The screen says the call comes from Germany’s medical helpline. The voice says the same thing, and then asks you to confirm a few details about your account. Nothing about that call is what it appears to be.
What actually happened
On 26 October, the Kassenärztliche Vereinigung Hessen published a warning. That body organises medical care outside normal practice hours in the state of Hesse, and in the weeks before it had been hearing from patients about a new kind of call.
The caller said they were a doctor, a member of the out-of-hours medical service, or an employee of the association. The aim was the same every time: to get financial details, especially bank information.
What made the calls convincing was the display. The number on the patient’s phone belonged to a trusted institution, and in some cases that number was 116 117. The trick is called caller ID spoofing: the label on your screen travels with the call, and not every network checks that it is real. Think of it as writing someone else’s name on the back of an envelope. The paper arrives from wherever it was posted.
The association was blunt about the limits. It has no technical way to stop the manipulation, and the manipulation works with almost every phone number. Only 110 and 112 are protected against it.
Why they picked the doctor’s number
116 117 is the number you call when you are unwell but it is not an emergency: evenings, weekends, public holidays. It is free, it works across Germany, and the person who answers will assess your symptoms or arrange an appointment. For anything life-threatening, the number is 112.
A call from that number feels like it is about your health, not your money, and that is the whole point. The association stated it plainly: staff at the 116 117 patient service never ask for bank or payment details.
Why it matters to you
With your name and account number, someone can try to set up a direct debit, a payment taken straight from your account, or keep you talking until you send a transfer yourself. Money leaves in minutes. Getting it back takes weeks, letters and proof.
The second cost is quieter. Health is one of the few subjects where most people stay on the line and answer questions, even when something feels wrong. A calm voice that knows your name sounds official, and the number on the screen agrees with it.
What you can do
None of this needs an app or a setting. The advice from the association is short, and it fits in six lines.
- If a number you do not recognise calls, you are allowed not to answer. The association’s first recommendation is to let it ring.
- If you pick up and the caller asks for bank details, say nothing and hang up. Do not explain, do not argue, do not wait for the sentence to finish.
- Call back on a number you looked up yourself: 116 117 for the medical service, 110 for the police, 112 for an emergency. Never use a number the caller gives you, and never use one they tell you to search for.
- Treat the display as a claim, not a check. The association said the manipulation is possible with almost every number, and that only 110 and 112 are protected.
- If you already gave details, call your bank on the number printed on your card. Ask them to watch or block the account, and say exactly what was asked and what you answered.
- Tell one other person. Fraudsters often ask people to keep the call secret, and Berlin’s police list that request among the warning signs of a call like this.
Common misunderstandings
Myth: the number on the screen proves who is calling
It does not. The display is filled in on the caller’s side and passed along by the network, and the association says it cannot prevent the manipulation. Berlin’s police make the same point: the number in the display is not enough to identify a caller.
Myth: my phone company filters fake numbers, so this cannot reach me
Network operators can recognise and block some fake numbers, but not all of them. That is why the association’s advice is not a setting you switch on. It is a habit: hang up, then call back on a number you found yourself.
Myth: if they know my name and my date of birth, the call must be real
Knowing a few things about you proves nothing about who is speaking. Names, addresses and dates of birth move around in data breaches and in lists that are bought and sold. A familiar detail is decoration on the story, not a check on the caller.
What to watch for next
The trick is not tied to one number or one region. In the middle of October, the City of London Police warned about the same technique being used with the display numbers of police forces in the UK. Any number people trust can be borrowed: a bank, an insurer, a parcel company, a hospital.
Expect the next version to arrive with a reason to act fast: a payment that failed, a record that will be deleted, an appointment that will be cancelled. Speed is the tool. The pause is yours.
The one thing to remember
A number on a screen is a claim, not a check. If a call you did not start turns to money, hang up and call back on a number you looked up yourself.
Photo: Ehimetalor Unuabona on Unsplash, via Wikimedia Commons, CC0 1.0, no rights reserved.