Content type: explanatory article, not a court case. Based on the sources linked below.
The call sounds official. A recognizable number, professional courtesy, then the sentence: "We have detected unusual activity in your account." From that point on, in many cases the person receiving the call carries out the action the caller asks for.
The Bank of Israel puts it simply: social engineering is a psychological attack based on exploiting innocence, lack of knowledge or a desire to help others. The next point matters just as much: there is no technological answer to an attack aimed at human vulnerability. No antivirus will block a convincing phone call.
How the script is built
Many impersonation calls follow three similar stages. First comes the disguise: the fraudster claims to represent a bank, credit-card company, the police or a government cybersecurity body. University of Exeter research for the OFT (2009) found that appeals to trust and authority are prominent techniques in scams. People tend to comply with someone who seems official. Next comes the flood of pressure: an urgent problem that triggers fear. The account has been hacked, the parcel is stuck, the card will be blocked. Finally comes the solution: the fraudster offers immediate "help" and, along the way, asks for the code you received by SMS.
This script has also been reported in Israel. In May 2024, according to Calcalist, the Israel National Cyber Directorate warned of calls from withheld numbers in which the speaker claimed to represent a police cyber unit or police call centre and asked for an SMS code. According to the Directorate, giving away that code allows an attacker to take over a WhatsApp account. The authority the caller presents is part of the trap.
Where it could have stopped
At one simple point: the moment someone asks you for something. The rule is simple: hang up and call back through an official channel. Hang up and call the number on the back of your card or on the official website yourself. If the story is real, it can wait five minutes. If it is terribly urgent, that is exactly why you should stop.
And remember: do not give a verification code to someone whose call you did not initiate, even if they claim to be an official. The code is the key. The person asking for the key is not the guard.