We’ve been taught to be wary of scams online, to think twice about suspicious texts, emails and social media messages. 

 

That instinct is largely correct. The internet gives scammers global reach, anonymity and access to increasingly sophisticated technology such as AI, allowing them to deceive people quickly and en masse.

 

But not every scam plays out on a screen. In a new approach, some criminals have gone analogue, convincing victims to wrap their bank cards in aluminium foil - and then hand them over.

 

Why scammers go offline

 

When scammers are willing to take that risk, it’s because there’s no other way to get what they want - and the payoff is worth it.

 

That’s currently playing out in a card‑collection scam being reported from Queensland to Victoria, which appears to be targeting the elderly.

 

For a criminal, the appeal of this technique is that although card details can be copied or purchased online, spending real money still requires something tangible: the physical card and its PIN.

 

The solution? Scammers are now successfully persuading victims to hand over both, willingly.

 

How the letter box scam works

 

The scam typically begins with a phone call. The fraudster impersonates a bank employee and claims suspicious activity has been detected on the customer’s card. The call is calm, procedural and comes across as a protective measure.

 

Victims are told the card needs to be collected for security reasons. Sometimes, they’re instructed to leave it in their letter box - occasionally wrapped in aluminium foil. Other times, an unsuspecting rideshare driver is sent to collect it.

 

During the same conversation, the scammer also asks for the card’s PIN. With both pieces of information in hand, criminals can move quickly, draining accounts before the victim realises what has happened.

 

Why the letter box scam works

 

This scam succeeds because it targets trust rather than technical weakness. The language sounds familiar. The instructions feel official. Victims believe they’re cooperating with their bank to prevent fraud, not enabling it.

 

But banks already have systems in place to protect customers without needing physical cards returned. If a card is compromised, it can be disabled immediately.

 

At most, a bank could ask you to cut up the card, and throw it in the bin, without needing it returned.

 

The important rule to remember is this: never reveal your PIN to anyone, including your bank.

 

What to do if you get a call

 

If a call from the bank is unexpected, it’s important to take control of the interaction.

 

This may look like getting a reference number, hanging up and calling back on a number you are comfortable with to confirm legitimacy.

 

Calling a trusted number breaks the scammer’s sense of urgency and removes their ability to steer the conversation.

 

The simplest protection still works

 

As scam tactics evolve, the most effective protection is often simple. 

 

Ensuring the card is in your possession and your PIN secret can save you a whole world of trouble.

 

As scammers blend digital deception with real‑world interaction, staying aware is the best way to keep yourself safe. If a request feels unusual or unexpected, it’s worth pausing - and checking - before acting.

 

In a world where scams are evolving fast, keeping hold of your card - and your information - still matters most.