SOFI Fraud Attempt
So I was recently the victim of a SOFI fraud attempt and just wanted to get some clarity as to how much of my information was possibly exposed, and how i should proceed moving forward.
So yesterday I got a text from the number with the following message below (removed some numbers for my own peace and sanity at this point lol).
"SoFi [ XXXX ]
Did you make a purchase at **WHOP, FL for the Amount of $XX.XX on 08/17/2026? Reply YES or NO Case# XXXXX To Opt out Reply STOP."
I usually ignore these messages because oftentimes they aren't legitimate, but this time I checked my bank account and saw the exact pending charge that was referenced in the text. So I replied "No" waited a few minutes, and decided to call SOFI to see what's going on. After being on hold for 30+ minutes, I finally got in contact with a rep, who I'm explaining the situation to, and then got another call from SOFI's number. I mention this to the rep and ask if I should answer, and they respond yes, so I do. Everything seemed normal. The guy on the phone was basically just talking me through everything that occured said there were multiple charge attempts on my account, but they stopped it after they noticed the first one was made in an area code that was far away from home address. He proceeded to tell me told me the fraudster also made a change to my email, and a few other odd things he noted within my account. Then they mentioned they'd essentially go through the process of securing my account. So they sent me a "secure" link to log in to my SOFI account (I know, dumb but it gets weird) to start the security process. I login in the first time but accidentally put in the incorrect password, and it prompted me to try again, no different than when I'm regularly login into SOFI. I try again, this time with the correct password and it prompts me to put in a verification code, which I receive from SOFI. I put the code in, he asked me a few other standard questions and told me that he'll proceed to secure the account so no other attempts can be made. Additionally, he stated in the meantime he's going to forward me all of the fraud notifications that SOFI sent out that should have been routed to my email but didn't because the fraudster made the change. I check my email, and what do I see? 3 emails from SOFI (no-reply@o.sofi.org) saying there was an attempt to make a transfer from my BOA account (which I had linked). He then goes on to say he'll put in a request for a new card to be sent out, we talk for a little longer, then the call randomly disconnects. I call SOFI back to be met with another 45 min hold time to be told they have no notes of any calls or fraud attempts on my account nor any request for a new debit card and proceed to get bounced around to a bunch of different departments who all tell me they don't have any answers and that I will have to wait until the charge on my account processes to dispute it. I've already gone in and changed my password and requested a new debit card, but left with a few questions.
I understand that you can clone a website interface but how is it possible that they were they able to prompt that the password I entered was incorrect, or the verification code from SOFI after putting in the correct password?
How could they have known exactly which charge hit my account to know to send the "Did you make a purchase" message regarding?
How is it possible that the emails he claimed he was going to forward came from verified SOFI emails with my BOA information?
Any other next steps I should take?