Ilia Nikolaevich Zavialov on calls from fake support

Caller ID is spoofed, and it is spoofed onto the official number specifically. Knowing your details proves nothing: leaks happen constantly, and the last digits of your card, your address and your last order number are available to the caller.

So the question «is this really the bank» has no answer that can be checked during the call. A checkable answer appears after you hang up and call back yourself.

The number comes from a source you control: the back of the card, a statement, a contract, the official app. Not from the message, not from a link inside it, not from an advertisement in search results.

The rule replaces trying to judge whether the caller sounds like staff. That judgment fails exactly when it is needed, because a prepared caller is calm and knows the details.

Any phrasing of the kind «the decision is needed now», «if you hang up the payment goes through», «we are recording, stay on the line» has one purpose: to stop you leaving the conversation and verifying.

A genuine organization loses nothing if you call back. Resistance to that step is the most reliable single indicator in the whole conversation.

The phrase «read out the code to cancel it» inverts the meaning of the action. The code is your signature under what is happening right now inside the attacker's app.

The same applies to a request for a code from an authenticator app, to showing your screen or to forwarding a screenshot with a code. No genuine employee asks for any of that.

Remote access tools are legitimate software, which is exactly why they raise no suspicion and are not blocked. After installation the screen, the input and the apps belong to whoever asked you to install them.

A request to install anything during an inbound call about money has no legitimate scenario. A bank does not configure your phone remotely.

The order: contact the bank on the number printed on your card and block the card or account; change the password and end sessions in the affected accounts; remove the remote access program if one was installed.

Then write down the time of the call, the number, what exactly was said and what you did. Those notes are needed by the bank and in a report, and within a day the details fade.