How Venmo Phishing Scheme Led to Account Takeover

Recently, Anne came across an interesting story that was shared by an Instagrammer who refurbishes furniture.  Apparently, she uses Facebook Marketplace as a source for acquiring furniture. 

The story talks about the common practice of reserving items on Facebook Marketplace by sending upfront money with an app like Venmo.  This is a bad idea!  This is a common scam where criminals will copy and paste legitimate listings and trick buyers into sending money for non-existent items.  Never do this, unless you’re willing to lose your money.

According to the story, the Instagrammer and her sister had been victims of a direct attack on their Venmo accounts.  Apparently, they were contacted by a scammer via phone who pretended to be a Venmo representative.  They were warned (falsely) that attackers were attempting to access their accounts.  The scammer followed up the phone call with an email, advising them to login to their accounts.  However, it sounds like the link to their accounts was a spoofed website (fake), allowing the scammers to capture their legitimate account logins with a fake website that they control.

As you can probably guess, the scammers took control of the Venmo accounts, locking them out and taking the money.  According to the story, the Instagrammer was able to recover $1500 from her compromised account.  However, it sounds like her sister remains locked out of hers.

This is an all too common occurrence.  Take note that the scammer got the victims into a heightened emotional state about unauthorized access into a financial account.  Most of us are in an excitable state after hearing this.  It somewhat blinds us from questioning the legitimacy of the conversation to begin with and that’s what the scammers are aiming for.

When communicating with anyone who claims to be a financial institution or operating in an official capacity, always be skeptical.  Especially, when they are the ones who contact you.  If you think that it could be a legitimate conversation, always politely hang up and find the contact information yourself (official website).

If you use Venmo or any other payment application, always make sure you’re using a strong password that hasn’t been reused with any other account.  Also make sure that you have two-factor authentication enabled on your account.  Always think twice before linking your bank account to an application that isn’t set up with secure authentication methods such as two-factor authentication.

With Venmo and Paypal there are a lot of scams being played out to steal money from customers.  If you see anything unusual or suspicious, such as unexpected funds appearing in your account or other alarming events, make sure that you notify the payment platform right away via their official contact methods that you found yourself (official website).