New Credit Card Warning: Don't Give Up Your Code

Be careful next time your phone rings: Identity thieves have come up with a new strategy to gain access to your credit card accounts.

The Federal Trade Commission says criminals accessed millions of consumers' names, credit card numbers, and expiration dates in recent months by hacking into computer systems at Home Depot, Target and other retailers.

The one missing piece that would allow them to use the cards for online purchases: that little three- or four-digit security code on the card.

"If they can get the three-digit or four-digit number on the card to verify it, they can do what's called a 'card not present' transaction, so they don't actually have to print out a card, go into a store and buy TV's or do whatever they want to do with it," said credit card expert Kevin Yuann, of NerdWallet.

"They can just go online and go on a shopping spree with your card because they have those three or four digits that prove that they have the card," Yuann said.

Now, the FTC says the thieves are calling consumers to trick them into revealing their security codes.

Here's how it works:

The caller says he or she is phoning from your credit card's security or fraud department because some suspicious activity on your card has raised an alert. The caller makes up a fake transaction and asks if you authorized it; when you say you haven't, the caller responds that they will open a fraud investigation, gives you a reference number, and offers you a phone number to call if you have questions.

The trick escalates when they tell you they need one more piece of information: verification that you are in possession of the card. To confirm that, they ask you to read back the three- or four-digit security code.

Once they have it, they have all they need to start using your card.

The FTC says the thieves often use "spoofed" phone numbers, so "caller id" indicates a bank or credit card company is calling.

If you get a call like this:

• Don't give the caller any information about your account, even if he already knows some of the details.
• Hang up the phone and call the customer service number on the back of your credit card to report the fraud.
• Report the call to the FTC at ftc.gov/complaint or 877-FTC-HELP.