It starts with a text message from your bank: irregular activity on your account, call immediately. Minutes later, your phone rings, and the screen shows the bank's name, the real number. On the other end, a calm, professional voice with all the right words: fraud department, suspicious operation, card limit.
The voice apologises for the inconvenience and explains there have been strange payment attempts on your account. You are being "transferred to the security department". You wait, listening to hold music just like your bank's, and a second employee picks up with your name in front of him. The solution, you are told, is simple and urgent: move the money to a "safety account" while the problem is fixed. Just for a few hours. The sooner, the better.
Everything in this call is fake except one thing, the fear. That one is yours, and it is the raw material they work with. In the cases of this kind logged by Portugal's GNR early this year, the scheme worked in seventy-five percent of recorded attempts, and on 7 July the PSP police received 24 such complaints in a single day. Three out of four people make the transfer. To understand why, you need to see the other end of the line.
Now rewind
The real number on your screen was not magic, it was a purchase. The technique is called spoofing: it makes your phone display whatever number the attacker chooses. For over a year, the world's most popular service for this was a website called iSpoof, advertised on Telegram and paid by subscription, between 150 and 5,000 pounds a month, in bitcoin. It reached 59,000 customers, who made about ten million calls in a year. When Europol and London's Metropolitan Police shut it down in 2022, more than 100 million pounds had been stolen; the administrator, Tejay Fletcher, was sentenced to 13 years and 4 months in prison. The tool that made your phone ring costs less than a month's rent.
The calm voice that answered you is reading. The US Department of Justice spelled it out in April: the operators "worked from a script", first as bank staff, then as fake detectives, then as a fake court. In a raid in Lucknow, India, earlier this month, police seized the call scripts and described teams divided like a company: who baits, who dials, who plays the "bank", who closes the deal. The hold music and the "transfer between departments" you heard are props from the same theatre, and some theatres are built from scratch: in an Interpol operation this year, investigators found in Eswatini a complete replica of a Brazilian police station, with uniforms and signage, built purely as a set for scams.
And the "safety account" the money was headed to? It is a money mule account: a real account, lent or opened by a third party recruited with the promise of easy money, through which stolen funds pass before vanishing. Portugal's Polícia Judiciária found 18 such accounts in a single dismantled network; Europol, in one European operation, identified 10,759 mules. By the time you miss the money, it has already hopped from account to account.
Who is really on the other end
Here the story darkens. According to the UN human rights office report published in February, at least 300,000 people from 66 countries work in scam centres, mostly in Southeast Asia, and a large share were trafficked there and work under coercion. The industry makes about 64 billion dollars a year. One survivor described the quota: 9,500 dollars a day in completed scams, under penalty of fines, beatings, or being "sold" to another compound. The person who read you the script may be as trapped by it as you were on that call.
None of this excuses the call, but it explains the seventy-five percent. You didn't fall for a street hustler, you fell for an industry, with suppliers, human resources and a product tested millions of times against ordinary people caught on the wrong day. The victims' shame is the only prop in this theatre that wasn't bought, we supply it ourselves.
Where the script breaks
The script is strong, but it has three seams, and one is enough:
- At the text message. Your bank does not ask you to decide "immediately". The urgency is not a detail of the scheme, it is the scheme.
- At the call. Hang up and call the number on the back of your card yourself. The script has no page for the call you make; against it, the operator can do absolutely nothing.
- At the "safety account". It does not exist. No bank, under any circumstance, asks you to move money "to protect it". Whoever says so has just shown you the script.
And if the transfer has already happened, the clock still plays on your side: call your bank through the official number, because reported quickly most of the loss stays on their side, and file a report, which can be done online. Every hour of silence works for the other end.
On the other end of the line there is no criminal genius, there is someone reading a script bought on a monthly plan, with a quota to meet and a supervisor behind them. Your advantage, from today, is knowing the script better than the person reading it. When the hold music starts, you know: hang up, and make the call yourself.
To go further: Portugal's National Cybersecurity Centre publishes practical guides for citizens, and the fake bank employee scam is described in PSP and GNR alerts.
Sources: PSP (via DN), GNR (via Público), Eurojust and Europol (iSpoof), US Department of Justice, UN Human Rights Office (OHCHR), Interpol, Polícia Judiciária.
#StaySafe
🙏🖖
