Even professionals get deceived: why you should not rely on advice from strangers

No one is scam-proof. This fact has been corroborated by the story of an entrepreneur with a deep knowledge of finance, who advises companies. She has been scammed on a virtual platform for selling goods: scammers misappropriated her details and wiped all the money from her bank card.

Asta said she decided to sell some clothes she no longer wore on a popular online shopping platform. The woman did not find the mobile app convenient. Therefore, when a potential buyer offered to chat in a messaging app about the sale, she was very delighted.

After a few quite natural questions about the piece of clothing, the "buyer" sent Asta a link indicating that "the money has been sent". The seller immediately clicked on it. She then opened the mobile app of the shopping platform, but could not find the information provided via the link sent to her. Instead of doubting about the "buyer", Asta thought it was just a problem with the platform, or that "the data was not received".

In her turn, the "buyer" started pressing the issue by texting on the messaging app: did the woman get the money, why didn't she get it, etc.? The questions sounded quite logical for a first-time user of the platform, who had heard that the money goes to the platform first and is only transferred to the seller after the goods have been delivered.

Account was emptied

The "buyer" continued on giving advice that supposedly the platform needed payment card details in order to transfer money to the seller. Finally, Asta, without getting any deeper, entered her payment card details in the link sent to her. Moreover, upon prompting, she made an additional transfer of money to her payment card account. The payment created via the link was then unexpectedly cancelled. The seller lost her patience and stopped entering the data - after all, she had several days to send a parcel. On the next morning, she saw that her payment card account had been emptied. The only consolation was that the amount was not very large and she had not sent the clothing.

Asta said she knew for a fact that it was not advisable to open links from strangers or download any documents attached to emails. Moreover, she said she never read emails from unknown senders and never paid any attention to suspicious SMS messages.  What is more, the woman also advised others on how to avoid scams.

In the case described, scammers deceived the woman by using a trusted trading platform that had a buyer protection function, which was also relevant for sellers - it allowed them to make payments through the platform, avoiding direct communication and payments to stranger accounts.

It is not uncommon for customers of popular classified ads portals to be similarly deceived. Sellers receive links to websites of supposedly courier services and are asked to enter their payment card details or top up their accounts. Although sellers themselves should be getting money for the items they sell, yet they often find themselves on the scammer's hook, misled by any familiar name of the service provider or vague instructions.

What data may be needed?

Due to the nature of the scenarios of bogus "merchants" or "buyers", the credibility of the persons involved is difficult to ascertain, and upon offering any unusual, but from the first sight unsuspicious, method of payment, the person in fact gets involved in the fraud scheme. 

Eivilė Čipkutė, President of the Association of Lithuanian Banks, suggests remaining critical when communicating and shopping online. "When it comes to communication by phone, email or chat apps, we would advise everyone to be cautious about messages and calls you receive from people you do not know, and especially not to rush to follow strangers' requests or instructions related to money, or to click on the links they give you," she stresses.

The general advice for online shoppers is to have a separate payment card for online purchases, topped up before making a payment and only up to the amount you need to buy a specific product or service. In case of suspicion, you should not enter any payment card details. And if you are selling a product, the only information the buyer really needs is your account number for payment.

Expert's comment: "Data is the key to money"

Tomas Karpavičius, Head of the Market Infrastructure Policy Division at the Bank of Lithuania

To receive a money transfer for a sale of any product, you only need to provide your account number, not your payment card number. Remember: to receive funds into your account, no personal identification is required, either by Smart ID, mobile signature or code generator, or by entering any codes. You do not need to enter the special three-digit code on your card (CVV) to receive funds. If you are asked or required to provide this information, you should immediately stop contact with the buyer.

The described case shows that you can never be too careful: when dealing with people you do not know, be cautious and aware of the likelihood of scam. If you have any doubts concerning validity of the request you have received, always check the information by using the available means (e.g. by contacting your bank, an online shop or platform, or at least via Internet search).

It is also important not to open any suspicious-looking emails and links in messages sent to you - never connect to your online bank by clicking on a link in an email or SMS message you receive. When creating passwords, make sure they are sufficiently complex (hard to guess) and change them regularly, etc.

Beware of requests to disclose your payment instrument data: payment card or ID card PINs, payment card's CVC code, internet user ID, etc. Remember: this data is the key to the funds in your accounts, so keep it safe and do not share it with anyone.

If you still feel that your data has been misappropriated, contact your payment service provider immediately and block your account. Noteworthy, at least two levels of security are applied when initiating any payment transaction, i.e. two confirmations are required: for your account access and for payment execution. It is therefore very important not to confirm logins and payment transactions that you have not initiated yourself.   

Norėdami pagerinti Jūsų naršymo kokybę, naudojame slapukus. Tęsdami naršymą svetainėje jūs sutinkate su slapukų naudojimu.