Scammed
I've been curious about how to track down scammers -- just a few days ago I got a quite convincing call supposedly from Bank of America; they appreciate my reliable payments and would like to lower my interest rate... they'd just need to verify a few bits of info, then pass me off to an account manager to handle the rate change.<p>First, do I have the card with me?  Can I confirm the expiration date, so they know this is the current card?<p>Next, they just needed the card number, starting after the (here he listed the first 4 digits accurately).  This was when I belatedly realized this was of course a scam attempt -- the initial digits of a credit card number just identify the bank, so he could pretend to be confirming that <i>he</i> was legit while at the same time collecting my entire credit card number.<p>What if I hadn't known that?  I know perfectly well I shouldn't trust an incoming caller's identity as a general rule... but he called in the middle of my workday, I was wrapped up in other things, and just thought "eh, I can take a minute and accept a lower rate" without even paying enough attention to realize he hadn't even addressed me by name.  Embarrassing, really....<p>Once the game was up it didn't last much longer -- though I played it safe and pretended I didn't realize it was a scam.<p>But what can I do now?<p>The incoming number was reported as 703 237 2680; but I have no other info on who the caller was beyond that, and I believe caller-ID is fairly easily spoofed.<p>I wish I'd had a honeypot credit card to give him; that would have been at least somewhat useful, though tricky to really use.  From what I understand, stolen CCs are tested first (via a small purchase from any online service), then good ones are sold.<p>A honeypot cc (generated by someone with the power to investigate its data) could be used to attempt to track down the people testing it, and whoever buys it, but the former use could be useless (if the scammer can cover their tracks), and the latter only gets the downstream bad guy, not the original scammer.<p>And... the honeypot cc would need to pass the test to be sold, which would cost money.  A chargeback (to that initial test) would of course be possible, but the whole testing process is already brutal for whatever merchant they're using for that.<p>I'm curious about other ideas on the most useful action I can take in response to this kind of thing.