– By DAVID HENCH

Staff Writer

Dozens of bank customers in the Biddeford-Saco area apparently have fallen victim to a scam that uses a bogus text message to get debit card information and steal cash from accounts.

Starting Saturday, thieves sent text messages to hundreds of customers of various financial institutions, telling them their ATM cards had been de-activated and they had to call a local phone number to reactivate them.

Customers who called were asked for their ATM card numbers and their personal identification numbers.

Although most people were suspicious and didn’t provide the numbers, some did, said Kevin Savage, president and chief executive officer of Saco & Biddeford Savings Institution, one bank that was targeted. A few dozen of its customers gave out the information.

“This is a perfect example of what is referred to as a ‘phishing’ scam,” said Savage in a written release Tuesday. The bank sought to publicize the scam so fewer people would be fooled, he said.

“A number of us started getting messages ourselves, some of which were not related to our bank but another financial institution, so we knew right off,” Savage said.

People who gave out the information should contact the bank immediately at (877) 722-6243, he said. The bank is temporarily providing 24-hour customer service to accommodate those people.

Although they used a local telephone number, the thieves apparently were not local. They withdrew money from ATMs primarily in California and New York, Savage said, typically in amounts ranging from $60 to $160.

One indication that the thieves were not local was that they pronounced Saco as “Say-ko,” Savage said.

Although it’s not clear how the thieves used only the numbers to get cash, scammers have created fake cards using stolen numbers.

Savage said Saco & Biddeford Savings Institution was not the victim of a data breach. The texts apparently were sent to a large number of cell phones in the area, many owned by people who are not customers of the bank.

The bank will cover the fraudulent withdrawals, but customers must report them, he said.

The calls that customers made in response to the texts apparently were routed out of state and possibly out of the country, said Saco Deputy Police Chief Jeffrey Holland.

“We do know this came out of some place out of Virginia,” Holland said.

He got the same text message at 5 p.m. Sunday, but was skeptical and didn’t give out his PIN.

Holland said his department lacks the resources to investigate out-of-town or foreign criminals who trick people into giving out financial information.

The messages appeared credible because they indicated the first four digits of each target’s ATM card number. But Holland said that number is associated with the location and the financial institution, not an individual’s card. The last four digits are commonly used to indicate a specific card.

Savage said people should be wary of unsolicited communications seeking bank information.

“Bank customers would never be asked by the bank to provide personal information by phone or over the Internet,” he said.

Staff Writer David Hench can be contacted at 791-6327 or at:

dhench@pressherald.com