What's going on here then?

[simpo two]

Friend of mine had a call from a woman purporting to be from Tescos (with whom he has a credit card).

Woman asked for his date of birth, which he gave. Then she asked for the second letter of his mother's maiden name, at which point he thought 'this ain't right' and refused. She said there was a problem with his card. When he asked what the problem was, she said she wasn't allowed to tell him. When he asked for some evidence that she was genuine, she suggested he call the Tesco number on his CC statements.

So he did - and there WAS a problem with his card - apparently the police have stopped it and he has to get a new one.

[Fortjefferson]

You seem to have answered you're own question.

[simpo two]

Fortjefferson said:

You seem to have answered you're own question.

But banks never ask for security details over the phone, right? So who was the woman? Just a phisher who had some details but needed more and played it cool when rumbled?

[TheLemming]

simpo two said:

Friend of mine had a call from a woman purporting to be from Tescos (with whom he has a credit card). Woman asked for his date of birth, which he gave. Then she asked for the second letter of his mother's maiden name, at which point he thought 'this ain't right' and refused. She said there was a problem with his card. When he asked what the problem was, she said she wasn't allowed to tell him. When he asked for some evidence that she was genuine, she suggested he call the Tesco number on his CC statements. So he did - and there WAS a problem with his card - apparently the police have stopped it and he has to get a new one.

The way things should have gone.

He shouldnt have given out any details of his security information to an unexpected, unsolicited call (his DOB is more info than I'd have given out).

He should then have called THEM on a pre-supplied number that he could be sure was connecting to his card provider.

As he did.

Moral of the tale: Never ever ever give out personal information on an unverified call. Unless you're 1000% sure of who you're talking to then call them back on the number on your statement.