How to tell the difference between Mark from IT and “Mark from IT”

The operator already has the customer’s username and password, stolen somewhere else. The OTP (one-time passcode) bot calls with your institution’s name on caller ID and tells the customer to press 1 if they didn’t make a transfer. That keypress is the cue. The operator logs in, your system sends a real code, and the customer reads it into the call. The fraudster, who’s watching this whole exchange, then enters the code and completes the login.

From your side, it is a clean MFA success. When one customer mistyped the code, the bot kept them on the line and walked them through entering it again.

The service is sold openly on Telegram for $60 a week, $130 a month, or $600 for lifetime access.

The most dangerous call is often the one that confirms someone’s suspicions.

In one case from our October 6 webinar, a small business owner’s computer was running slowly, so he asked an AI chatbot what a computer infected with malware looks like. The fraudster was watching his screen remotely and immediately flooded his inbox with spam and placed a $350 test charge on his account. Then his phone rang. The caller said they were tracking a rogue employee at his bank and needed him to approve a wire transfer to catch them. He thought he was helping federal investigators, so he complied and $30,000 left his account. The caller had promised it would be returned. It wasn’t.

He was suspicious, but he still approved the transfer because the call explained what he had noticed. The tools behind this scam are cheap: spoofing vendors sell any caller ID, plus a “helpdesk pack” with ticket formats, hold music, and a callback line so the victim can “verify” the caller.

hVNC (hidden virtual network computing) is malware that creates a hidden second desktop on the victim’s machine. The customer works normally while the fraudster controls the hidden session. Anything the fraudster does comes from the same device, the same IP address, and the same fingerprint. The customer is not locked out, alerts are intercepted or deleted, and authentication passes from the genuine device.

In one case, a business account was drained in a series of $30,000 transfers, sized to look ordinary and sent to mule accounts, several of which were at the same bank. The fraudster created mailbox rules first, so the customer never saw the confirmations. Detecting this kind of account takeover (ATO) can take weeks, and because large transfers are normal for businesses, models tuned on retail volume do not see it.

“Hi, this is Mark from IT. We’ve flagged unusual activity on your workstation.” The caller walks the customer through installing a real, digitally signed remote monitoring and management (RMM) tool that nothing blocks. The call ends, but the session stays open.

RMM abuse is up 277% year over year. One attacker’s ConnectWise panel held 812 devices, labeled by the targeted financial institution. Social engineering calls were the initial access vector in 19.4% of the ransomware operations in Q6 Cyber’s April 2025 study. Your controls look for malware, so these attacks use legitimate software instead.

Some versions skip the call. A fake “Verify you are human” on-screen prompt tells the user to press Win+R and paste a command, and the user installs the tool themselves.

The credentials were stolen somewhere else, the call hasn’t been placed yet, and the login is on hold. The fraudster’s preparation happens long before your institution sees anything.

In listings our analysts found, a log vendor (a seller of stolen login data) lets buyers filter business logins by bank, balance, and state. The sample request is 10 accounts over $100K for $2,600, with a free replacement for any that stop working within 24 hours. An access broker lists a persistent remote session on a corporate workstation, with saved banking credentials, for about $900. A business login with online access and a 2FA bypass is listed at $3,800 for a $212,400 balance.