Banking Phishing Scam: €7,000 Stolen in Seconds via SMS and Impersonation Call

A resident in Avellino Province, Italy fell victim to a phishing scam in which €7,000 was stolen from their bank account within seconds. The attacker used an SMS impersonating the bank, followed by a phone call from the fraudster posing as a bank representative, to obtain and misuse the victim's credentials.

How the Scam Works

This fraud case demonstrates a classic phishing attack. First, scammers send an SMS to the victim that appears to come from their bank. The message typically contains a fake link resembling the bank's official website or requests the victim to reply with personal authentication information such as user ID and password.

Once the victim clicks the link or replies with their credentials, the scammer obtains this sensitive information. Shortly after, the fraudster calls the victim, impersonating a bank employee. Using pretexts such as "security verification" or "account validation," they pressure the victim into providing additional details like one-time passwords (OTPs) or transaction confirmation codes.

With this information in hand, the scammer gains access to the bank account and transfers funds within seconds—before the victim realizes what has happened.

Warning Signs and How to Recognize Phishing

Verify the Source of Bank Messages

Determine whether messages were sent through your bank's official website or app, or from an unknown third party.
Official bank communications typically come through app notifications or dedicated email addresses, not SMS with suspicious links.
Banks never request passwords or user IDs via SMS.

Be Suspicious of Unsolicited Calls

If someone claiming to be a bank employee calls you, hang up and call your bank's official number to verify.
Bank staff will never ask for passwords, PINs, or one-time passwords over the phone.
Requests for personal information under the guise of "security checks" or "account verification" are red flags for fraud.

Prevention Tips

Don't Click Links in Messages：Links in emails or SMS can redirect you to fake banking websites designed to steal your information. Always access your bank's site by typing the URL directly into your browser.
Never Share Personal Information：Your bank will never ask for passwords, user IDs, or authentication codes via phone, email, or SMS. Only enter sensitive information through official bank apps or websites.
Enable Two-Factor Authentication：Set up additional security measures (such as OTP apps or biometric authentication) beyond your password. Even if scammers steal your login credentials, they won't be able to access your account.
Monitor Your Account Regularly：Review your transaction history frequently to spot any unauthorized transfers or suspicious activity.
Report Immediately：If you've been scammed or received suspicious messages, contact your bank right away and file a report with local law enforcement.

Where to Report

In Italy：Contact your bank's customer service, the Italian Banking Association (ABI), Banca d'Italia, or your local police (Carabinieri or Polizia di Stato).
Consumer Protection：Reach out to regional consumer protection agencies.