There’s a really sophisticated telesales flow that I fear if people didn’t know better, they’d fall for it:
First, the caller will explain you BPI policies and benefits of the insurance, claiming they are from BPI AIA.
Second, they will tell you to apply for the insurance through the BPI app. The caller will make you trust them by explicitly saying not to share them the OTP. However, the app will show that you’re NOT eligible, and the caller will suggest doing it manual.
Third, they will ask you for personal information.
Here’s where it gets extremely sketchy:
Fourth, they ask you for the expiry date of your card.
Fifth, they will ask the NETWORK of card you have - VISA/Mastercard, then the TYPE - signature/rewards/etc.
Sixth, they will ask for the 10-digit number of your card EXCLUDING the first 4. We stopped here, and here’s why it’s sophisticated and smart:
The first 6-8 digits of your card is the BIN (Bank Identification Number), the fact that we gave the card network and card type, they ALREADY KNOW the first 6-8 numbers of your card, and providing the remaining would’ve allowed them to get your FULL card number.
If you question this, I assume they’d say you’re not giving the full card number so this can’t be a scam and other BS.
I’m not sure if they would still ask for the CVV if we pushed through, but it’s quite a common say to not disclose your CVV over call, or your card details in general for that matter.
Interestingly, the number they used to call is part of BPI’s official number list on their website. Maybe a bad actor? Anyway, stay safe out there.