Scam Targeting Mobile Phone Users

F

Freelance

Key Post author
Messages
776
Before I go any further, the moral of the story
  • Never ever give, call out or read back a One Time Code, Verification code, PIN code, PAN code.
  • If you call your bank (not the other way around) they may ask for two digits from your PIN number to identify you. Unless you are certain that you are speaking to your bank on a call which you initiated, or if you are in any way suspicious, do not proceed.
This scam is a variation on a theme, but it is an alluring trap that is easy to fall into. A friend of my was caught on Monday.

What actually happened:
As soon as the scammer called her, he entered her number on the Vodafone "forgot my password" screen which sent a code to her phone
He used the code which she received and read back to him to change her password, her address, and various other details
He ordered an iPhone 16 Pro on her account to be sent to her "new address"

Here is her perception of what happened:
She received a call on her mobile from the Vodafone Customer Loyalty team. Caller said that he had good news, and that she was entitled to a loyalty reward
Caller sent he needed to verify that he was talking to the account holder before proceeding, and sent a verification code to her phone
The verification code was grouped in her phone messages with prior messages from Vodafone (suggesting that all was in order) and at his request she read the verification code back to him
He kept chatting for a couple of minutes while he was organising her loyalty reward, in the course of which he called out her address for verification, and also some of her credit card details (I'm not sure what exactly)
He concluded that all was in order and that her loyalty reward was on its way to her, and that she might receive a few messages later but that she could safely ignore these
She went off full of the joys and thinking how great life is when the gods smile down on you

The Outcome
She received a call on Tuesday from the Vodafone fraud team
It took a considerable period of time for the call to proceed as the details they usually use to verify the caller (DOB, address etc) were not correct
Eventually the call progressed to the point where they verified that she had not requested aa phone upgrade and they confirmed that they were in a position to cancel the upgrade as the phone had not yet been despatched

The National Cyber Security Centre have issued an alert in relation to this scam. It contains a description of the scam, some useful pointers on how to protect yourself and what to do if you’re a victim

NCSC Advisory Upgrade Scam targeting Mobile Phone Users 09 December 2024

Also detailed here: https://www.rte.ie/news/ireland/2024/1209/1485540-cyber-scam/
And discussed with Adrian Weckler here: https://www.rte.ie/radio/podcasts/22469716-national-cyber-security-centre-warning-people-abou/

In Conclusion
The three lines above under What actually happened are generic and are not limited to phone upgrade scams, this technique could be used in many situations to access the likes of bank accounts, online store accounts etc.
 
I got a scam call last week from an Asian-sounding guy claiming to be from Vodafone, from a Dublin number, offering me 30% off my bill. I played along, said i suppose you're going to look for a bank account? "no we just send you a 6 digit code". I asked him what my address was "oh we can't give you that for security reasons". I just told him I wasnt with Vodafone and he hung up.
My advice would be 1.dont answer any unknown calls. 2. Remove your name from any voicemail recordings & if you do answer the phone, don't give your name eg. "hello Luke speaking", because the scammer immediately used my name, as if he knew it was me
 
Protocol said:
How would the scammer know that she is a customer of Vodafone in the first place?
Click to expand...
Dial the number with a “5” immediately following the 08x prefix - the voicemail response and instructions are a giveaway. E.g. to test 087 1234567 dial 0875 1234567
 
lukegriffen said:
Remove your name from any voicemail recordings & if you do answer the phone, don't give your name eg. "hello Luke speaking", because the scammer immediately used my name, as if he knew it was me
Click to expand...
It's more likely they are using previous breach data to gather that. If you've had these details in any of LinkedIn, Twitter, Sony, Yahoo, Facebook, or many others when they were hacked your details are already circulating the dark web. Check Have I Been Pwned for instances of where your data has been compromised.
 
We've been here before

Received a call from unknown number

So, yesterday, I got a call from someone and the first thing they said was Hello, I'm ringing from "undecipherable company name", am I speaking to Mr podgeandrodge? As they had my name and phone number, my instinct was that this was a call from some trustworthy company so I acknowledged that I...
www.askaboutmoney.com
 
I watched a Channel 5 drama recently called Cold Call. While it is a fictional drama, it's based on real scams. They phished loads of information from the victim's elderly Mother. Names, DOB, address, phone number etc.

Just remind older people in your life, who may be more naive to this kind of thing, to not give out information over the phone. The caller can be very convincing and say they're doing a survey, census or anything like that.

They used this information to convince the victim they were from her bank.
 
lukegriffen said:
I got a scam call last week from an Asian-sounding guy claiming to be from Vodafone, from a Dublin number, offering me 30% off my bill. I played along, said i suppose you're going to look for a bank account? "no we just send you a 6 digit code". I asked him what my address was "oh we can't give you that for security reasons". I just told him I wasnt with Vodafone and he hung up.
My advice would be 1.dont answer any unknown calls. 2. Remove your name from any voicemail recordings & if you do answer the phone, don't give your name eg. "hello Luke speaking", because the scammer immediately used my name, as if he knew it was me
Click to expand...

Point 1 is ridiculous.
- When my doctor rings me with blood test results it shows up as unknown number.
- When the hospital rang to update me about my mother's condition, it showed up as unknown number.
- When I broke down at the side of the road and waiting for a callback from Breakdown Assistance, it showed up as unknown number.
- When a bank rang me about a €500+ interest refund on a long-repaid loan account, the call came from an unknown number. They posted the refund cheque to a local branch and I was able to collect it the following day. That paid for my car insurance that year.

Trying to ring back these businesses is usually a pain in the neck as you have to go through a switchboard and invariably the person you want is unavailable. Much easier to just answer the phone.
 
I got a call from the 'PTSB Security Team' the other day to alert me to some attempted transactions on my account. I was intrigued as of course the account was fine but I had frozen my card the day before as I had thought I lost it but had left it in the car.

I never progressed to any of the security stuff as I just started laughing saying I didn't have time for a scam and they hung up.
They called on a private number, UK accent but they knew my full name.
 
New Scottman said:
- When the hospital rang to update me about my mother's condition, it showed up as unknown number.
- When I broke down at the side of the road and waiting for a callback from Breakdown Assistance, it showed up as unknown number.
Click to expand...

If I am broken down on the side of the road and waiting for a call back I will answer my phone.

But it's probably good advice otherwise - especially for vulnerable people.

Brendan
 
I just don't answer unknown mobile numbers. I will answer a landline as I find most businesses use a landline. I changed my voicemail message to remove my name and point out that I don't use voicemail so 'please message me and I'll get back to you'.

If I'm dealing with Customer Support of any national organisation, I may suspend my own rules, temporarily, as they do, sometimes, phone back!
 
I received a WhatsApp call from "Revolut Bank" (from a Pakistani number), asking me to log into my account for a "refund." I stalled by saying I needed to find my login details in my car, which would take at least 10 minutes. After 20 minutes, he hung up. Each minute of his time I wasted prevented him from targeting another potential victim. Everyone should do this.
 
tomdublin said:
Each minute of his time I wasted prevented him from targeting another potential victim.
Click to expand...
It may feel good but it’s a drop in the ocean. He’s basically just a call centre employee.

This stuff is done at very large scale mainly from Asia.

People would be better off pressuring their TDs to pressure the regulator to force Ireland’s three telcos to put in place technical solutions to stop scammers spoofing Irish numbers.
 
Dr Strangelove said:
People would be better off pressuring their TDs to pressure the regulator to force Ireland’s three telcos to put in place technical solutions to stop scammers spoofing Irish numbers.
Click to expand...
Indeed. Still no action taken on foot of this consultation a year and a half on...
https://www.comreg.ie/comreg-consults-on-combatting-scam-calls-and-texts/
However, this intervention requires legislative change and ComReg is engaging with its parent department, the Department of the Environment, Climate and Communications (“DECC”) in taking this forward.
Click to expand...
 
You must log in or register to reply here.
Back
Top