USAA Account Takeover

Sharing this experience of being scammed as it was clever, complex, and had me totally hoodwinked. Only background you need is that I bank with USAA.

I received a call late Wednesday afternoon which my phone did not flag as spam. When answering, they said “Hi this is USAA calling over a potential fraudulent charge, could you confirm your first and last name.” Which I did. They asked if I recently visited a Courtyard Marriott in Texas or sent money using Zelle and I said no. They said “okay it appears your information has been stolen, have you misplaced or lost your card?”. I said no. They said “have you shopped at Amazon or scanned your card outside at a gas pump recently.” I said “yes, I’ve used Amazon” and they proceeded to record that in my file and told me that was likely how my information was stolen.

Then, they confirmed my account information, offering a correct phone number, email, and address. They asked if I was familiar with their login options, and I said no. They explained the CyberCode Token and asked if I would be interested in switching. I said sure. They said “okay, I can walk you through this but I need to confirm your USAA phone password first.” To explain, a USAA phone password is a one-word code with a hint that USAA asks for when you call, to confirm your identity, so it was normal to be asked this question, AND they knew and offered my one-word hint, so I told them.

Then, they walked me through setting up a Token through the USAA app, which felt legit. I swear to god they know this app better than actual USAA employees. At the moment the token was set-up, they asked me to confirm with them the account set-up was successful by sharing the SMS code sent from USAA. At this same moment, I was bombarded with a bunch of other phone calls, which flustered me and I gave them the code without thinking critically or even reading the whole text from USAA. Shortly afterward, we wrapped up and the call and I moved on.

When I got home from work the next day, I was locked out of my USAA account and had many email notifications from USAA. Most of them seemed related to the changes I made to my account the day before, but I decided to call just in case. After talking to the fraud department, I realized I was scammed. Within 24 hours they transferred money using Zelle, purchased things on my credit card, ordered a new credit card to an unknown address, and most concerningly, had transferred money from a linked Capital One bank account I had into my USAA checking account so that they had more money to spend.

Learn from my mistakes, in reflection, there were a couple red flags:

1. the person had a crappy microphone and was difficult to hear at times
2. when I was on hold, it was elevator music, not the USAA jingle
3. I should’ve never been asked for that SMS code and should have paused after the unusual phone calls

My new rule is that if my bank ever calls me, I will hang up and call them back through the app.