Fake Geek Squad scams and what to do if you fall victim to credit card fraud

Kerry Binder thought of herself as a real computer jock. When she had a problem with her computer that she couldn’t solve, she contacted the Geek Squad, retailer Best Buy’s tech support service, for help. One day she received a text message saying she’d been charged hundreds of dollars to renew her Geek Squad membership. She knew nothing about this and thought that this was an error. The text message said Binder could dispute the charge or cancel her membership by calling a phone number within 24 hours. When she made the call, a scammer told her that he had to gain remote access to her computer to help her. When he’d finished rummaging around in her computer, he told her that he’d corrected the error and apologized for the mistake.

A week later, Kerry found that her bank account had a zero balance. A bank employee told her that when she gave the scammer remote access to her computer, he probably installed a spyware program that stole her bank account information.

This case is fictional, but represents this recent scam posted on the Federal Trade Commission (FTC) website. (See “How to recognize a fake Geek Squad renewal scam,” by Alvaro Puig, FTC, Oct. 25, 2022.)

Puig, the author of the FTC article, offers the following advice:

• If you think the message is legitimate, contact the company in question using a phone number you know is real. Don’t use the number included in the message.
• If you see an unauthorized transaction on your credit card or in your bank account, ask the credit card company or bank to reverse it and give you back your money.
• Report it or any other scam to the FTC at ReportFraud.ftc.gov.
• Also, if you paid a scammer or gave them personally identifiable information (PII) or access to your computer, read the helpful advice in my November/December 2022 Fraud Magazine column, “Inheritance scam, improving cybersecurity protection and what to do if you get scammed,” to help resolve these issues.

Credit card fraud

Credit card fraud, a major and lucrative scheme in the playbook of most identity thieves, consists of two types: new account and existing account.

New account: An identity thief opens a new credit card in your name using stolen PII.

Existing account: An identity thief uses your existing credit card after stealing your credit card information or purchasing it on the dark web.

According to the FTC’s 2021 Consumer Sentinel Network Data Book, out of the record 7 million reported cases of identity theft, credit card fraud ranked second with nearly 390,000 cases. New account credit card fraud accounted for 363,092 of these cases, and existing credit card fraud accounted for 32,204 of them. The FTC offers the following explanations of why new account fraud predominates:

• Existing account fraud has become more difficult because advance credit-card chip technology has made the transaction process more secure, and it’s now harder to counterfeit credit cards. (See “How the EMV credit card chip works and why it matters,” by Lance Cothern, credit karma, July 26, 2022.)
• Data breaches have exposed information for hundreds of millions of people. Identity thieves can use this information for new account fraud.
• Fraudsters can more easily steal money via new account fraud because consumers don’t know the new accounts in their names exist. Card issuers or consumers may notice suspicious activities on their existing accounts and lock the cards to prevent possible takeovers by identity thieves.

Assessing liabilities

Are you personally liable for any fraudulent charges that show up on your credit cards? According to the FTC, your liability is limited, but it depends on when you report the loss and the type of card that has been charged. (See “Lost or Stolen Credit, ATM, and Debit Cards,” FTC.)

The FTC says that according to federal law, the following applies:

• If you report your credit card’s loss before someone uses it, you aren’t responsible for any charges you didn’t authorize.
• If you report your credit card’s loss after someone uses it, the maximum you might be responsible for is $50.
• If your account number is used but your credit card isn’t lost or stolen, you aren’t responsible for any charges you didn’t authorize.

Getting help

What steps can you take if you’ve been a victim of credit card fraud or loss? Call — or get on the mobile app — and report the loss or theft to the bank or credit union that issued the card as soon as possible. It’s important to act fast. Check your statement or online account for the right number to call. Consider keeping the customer service numbers for your bank or credit union in your phone’s contacts, and keep them up to date.

Follow up immediately in writing. Send a letter to the card issuer and include your account number, the date and time when you noticed something was wrong and when you first reported the loss. Keep a copy of your letter and your notes from calls with the bank or credit union. Keep checking your account statements and call to report fraudulent charges immediately. If you wait, you may have to pay for the charges or lose the money withdrawn from your account.

You should also do the following:

• Check if your homeowner’s or renter’s insurance covers you for card thefts. If not, ask your insurance company to include this protection in your policy going forward.
• Check your credit reports. Get copies of your free credit reports to monitor for accounts or charges you don’t recognize. If you suspect identity theft, visit IdentityTheft.gov to report it and get a recovery plan.

To protect your account information, do the following:

• Don’t share your account information. Don’t give your account number over the phone unless you made the call — and know why you need to share it. Never leave your account information out in the open.
• Protect your accounts by using multifactor authentication, when available. Some accounts offer extra security by requiring two or more credentials to log into your account. This is called multifactor authentication — a security practice that makes it harder for scammers to log in to your accounts if they get your username and password. (See “Protect Your Personal Information and Data,” FTC.) To log in to your account, you’d need either a passcode you get via text message or an authentication app, or a scan of your fingerprint, your retina or your face.
• Keep an eye on your accounts. Regularly check your account activity, especially if you bank online.
• Promptly open your credit cards’ monthly statements. Compare the current balance and charges on your account with your receipts. Report any charges you don’t recognize as soon as you discover them.
• Keep your cards, PINs, receipts and deposit slips safe. Dispose of them carefully. Carry only the cards you’ll need.
• Cut up old cards. Be sure to cut through the account number, the magnetic strip on the back and the security code before you throw the pieces away in separate bags. If your card has a chip, it may be difficult to cut. You may want to destroy the chip by smashing it into pieces with a hammer.

I’m here to help

Please use information about these scams in your outreach programs and among your family members, friends and co-workers.

As part of my outreach program, please contact me if you have any questions on identity theft or cyber-related issues that you need help with or if you’d like me to research a scam and possibly include details in future columns or as feature articles.

I don’t have all the answers, but I’ll do my best to help. I might not get back to you immediately, but I’ll reply. Stay tuned!

Robert E. Holtfreter, Ph.D., CFE, is a distinguished professor of accounting and research at a university in the U.S. Northwest. He’s a member of the Accounting Council for the Gerson Lehrman Group, a research consulting organization, and a member of the White Collar Crime Research Consortium Advisory Council. He’s also the vice president of the ACFE’s Pacific Northwest Chapter and serves on the ACFE Advisory Council and the Editorial Advisory Committee. Holtfreter was the recipient of the Hubbard Award for the best Fraud Magazine feature article in 2016. Contact him at doctorh007@gmail.com.