I just got a very legit sounding call from a bank saying "hey, a transaction on your account was flagged for possible fraud, please contact us"

It is in fact a scam.

Why it sounds/looks legit:

• The number showed as a Bank of America number.
• The voicemail (I didn't answer) says they don't give account or transaction information over the phone without account holder verification procedures. This is true for banks and financial institutions.
• Banks will flag transaction that look like fraud/are suspicious and contact the account holder to verify and approve/deny the transaction.
• They ask me to call them about the transaction. They leave a 1-800 customer service number that looks legit. I looked up the customer service numbers for Bank of America, this is not a listed number.

As someone that worked in banks, if you ever, EVER, receive a call, text, or email like this here is what you should do:

• Do not give them any information. If it is actually your bank, they have it all.
• Do not confirm any information. Absolutely nothing.
• On the phone, tell them you are hanging up and will call them back. Your bank will have 0 problem with this. The rep from the bank will likely put a temporary note in your account records saying what is happening so the next rep to answer the phone knows what is going on and/or which department you need to talk to.
• Stay calm. Scammers will often make you feel this is urgent! Don't hang up, we need to do this really fast! This is a security thing! We can't wait! This fake Bank of America number has already called me again saying this is urgent. This is FALSE. Yes, your bank would like to resolve this as quickly and painlessly as possible but they can also put holds and freezes on the account so nothing else can happen until the activity is confirmed by you. Your bank can deny the transaction. They have options that are not "give us all your info right now!"
• Call them back at a trusted number! Do not call the number that they just called you from or whatever number they tell you to call. Your bank and credit cards almost always has the customer service number(s) printed on the back. Or go to your internet banking, the number will also be available there. I looked up the Bank of America numbers, the one they gave me on the call is not a listed verifiable BoA number.
• Do not text or email them back. I don't have those communications approved on my accounts so I know it is fake if I get one, but if you do use those, sign in to your bank account and start a new chat/text through a known official platform.

When you call or otherwise contact your bank/credit card they will need to verify it is actually you. This is why it is so important to call, text, or otherwise contact them through a known and verified source. Websites can be faked, phone numbers can be faked. That is why I recommend calling the number printed on your card or logging into your account/card app. Especially if you already feel anxious. You can also go into your bank if you prefer.

This call looked and sounded very very real and could easily trick someone. In this case it was easy to spot because I don't have a Bank of America account.

AO3 Spam Bot Update

Date Posted: February 8, 2026

A wave of spambot guest comments claiming to be AO3 volunteers has recently been made across the site. They claim that there has been a data breach and that fraudulent password reset emails have been sent out. In addition, the harassment spambots are now accusing users of being sex offenders.

These claims are not true. These comments are not being made by real AO3 volunteers or users, and AO3 has not experienced a data breach.

These comments copy existing AO3 usernames in order to make their accusations seem more legitimate. They may also try to lure people onto other platforms, similar to the art commission scam.

AO3 volunteers will never communicate with you through guest comments on your work. All important communications from AO3 about your account will be sent via email. More general announcements will be posted on our official social media accounts or published as news posts on AO3 or OTW.org.

If you want to make sure you're doing everything possible to protect yourself and your accounts, our Policy & Abuse volunteers published a news post earlier this year with advice about internet safety best practices: Protect Your AO3 Account.

As always, we recommend that you do not click on any suspicious links or give your contact information to scammers. Instead, simply mark the comments as spam or report them so that Policy & Abuse can remove other comments left by these spambots.

If you aren't sure how to mark guest comments as spam, learn how to handle them below the cut!

Keep reading

holy shit the bots have pulled out the steel chair IF YOU GET THIS REPLY, REPORT AND BLOCK THE ACCOUNT, THIS IS NOT STAFF THIS IS A PHISHING SCAM TRYING TO GET YOUR ACCOUNT

Accidentally reported you’ scam

(‘Accidentally reported you’ scam)

So it’s just another day on tumblr when a beloved mutual suddenly DMs you (or a random stranger) claiming that someone impersonated you and has scammed them out of $900 be it art or crypto. They tell you they’ve accidentally reported you by mistake and that the only way to clear up this issue is to contact someone on discord. They even show a screenshot claiming your account was reported for fraudulent activity and action must be taken within 24hrs or else your blog will be terminated. You just need to contact the “official” report dispute discord account in a timely manner and clear everything up!

You panic! You don’t want to lose your blog so you immediately DM the discord account who begins asking you questions before ultimately asking you to change your email address to theirs so they can ‘fix’ the flag on your account. All is well, and you assume that the false report is going to be cleared up…Right?

Unfortunately no. That’s not what happens.

You get locked out of your account and now the scammer logs in as you and starts to send the same message to anyone and everyone they find. The same message that now you accidentally reported the receiver and you need them to contact the same discord account to repeat the same process over and over again and you yourself seem to have no way of accessing your blog to stop the phishing. But don’t fear! You can fix this! Just contact the real support email and let them know you’ve been hacked and give them any information they may ask to confirm your the real owner of the blog.

Here are things to keep in mind:

- There is no official report dispute discord account ran by tumblr that isn’t a thing and has never been.

- Any discord account claiming to an official tumblr report dispute staff account is a scammer.

- You do not need to ever contact Discord for a tumblr related issue no matter how official the screenshot looks.

- This scam can affect anyone, even your friends. Keep them informed and if you can contact them offsite to let them know they’ve been hacked please do so they can get their account back faster.

Ridiculous that this is a controversial take, but you have to stop reporting fundraisers and blogs as scams when you don't actually know they're scams. No, "multiple people contacted me like this" is not proof that something is a scam. And yes, there are scams out there to be wary of, but do you know what allows the scams to flourish? When the legitimate fundraisers and blogs, vetted rigorously by unpaid activists, keep getting deleted without cause by GoFundMe and Tumblr, because people baselessly reported them. Scammers exploit the confusion to slip between the cracks and impersonate people. Reporting legitimate and likely-legitimate fundraises literally creates the conditions in which scammers thrive.

You don't have to donate to or share fundraisers if you're not comfortable and confident in the veracity. But you have a responsibility not to spread misinformation about them, either.

You see I too often sat in school classes and thought “when am I ever going to need this, I’m never going to be an engineer, I’m never gonna be a scientist, I’m never gonna be a linguist” and then I grew up and it turns out a lot of bigots and cults and scams and grifts hinge their entire business model on you just. Not knowing what a protein is or some shit

PSA: Credit Card Phone Scam

(Or, how Tumblr just saved my ass)

I saw a PSA recently about a scam going around with spoofed official numbers calling and asking for information, and how you should hang up and call back using the correct number rather than just go along with what the caller is telling you. But this is Tumblr, so I'll never be able to find the post again.

I decided to make my own, because this literally just happened to me an hour ago. Hopefully my story can spread some more awareness and save other asses the way mine was saved.

Around 7:30pm tonight (Friday), I got a phone call from a 1-800 number. I almost didn't answer it, then I saw it was 1-800-465-4___, and I recognized that as the start of the CIBC phone number, so I picked up.

Me: Hello?

Guy: Hi, is this [MrsD]?"

Me: Yes.

Guy: Hi, [MrsD], this is _____ from CIBC, how are you tonight?

I thought, okay, this is a sales call. Right before I'm about to sit down for dinner. Typical. Mentally, I'm already putting together an exit strategy, preparing to say no to everything and get off the phone ASAP. But then—

Guy: We've just flagged suspicious activity on your CIBC Visa card. It was an online BestBuy transaction for $980.00. Was that your transaction?

Me, flustered: Uh. What? Sorry, how much?

Guy: $980.00 at BestBuy, was that you?

Me: Oh. At BestBuy?

Guy: Yes, your card was used at a BestBuy in [town nearby]. Was that you? Did you go to [town nearby] today? You don't live in [town nearby], right?

Me: Uh. No?

Guy: Okay, so I need some information to verify this transaction.

By this point, my brain had caught on that something about this was hinky. First of all, I thought he said it was an online purchase, then he said it was in person. But maybe I'd misheard, he was talking fast. My second thought was that every other time there was a suspicious transaction, I got an automated phone call and a text message with instructions to call back. I've never had a person call me directly.

My third thought was, well, the phone number on the caller ID was right....

THEN! I remembered a Tumblr post I saw recently, and I remembered what it told me to do.

Me: I'm skeptical about this call. I'm going to call CIBC myself and look into this.

Guy: What? Ma'am, you can just tell me, I can verify—

Me: No. Thank you, but I'll call the number on the back of my card.

Guy, getting more agitated: Ma'am, if you look at the number on your card, you'll see it's the same number.

Me: You know that can spoofed, right?

Guy: Uh— but ma'am—

Me: Sorry, but I need to make sure. I'm going to call CIBC directly.

The guy kept sputtering, but I hung up on him. In that moment, I really didn't think that he was a scammer. In fact, I thought I was being paranoid and was maybe kinda rude to the guy. I wondered if I was being overcautious, and I felt a bit guilty.

I called the number on the back of my credit card, waited 15 minutes for an agent, and told him what just happened.

IMMEDIATELY—

Agent: You didn't tell him anything, did you?

Me: No. I said I wasn't in [town nearby] today, but that's it.

Agent: Good. You did the right thing by calling us, let me look into the transaction for you.

Then, a minute later:

Agent: I'm not seeing any transaction like that. There's no flags on your card, nothing suspicious at all.

Me: So it was a scam?

Agent: Yep. Entirely fake.

I was honestly surprised. I really thought that there was some kind of mix-up and that I would be apologizing to this guy for being rude to his colleague.

Looking back on it now, I can see all the telltale signs of it being a scam call:

1. Time of day. Early evening on a Friday, chances are people are either sitting down for dinner or in a hurry to get somewhere. In this situation, a lot people probably wouldn't think twice about giving "the bank" some information just to get off the phone. (Joke's on them, I have no life!) But the way that I reacted to his introduction did evoke the desired reaction of Ugh, what now? Leave me alone! that the scammer was banking on (pun intended).
2. Sense of urgency. The scammer spoke fast, threw details at me quickly, and made sure I knew that I had to give him my information right away. This honestly threw me off. It was overwhelming, and I felt concerned and a bit frantic for a few seconds until I thought about what I know about scams and what I'd just read in that Tumblr PSA.
3. Complete lack of empathy or understanding about my skepticism/anti-fraud precautions. The last time I had to get a new credit card number due to fraud, the agent I spoke to said things like "I know this is frustrating", "I'm sorry this is a hassle", etc. And of course the CIBC agent I spoke to tonight was immediately grateful that I'd called them directly and reassured me that CIBC would never ask for information. By contrast, the scammer was outright dismissive of my concerns and got agitated when I wouldn't just trust him right off the bat.
4. Emotional provocation. Similar to #2 & #3 above, the scammer was very good at making me feel things. Worried and fearful at first, then guilty about being suspicious, to the point where I actually apologized to the guy. (Granted, I am Canadian, but still!)
5. And finally, I cannot stress enough: the spoofed phone number. I am a pretty well-informed person. I keep up with news about scams and whatnot. I know that phone numbers can be spoofed. I've been in front of my phone when it just starts to ring and I can see the auto-dialler number appear briefly before it gets replaced with a number that has my area code. But tonight—early evening on a Friday—I was cooking dinner and my phone was across the room. It had rung several times by the time I got to it. I only picked it up because I recognized the CIBC number. And when the scammer started his spiel, the fact that the number was the same was enough for me to give him just a tiny moment of trust. Had he actually gotten past that first barrier and started requesting my information, I think I would have caught on, because people asking for sensitive information over the phone is a huge obvious red flag. I like to think I would have caught on, anyway. But maybe not! That fake number almost had me.

TL;DR: No matter what the number on your caller ID says—that it's your bank, your energy company, your internet provider, whatever!—if the person on the other end is requesting sensitive information urgently, don't panic. Stop. Think. Then tell them nothing, hang up the phone, and call your service provider yourself using a verified phone number.