, so you've heard about direct contact via phone, right? So I spoofed the phone number. It looks like my bank is calling me and they'll say something like my bank’s fraud department, there's always a sense of urgency with. So whenever I answer that call, what's typically going to happen if it's a fraud actor or bad actor, what are they going to start trying to solicit from me? Like from an emotional state or information?

[00:04:47] Stacie: Sure. They're going to try and collect personal information that they can leverage to perpetrate their scheme. So let me give you a little bit more info. So the first, they're going to try and get your username and password right. Sometimes they might actually try to get your pin number. They're going to ask for information like your Social Security number. They're going to ask for, maybe your mother's maiden name, your date of birth. They're going to do things, and they're going to do it under the guise of I need to authenticate you. Right. So they're going to ask you the questions that a real bank would ask you if you called the bank and they needed to authenticate you. So they need those elements to be able to pass our authentication when they commit the fraud. So this is really important. Point is not giving information out to people who call you.

[00:05:36] Kolt: You said something that I’d like to touch on. Whenever you call us as a bank, we’re going to ask you for those things. When we’re calling you, we're not going to ask you. Either way, we’re not going to ask you for your password or your pin number right? The PIN numbers in the IVR, but we're never gonna ask for that kind of info.

[00:05:51] Kolt: So that's really good. OK, so on these and that I wanted to talk about a real-life use case that actually a fellow fraud fighter, who is a professional, actually fell in. He had reached out just like you talked about and he knew better. And one of the things he's always been taught is if my financial institution calls me, it is to hang up and call my financial institution so that I don't become a victim of this and I think we would tell everybody. We were we will never get upset with you. We actually encourage you to say that like let you call and we will get you redirected back to the Fraud Department if you call in and on some of these you'll find out like we never called you. But there's a little and you talked about social engineering like working on your emotions, giving you a sense of urgency or putting something in front of you that you just don't realize got put in front of you and on this one scenario is our fellow fraud fighter said. Hey, I'm going to call back the bad actor. Very polished, very well, skilled said we agree with you. That's exactly what we want you to do. Encourage them to do so. That said, let me just double check to see what the hold times are, so that you know what you’re getting into whenever that occurs and I cannot block your account until we hear back from you. The hold times are 75 minutes.

[00:07:06] Kolt: And all logic went out of his head, thinking if this is legit and everything sounded pretty good here. I could have a lot of fraud happening on my account, before they can get this closed up.

[00:07:18] Kolt: He fell for that and started giving them his information. I think he ended up losing like $1,500 with that, but that's the type of social engineering that we're talking about the level of sophistication and evolving fraud has really advanced over the last 5-10 years or even the last 18 months.

[00:07:36] Stacie: That's exactly right. They're savvier than ever. We talked about how the misspellings and the language problems with some of the schemes back in the day with AI being able to help you right, measurably better. We're just not seeing it looks, it sounds it.

[00:07:52] Stacie: Feels everything feels like it's legitimate, which is why you need to stop. Think, hang up and call your bank.

[00:07:59] Kolt: Listen, Stacie, I really appreciate the time today. That's all for today's episode. We hope you found this discussion on bank impersonation informative if you're a KeyBank client or not visit our Fraud Protection Center at key.com/fraud and please share this podcast with others.

[00:08:16] Kolt: If you're a KeyBank client and you think you may have been a victim of fraud. Contact the KeyBank Fraud Client Service Center at 1-800-433-0124. For those that use TTY or TRS, dial 711.

[00:08:29] Kolt: Don't forget to subscribe to Key FraudTalk for more insight on cybersecurity and financial protection. As a reminder, this content is for informational purposes only. It's not financial, legal, or investment advice. For guidance specific to your situation, please consult a qualified professional.