Scam calls: methodologies, personal details, how to protect yourself

You’ve more than likely received a phone call from a number you don’t recognize. You answer, and a person on the other line, speaking to you through a headset in what sounds like a busy office space, asks if they’re speaking with the right person, offering your name. If you say yes, they’ll tell you they’re calling from a reputable company, such as a national electricity provider, and they’re offering you a special deal, only available on the call, that will slash your bills in half.

They may tell you your home address, and even your own ID number, asking for confirmation that they’re speaking with the right person. 

There’s usually urgency to these calls, implying that you should accept this offer now because it’ll only be valid for a limited time. Urgency is one of the key telltale signs of a scam call. 

Some people’s phones are inundated with scam calls, such as the example given above. Some may even receive such attempted calls on a daily basis. 

Marta Cabrera Vendrell, the head of Public Service for Citizens at the Catalan Cybersecurity Agency, tells Catalan News that cybercrime incidents are increasing. In 2024, the agency managed over 3,300 such incidents. The majority of these were minor, but this figure represented an increase of 26% compared to the previous year.

Most of those also affected public institutions, but for citizen-related scams across all digital channels, the incidence is high, with around 300 scams reported every day to the Catalan police – a figure that does not include incidents not reported. 

But what’s behind these calls? How do these scammers work? What’s their methodology and final objective? And can they do any harm with some personal details they have? 

How do these companies work? 

Bruno Pérez Juncà is an expert in forensic digital computing and a court expert. He explains to Catalan News that the companies behind such scam calls are not petty criminals working out of bedrooms or garages, but rather the calls are the work of full-scale companies with salaried workers who chat about their weekends in break rooms like any other office worker. 

Pérez says these companies, which boast impressive office spaces, have a variety of methodologies they deploy. Some use machines that automatically call every combination of digits. If a call is answered, then this phone number will be verified as an active line. The machine usually hangs up immediately, but reports in its system that the line is active for someone to follow up on.

Marta Cabrera strikes a similar tone, explaining that companies that perform cyber scams are “normal companies” that have “contracted employees and HR departments.” 

Another way scammers operate is through data brokers to gather a certain level of information about a person. For data brokers specializing in collecting personal information about people, it’s a relatively easy task to piece together some basic points of information about a potential scam target. With a person’s name and address, and sometimes ID number, scammers can pass off as companies that provide common services, such as electricity or water companies, and gain the trust of their targets under the guise of authenticity. 

Pérez says that the more sophisticated companies categorize targets into profiles, such as "a guy in his 30s who is making a professional life and is always looking for better offers." This way they can be more selective of what type of company to pose as, and what kind of call to make. 

Cabrera explains that scammers purchase personal data on the dark web and can therefore target specific people, knowing a variety of details about them such as their name, address, ID number, and sometimes even the last four digits of their bank account. 

Fraudulent calls are often automated and done on a massive scale. Cabrera says that as many as 5 million fraudulent calls are made every single day in Spain, and the operation becomes worthwhile if even a few hundred people fall for the scam. 

Where did they get my personal details? 

Data brokers use open-source intelligence frameworks to gather up to 70,000 data points about a single person, Pérez says, extracted from everyday activities such as using a loyalty card at a supermarket, from which professionals can understand consumption habits and family structure. 

Our data is everywhere. In Spain, it’s very common to have to use your national ID number for all sorts of procedures, and data breaches are only becoming more common, unleashing personal details for bad actors to purchase online. Pérez says that data is now more important than money. 

Cabrera tells Catalan News that some non-personalized and non-targeted scam calls can have data harvesting as their goal, and are usually deployed on a large scale. The objective is to collect more personal information to later sell on the black market. The cybersecurity expert gives the example of a scammer claiming to be calling from a recruitment agency, claiming to have their CV, and needing some additional details.

What’s their final objective?

The ultimate goal is to obtain the victim’s bank details. 

They will try to gain your trust by posing as genuine companies, offering a great price for a necessary service, and they will attempt to convince you to call over your bank details over the phone to sign up to whatever they’re offering. 

Never give over your bank details over the phone. 

Bruno Pérez Juncà says these criminals are simply casting their net as wide as possible, to see who responds and falls for the scam. 

Beyond immediate financial acquisition, the scam companies can also gain by engaging in identity theft and exploitation. 

Can they do any harm with the personal details they already have? 

Yes, they can steal your identity. Pérez explains that if the scammers have a victim's personal data, this can let them steal their identity and engage in illicit activity. 

Pérez gives the example that with a victim’s ID number, criminals can register for online casinos, leading the legitimate person to be taxed on the winnings received by the scammer, or that bad actors can rent vehicles online using the victim’s details. If the criminal causes an accident, gets fines, or flees, the victim is left with the legal consequences and will have to prove to a judge that they were not involved in the events.

Cabrera says that for such cases, the Tax Agency website has a system for citizens to consult if gambling operations have been carried out under their name and to initiate complaints.

What should I do when I receive these calls? Answer? Ignore? Block?

Ignore. Hang up. Block if you want, but in many cases, these companies have dozens or hundreds of different phone numbers they can make attempted scam calls from. 

What can I do to protect myself? 

Ignore the calls. Sign up for the Robinson List, a free advertising opt-out service promoted by the Spanish government, available to all consumers for free. Its aim is to reduce the advertising people receive. If you’re on the Robinson List and you receive a phone call from a company with an offer you weren’t expecting, you can be practically sure it’s an illegitimate call, as the real company should be blocked from calling you. 

Do not call back a number you don’t know. If you’re intrigued by an offer, verify the information by going directly to the source: call the company yourself and ask if it’s a real offer.

Acknowledge the urgency of the call. If someone calls you with an offer, trying to get you to sign up there and then, it is most likely a scam attempt. Urgency is the most telling sign of a scam. Pérez says scammers try to exploit the societal tendency toward immediacy, and advises fighting this urge to rush and make decisions while distracted, such as taking such phone calls while doing other things like shopping in the supermarket. 

Cabrera emphasizes that prevention is the priority for the Catalan Cybersecurity Agency, as recovering money after a cyber scam is very difficult, often requiring specific circumstances for the bank to make a return.

Yet, she points out it’s important not to panic as they cannot steal money unless you authorize a transfer. Instead, she urges people to just hang up the call and block and report the number.