Safe deposit box fraud usually manifests itself in two distinct phases. First of all, the entrepreneur or self-employed person will receive a phishing message from an apparently reliable sender, such as a bank, the postal service, a telephone operator, etc., which leads via a link to a (counterfeit) website. Scammers use this website to collect personal information such as contact details or even codes to log in to internet banking. Once this information is provided, the scammer gains access to the business accounts and can carry out fraudulent transactions.

The victim then receives a call from the fraudster posing as a bank employee to warn him about some suspicious transactions that have taken place on his/her account.

For example, with the information obtained by the fraudster through phishing, he can refer to the account balance and recent transactions. In this way he gains the trust of the victim and convinces him/her to achieve the ultimate goal: transferring a large sum of money to a 'safe deposit box'. However, this safe deposit box does not exist at all, and as soon as the victim makes the transaction, he loses his money. The fraudsters use money mules' accounts to quickly transfer their loot. An alternative scenario is that the fraudster has the 'cancellation of fraudulent transfers' confirmed by the victim, while in fact he or she just signs the fraudulent transfers.

There is also the possibility that this first step of phishing is skipped, and the fraudster immediately calls the victim to persuade them to transfer money to a 'safe deposit box'. Both techniques are used by the fraudsters.

Scammers use various smart techniques that make it easy to fall into the trap. Fortunately, companies and self-employed people can protect themselves by being alert to suspicious messages and calls and following best practices.