The Moneyist: I fell victim to the ‘easiest banking scam in the world,’ and $20,000 was stolen from my account. How could I have been such a fool?

I don’t know if any of your readers have had similar experiences, but here goes. I received a call from my bank, Citibank, and was told that I had been the victim of online fraud. Except it wasn’t Citibank. It was late on a Sunday evening, and I was tired and getting ready for bed. The caller asked me if I had used an ATM recently, and I said that I had recently been to Paris and used an ATM that looked suspect, but I was in dire need of cash. I put in my PIN number and withdrew 200 euros ($220).

The customer-service representative was very nice and told me to always be careful about using ATMs. He said that, in order to help me and verify my identity, he was going to send me a code, which I read out to him over the phone. He then sent me two more codes, one for each purportedly fraudulent transaction.

“‘As I was speaking to the ‘bank,’ $10,000 was withdrawn from my account, and then another $10,000 was taken out within minutes.’”

I checked my mobile app, and as I was speaking to the ‘bank,’ $10,000 was withdrawn from my account, and another $10,000 was taken out within minutes. I was so confused and scared,. He asked me for the last four digits of my Social Security number, and five minutes later he asked for the first five digits. By this point, I knew something was wrong, but I still gave them to him. My heart was racing, and I was in a panic.

Moments after he hung up, I got another call from — you’ve probably guessed this — Citibank. They said there was suspicious activity on my account, asked if I had made two transactions of $10,000 and said I had set up a separate account online. I freaked out. The weirdest part is that halfway through the first call, I felt something was wrong, but I still did what the caller told me to do. What the hell? I was down $20,000 in 10 minutes.

I feel like such a fool. I was incredibly upset that I would fall for such an obvious scam, especially as I have always warned people about scams and was actually annoyed with my mother a couple of years ago for allowing a cold caller to access her computer, then lock it and blackmail for her money — which she never gave him. I was afraid to tell people what happened because I knew they would chastise me or laugh, so I am writing to you.

Update: Two days after sending you my original email, the money was back in my account. The bank had taken care of it. I was so relieved and thankful that Citibank

C,
+0.07%

was able to address this issue and fix it, but I wanted to alert you and your readers to this because if it can happen to me, it can happen to anyone. It’s the easiest banking scam in the world. How can someone who is supposedly intelligent and aware of these issues fall victim to such a scam?

Feeling Like A Fool

Dear Feeling,

Scammers are looking for that one window of opportunity.

The key words in your letter are “scared” and “panic” and “tired.” When we are in a state of high anxiety, our logic and reasoning are more likely to become impaired. That’s why scammers emerge from their swamp and target people who are experiencing a crisis in the aftermath, for example, of a natural disaster. It’s why they call you late at night, when you are tired, or try to catch you when you are distracted at work. This study from the Journal of Neuroscience concluded: “A detrimental aspect of anxiety is disruption of prefrontal cortex-mediated executive functions, such as flexible decision making.”

Most of us have learned not to answer calls from unknown numbers. Scammers can call your phone using the name of your bank. It’s a confidence trick that wrongfoots you from the moment you pick up the phone. This is a key starting point: You immediately believe you are talking to a bank representative, and they are getting better at replicating genuine scripts that customer-service representatives use. From that moment, they have your trust, they have created a sense of urgency and they are providing the reassurance that you need by telling you they will fix the problem.

Like phony fortune tellers, good scam artists take a nugget from something you’ve said and then go to town on it. In your case, you mentioned an ATM in Paris, and they used this to tell you to be careful about using such machines and, I assume, pretended to look at your transactions and confirm that, yes, you did make such a transaction. Conversely, you can use this against such scammers: “I used my ATM card in London a few weeks ago. Do you see that in my transactions?” The scammer, like a bad psychic, may be tempted to say, “Yes, I see it!”

“‘Like phony fortune tellers, good scam artists take a nugget from something you’ve said, and then go to town on it.’”

— The Moneyist

Most important, a bank representative will never ask you for your Social Security number or passwords, and they will never ask you to read off codes for verification. Citibank has a comprehensive guide to combating fraud and says it will never text you asking for confidential information. As you now know, the scammer was accessing your account, changing your password and asking you to read out those codes so he could withdraw money and set up another account so he could transfer and withdraw even more money from your accounts.

Don’t trust emails purporting to be from your bank. Always delete them and call your bank directly, using the number on the back of your card. Citibank says: “Always independently verify emails and telephone numbers before engaging in any dialogue, and never click on any links or open attachments contained within unsolicited emails. Ensure your devices have up-to-date operating systems and anti-virus software. Never give your card PIN to anyone. It should only be known by you and you should only use it when you are initiating a transaction.”

Good people tend to want to see the best in others. It’s hard to fathom how anyone could talk to us in a caring and supportive manner, yet at the same time be manipulating our good nature to steal from us. How can anyone lack such empathy? How could they be so cruel? Psychologists say the most successful scam artists lack that compassion and exhibit the “dark triad” of psychological traits: narcissism (extreme self-centeredness), Machiavellianism (manipulation of others) and psychopathy (acting impulsively with no regard for other people’s feelings).

Be kind to yourself. You freaked out and did what the person told you to do, even though your inner Jiminy Cricket was trying to warn you against it. But the scammer now has your Social Security number, so log onto all three major credit bureaus — Experian
EXPGY,
-1.32%,
TransUnion
TRU,
-0.45%
and Equifax
EFX,
+0.30%
— and lock your credit so no one can take out loans or open accounts in your name. Your phone number will also be on a scammer list, so beware of more calls. Your bank may suggest setting up a new checking account altogether. Use it as an opportunity to review your automatic deposits.

That way, you may even save some money from this traumatic and unsettling experience.

The Moneyist: “Like phony fortune tellers, good scam artists take a nugget from something you’ve said and then go to town on it.”

MarketWatch illustration

Readers write to me with all sorts of dilemmas.

By emailing your questions, you agree to have them published anonymously on MarketWatch. By submitting your story to Dow Jones & Co., the publisher of MarketWatch, you understand and agree that we may use your story, or versions of it, in all media and platforms, including via third parties.

The Moneyist regrets he cannot reply to questions individually.