Chapter 11: The Call from the Bank: When the Caller Knows Everything About You

Welcome to the second part of the book. If the first part dealt with the fundamentals—the psychology of the con artist, their hunting methods, and how they spin their digital web—here we dive into the heart of the darkness. We enter the sanctuary, the place where most of us feel safest, but in reality, are most exposed: our relationship with the bank and credit card issuers.

For the average citizen, the bank is not just a financial institution. It is the fortress that protects a lifetime of labor. It is the place where one's salary is deposited, where money is saved for the children's apartment, and where the pension that will allow us to age with dignity is managed. The reputation of banks is built on trust, bank secrecy, and a sense of absolute security. It is precisely upon this trust that the most sophisticated scammers ride. In this section, we will analyze how impersonating an authoritative body becomes the deadliest weapon in the arsenal of financial cyber-fraud.

The Scenario: The Fortress That Collapsed from Within

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustrative purposes only.

It was a Tuesday afternoon, the kind where routine takes over the mind. Mordechai, a retired accountant, a man who spent his whole life dealing with numbers and precision, sat on his balcony. His mobile phone vibrated. On the display appeared a number that was very familiar to him—a number ending in the recognizable digits of his bank's customer service center.

"Hello, this is Liron from the bank's security department," said a female voice, professional, businesslike, almost cold. There was no trace of excessive urgency that would arouse suspicion, just the tone of a clerk doing her job. "Am I speaking with Mordechai?"

"Yes, that's me," replied Mordechai, feeling a slight pang of anxiety in his stomach. "Is something wrong?"

"We are currently identifying a suspicious transfer attempt from your account for 12,000 NIS in favor of a beneficiary abroad. Did you perform such an action in the last few minutes?"

"Absolutely not!" exclaimed Mordechai. "I'm at home, I haven't touched the computer."

"I feared as much," answered Liron with annoying calm. "Don't worry, our system blocked the operation temporarily, but it appears there was a breach of your client file. I need to verify a few details to re-secure the account. Just to verify I'm speaking with the right person, the last four digits of your credit card are 4482, right?"

Mordechai was amazed. "Yes, exactly."

"And the home address we have on file is 14 Herzl Street, right? And you also have a small savings account that was opened two months ago?"

At this stage, all of Mordechai's defensive walls collapsed. The caller asked him for nothing at this stage, she only presented him with information. She knew everything. She knew his address, the type of credit card he had, and even details about recent transactions. In Mordechai's mind, there was not a shadow of a doubt: he was talking to the bank. The thought that this was a scammer sitting in a hideout with lists that leaked from the dark web did not even cross his mind.

"Mr. Mordechai, in order to stop the breach and cancel the unauthorized access, I am sending you now a verification code from the bank to your phone. Please read it out to me so I can enter your account's security settings and block the intruder."

The code arrived. In the SMS message, it was clearly written: "Your code to perform the action is...". Mordechai, who was under heavy psychological pressure and under the absolute belief that he was cooperating with the authorities, read out the code. He did not know that at that very moment, the "clerk" was using this code to authorize an unauthorized bank transfer to the account of a "money mule" (straw man) or to change the phone number associated with the account, thereby taking full control of it.

When the conversation ended, Liron promised him that everything was being handled and that he would receive a summary call within an hour. The call never came. Two hours later, when Mordechai tried to log into the app to calm down, he discovered his access had been blocked. When he went to the branch the next morning, the bitter truth became clear: tens of thousands of shekels—his entire checking account balance—had vanished in three quick transfers performed immediately after that conversation.

The Illusion of the All-Knowing: How Do They Really Know?

The central component that causes educated, calculating, and careful people to fall into this trap is the "information authority effect." When a stranger calls you and knows personal details that only an authorized body should know, your brain performs a cognitive shortcut. It concludes that if he knows my secrets, he must be who he claims to be.

But the reality in the digital age is far grimmer. The information about us is not stored in steel vaults. Over the years, many breaches have occurred in databases of insurance companies, shopping sites, government offices, and communication companies. Your details—full name, ID number, address, phone number, and sometimes even the last four digits of a credit card—are sold in bundles of many records on hacker forums for huge sums or pennies, depending on the freshness of the information.

The scammer does not need a direct breach of your bank. He only needs the initial piece of information that will buy him your trust. The moment he tells you your ID number, he has already crossed most of the way into your pocket. The use of "spoofing" technology (faking the caller's number) completes the picture: not only does the caller know everything about you, but your phone also testifies in his favor and displays the name of a recognized banking institution.

It is important to understand this dynamic: the prior information is the bait. The conversation is the trap. The code you provide is the key. Without your code, most scammers would still lack the final link in the chain—the final confirmation to execute the transaction or change account settings. Therefore, they invest so much effort in building a reliable and professional persona.

The Legal Triangle: The Client, the Bank, and the Law

When a case of a person who fell victim to such a scenario is discussed, the first question asked is: "How did the bank let this happen? Where is their responsibility?". The legal answer is complex, and it relies heavily on the Payment Services Law, 5779-2019.

Modern Israeli law created a significant change in the field of financial consumer protection. Today, the starting point is that if an "unauthorized payment transaction" was performed (i.e., the client did not give his conscious and free consent to execute the transaction for the benefit of the specific beneficiary), the obligation of the bank to return the money can be examined.

However, this is where the fine print and legal battles come in. Banks may use claims of "fraud" or "gross negligence." The bank's argument in similar cases will usually be: "We sent an explicit warning message together with the code. The client provided the code of his own free will to a stranger. This is gross negligence that absolves us of responsibility."

During his years of professional work, the argument arises repeatedly that providing a code under sophisticated psychological manipulation should not be considered "gross negligence." When a scammer uses inside information (or information that appears as such), fakes a phone number, and creates an atmosphere of emergency, they perform "social engineering" that neutralizes the judgment of a reasonable person. One can analyze whether it is reasonable to expect an ordinary person to stand against such a well-oiled psychological attack.

One can see an increasing reference in the legal approach to the power gaps. The bank, as the "cheapest loss avoider," possesses sophisticated monitoring systems. If a client has never performed a transfer abroad, or if the phone number in the account suddenly changes and immediately afterward transfers are executed in irregular amounts—it is possible that the bank should have identified this. It can be argued that the bank's duty of care does not end with sending an SMS, but also includes identifying irregular patterns (Anomaly Detection) and stopping transactions in "real-time" until a certain confirmation is received.

However, it is important to emphasize: the law does not grant a "blank check." If it turns out that the client acted in bad faith, or if the bank's warnings were clear and unequivocal under the circumstances, the responsibility may remain on their shoulders. Each case is examined on its merits: What was said in the conversation? What messages were sent? What was the previous activity pattern in the account?

The Moment of Truth: The Discovery and the Shock

The hardest stage in these cases is not just the loss of money. It is the loss of self-confidence. Over the years, Attorney Ha'lulu has encountered diverse cases in which victims feel emotionally broken and ask themselves how they fell into the trap. Professional guidance, even before examining the legal aspects, is intended to clarify to the victims that they have fallen victim to sophisticated criminal activity.

The initial shock sometimes occurs when the bank refuses to return the funds. This is a defining moment where the client feels that the system is turning its back on them. The claim that the client provided their verification details to a third party is often the factor that leads people to give up, out of a feeling that the system is too big for them.

But this is exactly where the legal examination begins. One can examine the transcripts of the conversations (if they were recorded), and demand from the bank the records of its security systems—what was known and at what time? Did the bank's systems alert when the money left? Why was a proactive call not made to the client when an irregular operation was identified? In many cases, it is possible to identify "warning lights" that could have led to imposing responsibility on the banking institution.

It must be remembered that the bank is obligated to have loyalty to the client. This duty is seen as a substantive duty. In a world where digital fraud is common, one can expect banks to adjust their level of protection to the level of the scammers' sophistication. Knowing the client (Know Your Customer) should be used not only for regulatory purposes but also as a means of protection against fraud.

Warning Signs: When to Hang Up Immediately?

• Initiation of the call: Banks, as a rule, do not tend to call and ask for a code that arrived by SMS. The code is intended to be used by the client for an action, not by the clerk for them.
• Artificial sense of urgency: Creating time pressure is a common tool for bypassing logical judgment.
• Request for confidential details: Generally, there is no need to provide the bank with details such as a full credit card number or a secret code in an incoming call, as the information already exists in their systems.
• Discrepancy in the SMS: It is important to read the content of the SMS message carefully. If the purpose of the code indicated in the message is different from what was said in the conversation—this is a significant warning sign.
• Language and phrasing: It is worth paying attention to linguistic errors, lack of recognition of professional terms, or unusual background noise.

What to Do Immediately If You Have Fallen Victim?

1. Disconnect and Call the Bank: As soon as a suspicion arises, it is recommended to disconnect the call and contact the official center of the bank proactively.
2. Freeze Account and Cards: It is advisable to request an immediate freezing of the ability to execute transfers and cancellation of credit cards.
3. Documentation: It is recommended to document the time of the call, the number, the content of the conversation, and screenshots of the SMS messages.
4. Filing a Police Report: Filing a complaint is a significant stage in the clarification process with the bank.
5. Changing Passwords: It is recommended to change passwords for financial services from a secure device.

Legal Aspect: Your Working Assumption

In cases of fraud, legal options for returning the funds can be examined, but this sometimes requires persistence. When examining the circumstances, one must check whether the bank complied with the relevant regulatory instructions, such as proper banking management instructions, and whether its monitoring systems were reasonable. As the transaction performed was more irregular to the nature of the regular activity, the chances of examining bank liability may increase.

Remember: The law offers tools for dealing with these situations. In the case of fraud, one can examine whether banking duties were breached. If the bank failed to identify warning signs that it should have identified, legal liability may arise for the damage caused.