Vishing example: the fake bank call about a purchase
First comes a text about a purchase you did not make. Minutes later someone from the “fraud team” calls, already knows your name, calms you down and walks you through “cancelling” the purchase. Along the way they ask for a code, a password or for you to move your money to a “safe account”.
BANK: Purchase of $2,489.90 at ELECTRO-ONLINE. (Red flag 1) If you do not recognize it, do not reply: our Fraud Prevention team will call you in minutes.
- Caller
Am I speaking with Carla Gomez? I am calling from Fraud Prevention about the $2,489.90 purchase we just put on hold. I see your card ending in 4417 (Red flag 3).
- You
I did not make that purchase.
- Caller
Do not worry, we will cancel it now, but it has to be in the next few minutes (Red flag 4). You will get a code by text: read it back to me so we can confirm it is you (Red flag 5).
- Caller
And for safety we will move your balance to a protected account (Red flag 6) until the investigation is over.
Six red flags that give the fake bank call away
The text sets up the call
An alert about a large purchase creates fear and tells you to expect a call. When the phone rings, you are already ready to believe.
A number that proves nothing
The number and name on the screen can be spoofed. Hang up and call the number on the back of your card or the one in the app yourself.
Partial details that build trust
Your name and the last digits of your card circulate in data leaks and on receipts. Knowing them does not make anyone a bank employee.
Minutes to act
The countdown is there so you do not hang up and verify. A real hold does not disappear because you hang up and call back.
They ask for the code
The code that arrives by text authorizes a transaction or a sign-in. Whoever asks for it on a call wants to use it right then.
The “safe account”
No bank protects your money by moving it to another account. That request is the fraudulent transfer.
What to do if they call you
- Hang up. You do not have to be polite or finish the conversation.
- Call the bank yourself on the number on the back of your card or from the app, and ask whether there is a real alert.
- Never read out codes, passwords or card details on a call you did not start.
- If it involves a company account or card, tell finance and security.
If you already gave details or sent money
- Call the bank right away through its official channel, ask them to block accounts and cards and dispute the transactions.
- Change your online banking passwords from the official app and check that no new device was added.
- File a report and keep the text and the caller’s number as evidence.
The same trap on other channels
On WhatsApp
An account with the bank’s logo messages you about the “suspicious purchase” and offers an advisor. Anyone can set a profile name and photo.
With remote access
The caller asks you to install a “security” app to help you. It is a remote access tool: with it they see your screen and the codes you receive.
Against the help desk
The same technique works the other way around: someone calls the company help desk posing as an employee who lost their phone, to get a password or MFA reset.
Questions about vishing
Other scams to recognize
Would your team hang up and call the official number?
At Whalemate, vishing runs as a professional service: our team builds the role —bank, help desk, supplier—, makes the calls in an agreed window and measures who handed over what and who hung up to verify. The wrap-up trains exactly that habit: hang up and call the official number.