Wrong Number: A Cautionary Tale

This isn’t my usual article. No regulations. No labeling rules. Not a single ingredient declaration. This a story about something that happened to me recently. I’m pretty astute and very careful, yet I nearly got suckered. So this is a cautionary tale, partly for you as a consumer, and partly for you as a business owner with a phone number on your website.

The Call

On my way to SoapCon 2026 I purchased a lovely lipstick named “Sweetheart” at the M·A·C store in the Charlotte, NC airport. When I got home, I took out the receipt so I could get it credited to my loyalty account (they couldn’t do it in Charlotte). Simple enough. I went to the M·A·C website, found the customer service number and called.

A recording told me I was entitled to a $100 gift card just for calling.

Well, how nice! I figured maybe this was some kind of loyalty thank-you. (In hindsight, nobody gives you $100 for dialing a phone. I know that. You know that. And yet….)

Right away a pleasant woman came on the line. She was very understanding of my issue with the loyalty points and took my information. Then she asked for some basic information to verify my account. She checked my phone number, asked about the address on the account. It all sounded routine, the way these calls do when you think you’re talking to a company you already do business with.

I admit I was multi-tasking, so I didn’t really notice the red flag when she wanted to verify my bank. She asked which bank I use and where I’d opened the account and then “verified” my routing number with me.

Then she asked for my bank account number. (Uh-oh!)

Multi-tasking aside, at that point the red flag flew up and waved wildly. Getting suspicious, I asked why she needed it. She said it was to confirm that I qualified for the gift card. Which, by the way, had now grown to $200.

I said no. She hung up. No goodbye, no “have a nice day,” just gone. The $200 gift card apparently left with her.

What Actually Happened

When I went back and checked, the answer was embarrassingly simple. The real M·A·C customer service number ends in 0070. I had dialed 0700.

I swapped two digits. That’s all it took.

Someone had set up shop on that misdial, just waiting for people like me who are in a hurry (and multi-tasking), looking at one number and typing another. The person who answers doesn’t say “Hi, I’m a scammer.” She lets you assume you reached the company you meant to call, and she has a script ready for when you do.

I didn’t lose anything except a little pride and about ten minutes. I have a pretty firm policy about not EVER giving out my bank account informaton. But it was so slick, so plausible (and $200 is attractive). It would have been pretty easy to fall for it. My older sister definitely would have!

For You, as a Customer

A few things I hope you can take away from this cautionary tale about my almost-disaster:

No real company needs your bank account number to give you a gift card. Or to credit loyalty points, or to “verify” anything. If someone asks, that’s your cue to hang up.
A free prize for calling is a red flag. Companies don’t pay you to contact customer service. (Wouldn’t that be nice?)
Look at the number you actually dialed. If something feels off, check the number you called against the number you thought you called.
If you gave out anything, call your bank right away, using the number on your card or statement (not one you look up in a hurry).

For You, as a Business Owner

Here’s the part that’s relevant to you as a maker. If scammers can do this with M·A·C’s number, they can do it with yours.

Your customers can make the same mistake I did. They mean to call you, swap two digits and end up with someone who’s happy to “help” them with their order and their bank account. The customer has no idea they didn’t reach you, so as far as they’re concerned, your business asked for their bank information.

Thankfully, there are a few simple things you can do:

Make your phone number tappable. On your website, set your number up as a click-to-call link so people on their phones tap it instead of typing it. Fewer typed numbers, fewer typos.
Try the obvious misdials yourself. Swap the last two digits of your number and call it. Try a couple of other likely slips too. It takes five minutes, and you’ll know whether anyone is waiting on the other end.
Check your website address the same way. The same trick works with domain names. A site that’s one letter off from yours can look a lot like yours. Search for a few likely misspellings of your domain and see what comes up.
Tell customers what you’ll never ask for. A short line on your contact page or FAQ (“We will never ask for your bank account number”) gives a customer something to remember when a call starts feeling odd.
Report what you find. If you discover a scam line or a look-alike site, report it to the FTC at reportfraud.ftc.gov, and let your customers know.

Final Thoughts

I’m writing this partly because I’m a little annoyed with myself, and partly because I know I’m not the only one who’s ever been in a hurry with a phone in her hand.

The scam itself wasn’t sophisticated. It just counted on one small, completely ordinary mistake and the expectation that a certain percentage of people will fall prey to a smooth offer of a tempting gift card supposedly from a company they trusted.

Heed this cautionary tale, my friend, and never, ever, give out your bank account number – no matter how great the offer seems!