“A courier will collect your deactivated card.” How scammers build a credible story

A call announces that your data has leaked. You hang up because something sounds wrong. Minutes later, another person calls, a document with a police logo arrives through WhatsApp and the caller knows the layout of your banking app. Finally, a courier is meant to collect the old, supposedly deactivated card as “evidence”.

These are not independent events. They are one story assembled in layers so that each new institution appears to validate the last. Poland’s Financial Ombudsman described a customer who handed her card to a courier and lost almost PLN 200,000 within hours.

One good decision does not end the attack

The victim initially did the right thing and ended a suspicious call. The scammers did not give up. They called again with a different offer of help, sent a text from a number meant to evoke Poland’s central bank and followed it with a forged letter on WhatsApp.

There is an important lesson here: recognising the first call does not make you immune to the second. A criminal can change role from “bank employee” to “the person helping after that earlier scam attempt”. They know the victim is already worried, so they offer an orderly procedure and apparent contact with several institutions.

Do not try to win the argument within the call. End it and create a new channel to your bank yourself.

A logo, name and telephone number do not verify the caller

The scammers in this case used the genuine names of employees. Their document carried the Warsaw police logo and address, while a messaging profile could change instantly from the central bank’s identity to a commercial bank’s logo.

Every one of these elements is easy to copy. A name can be found online, a PDF built from a public template, a profile image changed and a text sender name spoofed. Several matching visual details prove only that somebody prepared the script.

Verification requires an independent channel: the number in your own banking app, on the back of the card or on an official site you typed yourself. Do not use a number, link or procedure supplied by the caller.

A bank does not send a courier for your card

The Financial Ombudsman notes that a bank can block a card or funds itself when security requires it. It does not tell a customer to make a “safe transfer”, move money into another account or hand the card to a third party.

A bank may call to confirm a transaction the customer initiated. That conversation should not turn into a series of new operations, disclosure of confidential information or collection of a payment card.

The card remains an object you must control even after cancellation. Do not give it to a courier, a “police officer sent by the bank”, a security guard or someone waiting outside a branch. If your bank requires a return, verify the process independently through its official channel.

Cancel the card yourself and check the result

Use your own banking app, online banking or the official helpline. After the action, check whether the card is permanently cancelled rather than merely frozen temporarily. The terms can represent different states depending on the bank.

Destroy a cancelled card that remains in your possession so it cannot be reused. The Financial Ombudsman suggests cutting it into several pieces or removing the corner carrying the chip. Deal with the magnetic stripe and printed details too.

Do not perform these actions under instruction from somebody on the telephone. Even a step that sounds protective can form part of a story leading later to a disclosed code, approved operation or surrendered physical card.

A sentence that ends the pressure

Prepare a response: “I am hanging up and will contact the bank myself.” Do not explain where you are, how much money you hold or which app you use. Do not accept a transfer to a “supervisor”, “police officer” or “security department” because you remain inside a channel the scammer controls.

Time pressure, an instruction to keep the call secret and a claim that only immediate action can save the money are enough reason to end the conversation. A genuine security process will survive independent verification.

If you already surrendered the card or information

Speed matters, but use your own channels:

1. contact the bank through its app or official helpline and report the incident;
2. cancel the card and ask the bank to secure the account and sessions;
3. review transactions and dispute operations you did not authorise;
4. retain telephone numbers, texts, documents, WhatsApp history, receipts and courier details;
5. report the matter to police and obtain confirmation;
6. submit the information to CERT Polska.

Do not delete correspondence out of embarrassment. It may reconstruct the sequence of manipulation, communication channels and money movement. If you revealed a password or code, tell the bank exactly what you supplied and on which screen.

The Financial Ombudsman also advises filing a complaint that explicitly requests reimbursement and refers to the D+1 rule for unauthorised transactions. When a bank refuses reimbursement, a customer may ask the Ombudsman for intervention or mediation. Every case still depends on its circumstances; this article is not legal advice.

How to prepare relatives and employees

“The bank never asks for a code” is too narrow a lesson. In this story, criminals told the victim to perform apparently protective tasks and supplied documents meant to quiet her suspicions.

A better exercise teaches three rules:

• always end an unsolicited conversation about the security of your money;
• return to the institution through a channel you found independently;
• never hand a card or phone to a person sent by the caller.

Within a family, agree who can receive a call before an urgent decision. At work, give employees permission to stop a process without fearing that they are “getting in the way”. A scammer exploits isolation and speed; an independent second person disrupts both.

What the source says and what Breachroad recommends

The sequence, the loss of almost PLN 200,000, the text, WhatsApp document, genuine names and courier collection come from the Polish Financial Ombudsman’s alert about the “deactivated card” scam. Its guidance also covers independent cancellation, card destruction and the reporting path.

Breachroad recommends preparing one short sentence that ends the call and treating several apparently corroborating institutions as one channel until you establish fresh contact yourself.

Our guide to vishing and fake bank employees explains more warning signs. We help organisations build the same habits and escalation procedures through cybersecurity training.