someone claiming to be from my bank asked for account info, did i make the right call or is the bank actually checking

bro i went through the same thing... was so scared. then the bank called from customer support said it was a scam then edit: actually got really angry

rules are simple: 1. NEVER give password, PIN, credit card over phone 2. if bank calls, hang up 3. call the bank from your phone check 4. if suspicious activity go reset and check 5. report to police if needed

i remind myself banks never call. never ever ask. but still every call speeds up my heart...

social engineering method: Authority (bank), Urgency (suspicious activity), Fear (account will be closed). you recognized this.

how much damage was done to the account? or no damage at all? should i be paranoid?

great incident! really great reflex. people fall for these scams so easily. you acted smartly

Thanks, this was very helpful. Forgotten test environments are more often the entry point than live systems.

Taking measures without an inventory leaves doors you haven't seen open. Of course, it varies if your situation is different.

Let me share my experience. The harder it is to reverse a decision, the slower you should make it.

An automated scan report is not the same as a penetration test. Hope this helps.

Let me summarize the topic, since several different answers were given. If 2FA is on, a stolen password alone is useless.

I've been down this road, let me tell you. Most time waste accumulates in tasks waiting for approval.

An automated scan report is not the same as a penetration test. If you post the result here, it will help others too.

I felt relieved reading this answer, so it's not just me. If 2FA is on, a stolen password alone is useless.

The answer varies greatly by industry; there is no one-size-fits-all rule. That's all, sorry if I went on too long.

There's a trap here, let me mention it. Taking notes for two weeks yields better results than a six-month estimate.

If you don't write this down from the start, it leads to arguments later. If you post the result here, it will help others too.

Three different views emerged, they all complement each other. Security isn't absolute; it's about making attacks not worth the effort.

Correct me if I'm wrong.

Great work. Everything goes well for the first three months; problems arise in the fourth.

let me summarize what's been said so far but when we decide without measuring we always end up in the same place.

of course, it varies if your situation is different.

I feel the same way. Your time to detect an issue directly determines its cost.

This is exactly what we experienced. An automated scan report is not the same as a penetration test.

Good call starting this thread.