Breakdown 01
The fake security officer, taken apart by Zavialov Ilia Nikolaevich
The most expensive everyday scheme of recent years rests on a single promise: that money can be saved by moving it somewhere else. No such place exists.
How this scheme unfolds
- Step 1An inbound call
- Step 2The role of a bank officer
- Step 3«The payment is already going through»
- Step 4A transfer or a code
- Step 5The money is gone
A call you did not start
The number on the screen matches the official one, because it is spoofed onto the official one specifically. The voice is calm, the speech is rehearsed, and your real details are named in the first seconds.
The details prove nothing. Leaks happen constantly, and the last digits of your card, your address and your last order number are available to the caller.
The role: not a seller but a rescuer
The key difference from other schemes is that nobody is persuading you to buy. You are being persuaded that you have already been robbed and are rescuing yourself right now.
Inside that frame every action reverses its meaning. A transfer looks like rescue rather than spending. A code from a message looks like cancellation rather than a signature.
Safe accounts do not exist. That single sentence closes the whole scheme.
The deadline that stops you hanging up
«Do not hang up, the payment is going through right now», «if we break off the money leaves», «we are recording, stay on the line». These are not turns of phrase, they are the construction.
A genuine organisation loses nothing if you call back on the number printed on your card. Resistance to that step is the most reliable single indicator in the whole conversation.
The moment of loss: a transfer you made yourself
The transfer to the «safe account» is made by the victim, voluntarily and with correct confirmation. For the bank it is an ordinary operation rather than a break-in.
That is exactly why recovery here is hardest: no system saw a violation. The second variant of the same step is a code read out aloud, which confirms an operation inside somebody else's app.
What to do if the step has already been taken
The window is narrow and ordered by time: call the bank on the number from your card and block the account; delete the remote access program if one was installed; change the password and end sessions.
Then write down the time of the call, the number, the exact wording used and what you did. Those notes are needed by the bank and in a report, and within a day the details fade.
| Wording | Why it is there | Your action |
|---|---|---|
| «A transfer attempt was recorded» | To create the rescue frame | Hang up |
| «Do not break off the call» | To stop you calling back | Hang up |
| «Read out the code to cancel» | To obtain your signature | Do not read it out |
| «Install the support app» | To take control | Do not install |
| «Move it to a safe account» | To obtain a voluntary transfer | No such account exists |
Questions and answers
Can a bank call first?
It can, which is why the rule is not about who calls. Any inbound conversation about money is ended and restarted on the number printed on your card.
Why does the number match the bank's?
Caller ID spoofing is an available technique, and the official number is exactly what gets spoofed. The display is not a confirmation.
What comes first if the transfer has already been made?
Call the bank on the number from your card and block the account. Every minute counts, because the money is moved on within minutes.