I just fell for an AA breakdown phishing scam

[FellforPhish]

I'm amazed at how clever it was and at the same time feel so stupid that I fell for it.

I've had a letter through the post and emails all looking genuine. They had my name, address, email address, membership number, length of membership and renewal date. Long story short I've now given them my telephone number and linked it to all the details they already had via WhatsApp (again, a verified AA.com account).

I just feel so stupid, like one of those women you hear on the radio saying how they feel so stupid for falling for it(!).

Any advice or similar stories welcome.

Even the Who Called Me website has comments saying it's a genuine AA renewal number.

How do you know it’s a scam?

So do you already have an account with the AA? And the letter was asking for further details?
Did you give them any bank account details?

What was the scam? That you’ve paid them money for renewal but it isn’t actually the AA? It sounds like it’s an easy one to fall for given the details they had so don’t feel foolish. Have you contacted your bank to see if it is possible to retrieve any funds?

I woke up in the early hours realising they never got back to me. Rung the AA and they confirmed they don't use WhatsApp.

What is the scam? When and how did you realise this wasn’t the AA?

No, the letter already had my details (and a trawl through my emails show that presumably the same scammers have had them since 2023 at least). The letter and email got me to ring a number, thus confirming all of the details and giving them my number.

No bank details were mentioned until I found an email from them back in 2023 with my sort code and the last four digits of my account number. (I have informed my bank).

So what have the scammers got? It seems they have gone to a lot of work.

If they had all those details it would appear that AA have had a data breach. let your bank know as they may be able to recover the money but I would also be going after AA for this

I think I should be saying phishing rather than scam. I've confirmed personal details and given them one more.

I think the scam would be to renew with them and send them £120. I even did a quote check on the genuine website this week and it was accurate within a pound.

I was already feeling suspicious when I confirmed name and postcode on WhatsApp, but the profile was a verified AA business profile and I thought, "well, I'm not going to be giving them any bank details". Then I woke up suddenly realising a call handler never did get back to me.

My bank said to now expect a lot of clever approaches from the scammers in lots of different ways. Apparently the most popular is for them to tell me that it's a fraud, get me panicking and to hand over bank details and/or move money.

If the letter asked you to call a verified phone number how come you ended up confirming it on WhatsApp?

Luckily no money has been taken. I am probably "catastrophising". I just feel so stupid.

So all they’ve got your banks details and address? You’ve let the bank know, can they change your number? The easiest thing would be to open a new account, that way all your direct debits carry over.

No, I rung a false number. The automated menu system is the same as the genuine AA one (including a statement about kindness). I didn't speak to a person as "our lines are busy" and they sent me a WhatsApp to put me in a queue. This is something I've experienced with genuine companies. The WhatsApp profile had all of the correct AA details (not hard) and a verification tick.

They've got the sort code and * * **1234 of my account number. Bank didn't seem worried about that. I wonder if I should call again. In complete honesty, he had a strong Indian accent and I have a strong Scottish accent, so the odd detail may have been missed.

Did you give them a way to take money? Passwords, credit/debit card details with the code, etc? If not they can't do anything really, just watch out for other scams, if you have shown you might fall for one you may be on a list that will be passed around. I guess I must be because I seem to get all the usual ones!

Thank you @dogcatkitten your message has reassured me.

Interestingly, ever since I got a new telephone number in 2022 it's been besieged with scam calls (and debt collection agencies). I was convinced it was a recently recycled number. The calls did drop off after a bit. I've probably re-ignited them now.

I've logged it with Action Fraud, the AA and my Bank. I've checked my credit score and paid £30 to Cifas for a two-year Protective Registration marker to be attached to my details. I think I need to move on with my day now.

Sort code is just which bank you use, you give out that and your account number quite frequently so they are hardly secret, no one can use them to take money without passwords, etc. And online banking has various layers of security to log in. I assume you didn't give them any security info, passwords, secret answers, etc, that would let them impersonate you. If you think you may have been tricked into giving security info then change your passwords, etc, and keep an eye on your banking transactions.

AA say on their website they have WhatsApp.

Thank you again @dogcatkitten I know you're right about the sort code etc. I think I just need to have my wits about me.

@Lemonsugarpancake do you have a link? I searched and searched and eventually spoke to breakdown recovery because I couldn't get through to a person any other way. She understandably wasn't impressed but did confirm that they don't use WhatsApp and that membership renewals don't use WhatsApp. (I asked twice because I was sure they'd used WhatsApp when DP broke down last year).

Yes they do use WhatsApp. This sounds like a very elaborate and convoluted scam. Sending letters, phone queues, verified WhatsApp groups, and for what? To confirm a phone number?

Are you sure it’s not just a bog standard renewal letter and you just spoke to a customer service agent who gave wrong info?

It’s always good to be aware of phishing but think about the information you are being asked to give or processes you’re being asked to follow. Giving login details, card details, bank details, visiting a link that clearly isn’t the official business website to input information, verification codes, these are classic phishing tactics. But phishing scammers go for low overheads, it’s highly unusual for them to send letters, especially if they already hold the information. They don’t need to ‘confirm’ it if they already have it in their possession. All the effort and expense for what purpose in this case?

This doesn’t sound like a phishing scam to me, just a standard renewal letter, a WhatsApp chat bot (they definitely have this, Trustpilot is full of people complaining that it is crap) and a customer service agent who gave wrong info.

I wouldn’t waste any more time on it.

Thank you so much @moppety. I had just got to the conclusion that I had fallen for a phishing trip and I need to let this go now. But then your message got me thinking I'd really like to know whether it's genuine or not. I completely get your point that the letter is quite a lot of effort even if the emails are not.

On balance, I'm pretty certain it's phishing.