Maybe 15 mins has passed since I first took the call when I get on with with my bank. They immediately kill the access and close the acccount and begin the investigation. They asked me if I had shared any one time codesfrom them with anyone. This is where it dawned on me what had happened. The attacker had enough of my personal information (username, SSN, Bdate, phone number) to get to the point where they were able to initiate a password reset of my account on the bank's website and the only thing standing in the way was the text verification step. All the while , I think I'm sharing text codes with my bank's security team to verify I'm the owner of the account. I provided the code and let them walk right in to the account.

At some point during the panic, we find the 25k transaction and surprisingly it shows that all the attacker did was initiate a transfer to a linked account I have with another bank.

Not sure why they did what they did. Maybe just to stick it to me when they realized the game was up. OR, if they had actually gained remote access to my phone, using the missing money as evidence that my account was compromised to keep me believing they were helping to stop the attack, all the while doing who knows what on my phone.

I had to spend several hours the next day securing my digital footprint. Chagning all passwords, updating employers with new account info, locking down credit reports, etc.

The money never made it to the external account, my bank reeled it back in, but it took nearly five days of nervous waiting.

Big takeaway, and hopefully someone reading this will help to avoid a future attack. Only share the one-time text passwords if you are the one who initiated a call to the bank or any other type of access request. (Bank website, app, etc)

I'm sure many of you will feel the need to pile on , and point out my obvious mistakes.(Like why'd you answer an unknown call, or duh it says right in those text messages to not share code with anyone) No worries, bring it, I haven't beaten myself up about it enough yet. . But understand that attacks are getting more and more sophisticated and it just takes that one time for whatever reason when you're a little bit off your game when a scammer gets you.