Calling out COVID scammers

The confusion surrounding the COVID-19 pandemic has been a boon to scammers — who are expert at getting people to doubt their own good instincts.

Health officials have diligently explained how important it is to be able to know who has had contact with whom — to be able to trace and halt the spread of the virus in our communities. The important work to figure out that puzzle has traditionally been done by public health professionals, and others who have been specifically trained to interview people who have tested positive for COVID-19, identify who they might have been in close contact with, collect and document relevant epidemiological data, and offer resources to support self-isolation. Now their efforts are being augmented with technology — everything from text messages to contact tracing apps — that offers tremendous potential to solve the contact puzzle.

Healthcare authorities have been less focused on explaining that contact tracing also presents a tremendous opportunity for scammers who also take advantage of technology. So, these tips can help you decide whether a caller is legitimate or a scammer, and help you protect yourself and your family.

If you receive a text or phone call from someone claiming to be a ‘contact tracer’ it could be a legitimate heads-up to expect a phone call—or it could be prepping you for a scam.

If the initial text message asks you to click on a link, don’t. Chances are that clicking the link could download malicious software onto your device. Hover your cursor over the link to reveal where it actually points; and then type the address into your web browser. Even if the address in the link looks authentic, don’t simply click it: Scammers have figured out how to use fonts, symbols, and capitalization (an upper case I often looks like a lower case L) so the address appears real, but isn’t. 

Regardless whether or not you received a heads-up text, if you do get a call from anyone who says they’re a contact tracer your first step — before divulging or confirming any personal information (including your name!) — is to verify that the call and the caller are legitimate. If the caller asks for you by name, “is this….”, don’t answer ‘yes’ or ‘no’; simply ask how you can help them. A scammer will probably launch right into their spiel; a legitimate contact tracer will want to know they’re talking with the person they called. 

Contact tracers usually work for the local health department, and would be careful to avoid breaching anyone’s privacy — so it’s a red flag if the caller tells you the name of someone who suggested you be phoned, or who you supposedly were in contact with recently. Any caller who tells you a name of someone who allegedly tested positive and was in close proximity to you is waving a red flag to warn you that it’s a scam: divulging someone’s health status to you is unprofessional, unethical, and a violation of privacy law.

Even if no red flags are apparent, its important to be certain who you’re talking with— before confirming or volunteering any information. Investing a few minutes now is a small price to pay to avoid falling victim to a scammer.

Checking the CallerID is not a reliable way to verify who’s calling, since scammers can easily spoof phone numbers using low-cost services that allow them to display any phone number. In other words, the display showing the call is from your local hospital or health department might well be displaying a legitimate number, but not the caller’s number. And even putting the caller on hold, then phoning the displayed number, isn’t a sure way to confirm their identity, because you will be phoning a legitimate number.

The first step is to ask for the caller’s name and employee number, the name of the agency and department they’re calling from, and their phone number and extension, and tell them you’ll call back. It’s a warning signal if they avoid telling you who they are, claim that ‘policy’ prevents them from revealing their identity, if try to keep you from ending the call, or if they make other excuses why you should keep talking to them now.

It’s also a red flag if they try to discourage you from calling back, or if they explain why your call won’t be able to reach them. Sure, more people than ever are working from home these days; but healthcare organizations and governments have figured out how to forward calls to employees’ home or cell numbers.

The next thing to do is look up the agency’s main phone number and call to verify if the agency is actually phoning people, and if the caller works for the organization. If they do, then ask that your call be transferred to the person.

In the same way you need to know who you’re talking to, a legitimate contact tracer will have to be sure they’re talking to the correct person and will ask you to confirm basic details such as your address and birth date. How that request is made is critical: If the caller asks you asks you to provide your birth date, address, SSN/SIN or any other information to confirm their records, you’re right to be suspicious. If you do answer that sort of questions, you’re not confirming the details; you’re providing them with the information.

A better approach is to turn the tables and ask the caller, “What birthday to you have for me?” or “You tell me what you have on record for my address, and I’ll let you know if there’s any changes.” If they claim they can’t tell you because of ‘privacy’, and insist you tell them, be suspicious.

Legitimate contact tracers are well trained and have ways to confirm they’re talking to the right person — without disclosing someone else’s information.

A legitimate contract tracer would also have no reason to ask you for payment of any sort, or about your finances, banking, race, or immigration status. If they do, you have good reason to be doubtful. 

If you ultimately decide the caller is a legitimate contact tracer, the information you provide will be valuable for them to be able to trace where in the community the virus might have been transmitted. As part of the process — especially if you have tested positive — the contact tracer might want to phone to follow up with you about symptoms, wellness, and additional contacts. Long before that point you’ll have a good sense of whether or not the call is legitimate.

But if your Spidey Sense has been tingling, and you have doubts about the legitimacy of the caller, don’t be bullied or shamed into cooperating. Simply hang up, without apology or explanation.

Some spammers prefer to hide their numbers, so the call comes in as “private” or “no caller ID”. Most North American telcos allow their customers to dial *69 to reveal the last number called. It might be satisfying to know, or to immediately call them back to ask the spammer to put your number on their do-not-call list (or give them a piece of your mind); but that will only confirm that the spammer reached a legitimate phone number. The easier route would be for you to block the number in your phone’s settings or contacts.

Telcos also allow customers to control whether incoming calls from blocked numbers will get through or be intercepted before the call connects. Some telcos provide a message that the dialed number doesn’t accept calls from blocked numbers, and offer instructions on how a caller can unblock their number. A legitimate caller will figure out how to do that; a spammer is likely to move on to the next number.

If the caller was abusive or threatening, immediately dial *57 to automatically initiate a trace that is passed on to the police. Then write down what was said during the call, note the day and date, being as precise as you can, and then phone the police to report the incident. Some telcos charge a small fee for this service, but it’s a small price to pay for peace of mind and personal safety. 

Finally, if you think you’ve been contacted by a scammer — by phone, email or text — report it to regulatoryagencies, such as the Canadian Anti-Fraud Centre, the Spam Reporting Centre(a national service jointly operated by the RCMP, the Ontario Provincial Police and the Competition Bureau); the National Do Not Call Registry, or the FTC.