The wife very nearly got caught by this one today!
How the Online Shopping Basket scam works
The scam starts with a cold call from scammers, pretending to be from Amazon, warning that your account has been hacked, and that fraudsters are trying to make big money purchases.
The scammer will gain the trust of the victim and persuaded them to read out a One Time Passcode (OTP) sent to their mobile phone. This allows the scammer access to their shopping account – to which they add a number of high value items- for example – iPhones.
The scammer will ask you to check your Amazon account to confirm that these item have been added which then frightens the account holder into believing they have been hacked.
The scammer will then typically claim that the bank accounts linked to the Amazon account have also been compromised, and persuade the victim to move their money to a so-called ‘safe account’. But any money transferred will instead be sent directly to the scammer.
To help facilitate the transfer of cash, victims are often convinced to install remote access software on to their laptop, or smartphone, allowing the scammer to monitor and even control the device.
I was stood next to her as we could see an iPhone in her amazon shopping cart and a new delivery address to some stranger in London.
This made it all look very convincing - and happened because they had got her to give up the OTP ("I have sent you a code..." and she didn't realise that was what it was!) - and at this point I was unaware of that fact.
I was, however, very suspicious, but they even said to "check your email for a fraudulent account warning". And sure enough the REAL Amazon had indeed sent an email saying that someone was attempting to access the account (and as a techie I could tell it was a real email). Of course, it was Amazon warning us about the slimy gimp pretending to be from Amazon!
It was only at the point when they wanted her to download some app to "allow us to block this fraudulent user from your account" that I said "NOOOOOOO! hang up immediately and change your passwords!"
In our case there was no mention of money transfer, maybe they hadn't got that far in the script...
Stay safe folks!