Tag: SIM swap

Posted on

Keeping safe online

The threats – real and perceived

[First posted 10 September 2020]
[minor changes 21 June 2021]
[Revised 24 May 2023]
[MINor changes 25 January 2025 – links checked]
Luckily, there’s plenty of advice and guidance available – often slanted particularly towards our demographic (ie oldies) …
Those two sites are particularly easy to follow and understand, but others are equally informative and targeted. Your bank probably has guidance which it publishes online and which is accessible to everyone, not just their customers …
I’ll return to further information, guidance and references at the end of this post, but first we need to look at a few issues, discuss some terminology that’s widely used and try and tease out what’s really important, and what’s just an inconvenience and then it’s up to you to judge where you find yourself on the scale of …

Terrified -> Apprehensive -> Sensibly Aware -> Relaxed -> Unconcerned

First let’s distinguish the difference between online security and online privacy. These are two different issues which are however linked. Sometimes you have to relinquish some privacy to receive a service – unless you choose to pay for it (and I’ve long been an advocate of paying for services if they do a job that is necessary); exactly how much privacy are you prepared to relinquish? Security on the other hand is an absolute – you should not be prepared to accept less than your very best efforts . We’ll deal with that in the third part of the post.

How do you relinquish your privacy, and how much of a loss of privacy is acceptable?

Some services could not be offered without income from adverts, or paid-for advertising – eg Facebook, Twitter and Instagram; and some eg Google and Amazon track and provide information to resellers if you don’t block them from doing so. As an example of how much value Google sees in getting knowledge of what you’re doing and where you’re doing it, they pay Apple up to $20bn annually to remain as the default search engine for any browser that’s running on an Apple device! Sometimes you may click on a link and have been asked whether you wanted to accept cookies – what exactly are they, and what do they do. This article from Norton explains what they do quite well … Essentially, they record what you do on a website so that when you return to it some of the settings are remembered and applied. Cookies do however also have a downside in that some can also act to track your activity once you’ve left the site. For that reason, you should disable in your browser the ability of third-parties to glean information from a cookie, and also to prevent them tracking your activity once you’ve left the site. You can at anytime, clear the cookies from your browser, and indeed on some internet browsers set them up to delete cookies when you leave (close the window) the site. If you use Firefox as your browser it will alert you the first time you go to a site that it is using a Fingerprinting cookie itself. For instance from the Norton site above …
… this is a nice feature, and should not be confused with the rather more annoying GDPR pop-ups which almost force you to accept because you can’t be bothered to check the detail that some sites force you to go to in selecting which cookies you want to store. I often just stop using that site rather than read through the options, or alternatively just click “Accept” and hope for the best!! Not exactly the privacy control that was envisaged when the legislation was enacted! Another thing you should consider is whether you want adverts to be shown, or not. You might get a request to enable adverts when you visit a site, the answer you supply will be held in a cookie in the browser – that’s how cookies work. Firefox, Brave and Microsoft Edge, by default, block most, if not all, adverts. These are often annoying and having a browser that blocks adverts, or if you use Chrome – using an ad-blocker like AdBlock Plus often makes for a more “pleasurable browsing experience” by limiting the intrusion you might feel upon your privacy.

Which brings us to browsers and search engines

Search engines are not created equal! Whilst Google is often thought to be the same as the internet and is often mistaken to be an internet browser itself, it is in fact just one of a range of possible search engines that you can use to look for information on the internet. It uses a platform called Chromium to display the results of its searches to you through a browser called Chrome. However, other browsers – Microsoft’s Edge, Brave and Opera all use the same underlying Chromium technology – the difference being they don’t track what you’re doing “to present the content that most meets your needs” (Google’s philosophy) and in some cases (eg Brave) they can actually prevent tracking of your browsing history. I use Safari – which on Apple is my default browser choice, but otherwise I would use either Brave or Firefox as my internet browser. So what safe and private search engine could you use as an alternative to Google. I use DuckDuckGo …
… but others I could have used might have been Ecosia, Bing, Yahoo or another one you might choose from this article or the list of other articles at the end of it …
There are many specialist search engines (as explained in the above article) that can give you much better, and more targeted results than a broad-spectrum Google search with the priority of results returned by relevance, not payment received by Google. Finally, no discussion of Privacy can ignore Social Media and Facebook in particular. These applications, if left to their own default settings, are effectively personal information mining engines. They grab what information they can from you, and sell it on to whoever is willing to pay for it; or are indeed the platform for data mining, vis the Cambridge Analytica affair. Recent enforcement of data privacy legislation by the EU on Meta has resulted in them being hit with massive fines for breaches of GDPR law by Facebook, Instagram and WhatsApp. Online retailers are not exempt from this and Amazon for instance has a wonderful record of your browsing history! Are you sure you know what it’s doing with that information? So look at this table taken from a recent Which? supplement – Staying Secure in a Digital World – and just check whether you need to change your settings if you use any Social Media apps …
So that’s Privacy dealt with.

Should you be frightened?

The take away message I want you to have is Frightened – no; cautious – yes! Online banking is very secure – a recent survey in Which? produced the following scores …
… plus you are protected and most of the banks are increasingly opting to adopt an online and mobile guarantee to refund you where you’ve been the innocent victim of a fraud. Here for instance is Barclay’s “Online and Mobile Banking Guarantee.” They really don’t want to shell out money, so they are trying to educate us to be wise to scams. So let’s take a scam test …
Banks are also often supplying software free (or at reduced cost) for you to install to protect your machine, to protect you from fraud – and of course themselves from having to pay out! I was recently offered a piece of software called Malwarebytes by the NatWest and although I have an Apple Mac computer which are well known to be relatively secure from Viruses, Spyware, Trojans and other malware, I installed it. I was pleased to note that I didn’t have any malware on the machine. Surprisingly you might think … it’s safer to use the mobile app on your phone, or tablet to do online banking and retail purchases than a web browser. This is because the app on the mobile device has to be verified by Google for Android (Google Play Store) or Apple for iOS/iPadOS (Apple Store). Whereas a browser could be infected, or compromised with malware. [That’s something I’ve learnt whilst preparing this post!!!] When you’re out and about and NEED to do an online transaction from your mobile – use cellular rather than WiFi. The latter can be really open to “sniffers”. [I must admit I try to avoid doing online transactions when away from a domestic network.] Alternatively consider buying and installing Virtual Private Network (VPN) software, such as NordNet so that you can use the free public WiFi in a public area. You can find out a whole lot about the range of scams at the NatWest’s Security Centre.
However the most scary scam I’ve been made aware of is one that befell a member of my family when they were distracted sufficiently to become the victim of SIM swapping.
I’ve discussed this with you before and you can  read the updated post here. I also covered this issue in another post which involved stealing a phone, to obtain access to your identity and commit fraud, and we covered the even more disturbing theft of a credit card with the complicity of the US Postal service to obtain a SIM in a recent meeting as well.

What should you do to protect yourself?

Some of these pieces of advice are really quite straightforward, but some require some intervention by yourselves.
  • Keep your operating software up to date. This is particularly true if you’re a Windows user, and even more true if you are still running an older version of Windows than Windows 10. If you’re using Windows XP, Windows Vista or even Windows 7 you should seriously consider disconnecting your machine from the internet because even if you’ve got anti-malware software running this is probably not protecting you against the latest threats.
  • Install anti-malware, or anti-virus software, particularly if you’re a Windows user. Don’t pay more than you need to. Windows Defender from Microsoft is Free and for our demographic relatively undemanding and unsophisticated users, more than sufficient. Keep it up-to-date as well! [As I said previously, your bank might be offering free software as well.]
  • Keep the software you use regularly up to date as well. Consider removing any software from your machine that you don’t use – this is because software vulnerabilities are discovered sometimes quite a while after the software was first released. It will also save you disc space!
  • Be cautious over installing extensions into your browser. These are often extremely useful and valuable tools, ie password managers, Dropbox, note taking, Google Back up and Sync, but if you don’t get them from the official sources then you might be importing vulnerabilities, eg spyware and trojans to your system.
  • Very seriously consider logging-out from social media and other retail sites when you’ve finished using them, especially Facebook, you just don’t know what tracking and logging of what you do, even where you are, if you leave yourself logged in on a mobile device.
  • Free software is both a boon and a curse. Only download open source software from a reputable site such as Softpedia, and never try and get proprietary software for free. Read this article about Free download sites if you want to know more.
  • Remember the golden rule 1 – if it seems too good to be true, it probably is, so steer clear!
  • Remember the golden rule 2 – don’t speak to strangers (an oldie but goldie that one); in other words if you don’t know where an email has come from – ignore it; if the website address looks a little strange – do an internet search on the company or organisation to check if the address you’re looking at is a spoof of the proper one.
  • Have more than one email address. Use one as your personal address, then use other ones that you can “throw away”when you need to register to a website, but you’re unlikely ever to go back to it again. Or have an email address (UserID) specifically for online purchases. Splitting things like this reduces the risk of you being the victim of fraud.
  • Seriously consider using an email service that is NOT connected to your Internet Service Provider (ISP). If you decide to change your ISP, and you should review them periodically, then you will have real problems if your email address is linked to their service!
  • You’ve got Spam filters running? Of course you have – but you better check! Probably your ISP, or email provider (eg Gmail, Yahoo, Microsoft Outlook or Hotmail) is filtering out what it thinks is spam, but occasionally some gets through. If that’s the case then you can always look at the real sender of your message. Take a look at the examples below …
You can also apply filters to divert incoming email into different folders in your email system. That reduces the amount of Junk that you need to review. [I’ve also advocated using the “native” email application for your device rather than rely on the web-based service the email provider has. Thus on a Windows device – use Windows Mail (or Outlook); on a Mac use Mail. You can then easily synchronise your email between devices from multiple email accounts. Tidy!]

So we come to Passwords …

… this is the point at which you need to consider intervention and changing your behaviour! You might also need to do a fair bit of work, but it’s worth it if you want to have a secure internet experience. Let’s just see what using an insecure Password can lay yourself open to. Type in the word Password, or ABC123 from the link above – frightening eh!?
The most common password I use – and I know I shouldn’t reuse the same password, but I am human – has not been discovered on any pwned site. Phew!
What about the combination of your email address with your password – has that been “pwned” (ie stolen through a data breach)? Try typing your email address into the link above.
Oh no! I’ve been pwned … but it was a long time ago and I’ve changed my password many times since then!
Ah! That’s better – my “throwaway” email and passwords are “safe”!
And if you want to see a list of which websites have been breached, it’s alarmingly long! So … use a unique password for everywhere you sign on. There’s lots of tricks to achieve this; some of which I wrote about in a post quite a long time ago …
… but the real change of behaviour is to use a Password Manager – again I wrote about this a little while ago and linked it to using Two Factor Authentication, which is also covered in the same post …

Password managers

I still use LastPass, but as a back-up and archive of my old passwords. I now use Keychain as I only have Apple devices (as do most of my family, and so it makes sense to use a system that is linked to the hardware I use. Other common password managers  are Dashlane and 1Password. Please make up your own minds after reading some Reviews and seriously consider using one.
An authoritative article on using Password Managers is provided by the National Cyber Security Research Centre. They also give an opinion on whether you should use the browser offered option to save your passwords.

However … the future is Passkeys

The major tech companies – Microsoft, Google and Apple amongst them, have been working in alliance on a project called FIDO that will mean the combination of UserID and Password can be consigned to the waste basket. This article explains what they are, and what it means for us really well. Although Apple stole a lead, announcing their implementation a year ago, Google has now launched it’s implementation, and this article describes how to set them up on your Google account. Microsoft also allow a password-less way forward, but I’m not clear on how to set it up – not being a M$ user. On Apple – here’s how you set up Passkeys on your iPhone, iPad and Mac. Another reason why I chose to move from LastPass to Keychain. Whilst if you’re a 1Password user, you can combine your legacy use of a Password Manager with Passkeys, and these will also work much better together on your iPhone. Watch out for an announcement shortly! [NB It is possible to move between password managers, ie from LastPass to 1Password.] And that’s about it for this year. We can look forward to much more about Passkeys in the coming 12 months; much more about GDPR and how the UK government’s online security legislation is reviewed (and hopefully revised) before implementation; much more about “big tech” and corporations re-acting to whether they are responsible for content, or are just a platform providing a service, rather than a publisher. Interesting times!

Slides from talk given to Bridgend U3A

Keeping safe online

Slides from talk given to Cardiff U3A

Staying safe online

References

These may not be available in your Public Library, hopefully that isn’t the case.
… but these are available … Which? webpages – Scams & older people I seriously do recommend signing up for the Which? Scam Alert Service – sign up for an email alert – and I seriously recommend you NOT broadcasting other people’s warnings to you about scams; they could be old, they could be inaccurate, they could be scams in themselves. Look on the Age UK webpages – Staying safe in your digital world and specifically How to stay safe online Your bank will undoubtedly have Internet Security webpages. Mine has a Security Centre web presence and particularly they provide a number of Fraud Guides I could give a million references to changing your privacy settings on Social Media, but here are a couple relating to Facebook, perhaps the most challenging service of the lot. First – what Facebook unchallenged will want to get from you. You are able to disable (prevent) all or some of these … Sign up for Facebook – this is not sign-up site, it’s just one to educate you on the privacy you might give up without realising before you sign up (but of course you can run the checklist at any time); then How to change settings on Facebook and finally Securing Facebook: Keep your data safe with these privacy settings.
Posted on

Notes of meeting – 9th February 2023

This was the first of our “discussion-style” meetings and I recorded the following notes.

John S reported that his bus pass had stopped working and it had taken two further re-issues to get a working card. This led to a general discussion about apps and led to the suggestion (later in the meeting) that a session on apps might be “a good idea”. I offered to do a write-up on the Cardiff Bus app. [I haven’t done this because of later actions, namely the Forum “The apps I use …”.]

Renee had followed up her Signal request for suggestions for a new mobile contract by signing-up with Lebara (linked to Vodafone) and was happy with the deal but unhappy that voice-messaging didn’t seem to be offered. I advised that with GiffGaff (my preferred provider) it took some time for the network operator to arrange with the phone supplier the necessary integration and access to voice messaging. I found this link which might be helpful. We also discussed VPNs and I again offered to write something about them. [This I will do as a Topic in the most appropriate Forum.]

Anne was having difficulties in setting-up Amazon Prime. Getting a “No internet connection” message after she had upgraded her VirginMedia Router. Advice from group members was that she probably needed to setup the network connection on the TV again because the IP address of the router was probably different.

John M reported that he was experiencing an annoying break, and then delay in delivery of streamed media. I explained that this was almost certainly due to buffering. The download of a stream starts, then the delivery of the stream to the device is faster than the initial filling of the buffer that holds the content. Once the two are in sync, this delay would be minimised and the stream would be constant – that is download would equal display but would probably be slightly behind a live stream. This can be mitigated by using a cable connction from the router to the TV (or other device) because the download speed over local cable would be faster than relying on WiFi. He also reported some difficulties with enabling his First Direct Bank account with 2FA (his fingerprint). We suggested that he might look at the settings for his device, or the app, just to check that fingerprint recognition had been enabled.

Margaret retold in great detail the sage of changing her old phone to a new phone. The trials and tribulations of different SIM sizes (moving from a 7-year old phone); the barrier of having to provide ID at the shop (the security check to prevent SIM-swapping – which I applauded); the complexities of different USB connections (USB-A to USB-C) for an adapter; and when she’d got through all that the difficulty in understanding the instructions to validate the new sized SIM (they said Turn off, it should have said Power down). Congratulations and applause was showered upon her for the detail in her recounting of events and her success in achieving a successful outcome.

Ian was experiencing the SBOD (Spinning Beachball of Death) on his 7-8 year-old Mac; was this really the end, or could he do something about it? I suggested that the machine was probably nearing the end of its productive life. I had older machines but had been able to upgrade the RAM, the hard disk and the battery. If any of these were a possibility an upgrade might be a good idea and it was a job that a user could do relatively easy as there are videos (specific to machines) on the internet that show you hoe to do it. In the meantime, powering down the machine at least once a week (to flush the cache); running maintenance software such as Clean My Mac; and reducing the number of open windows, and background software, might eek more life out of the machine.

Stella was trying to link her laptop to her TV, but was having difficulties in doing so. I can’t remember (and I have no note) as to what was suggested.

Posted on

Identity Theft

This will probably be one of the most challenging posts I’ve ever attempted to write because in all truth, I don’t think we really still know what actually happened to my daughter’s online identity, let alone wholly knowing how it happened, but I’m going to try and explain the sequence of events as an alert to you all, and a reminder to us too!

Some background and a plausible explanation of why they got themselves into the situation they found themselves.

They’d been self-employed for a short while now, working as a freelancer, and had just submitted their first tax returns in that capacity.

They were working from home, with two young children with one under six months old, and both very demanding of their time.

The family is living in another family member’s house whilst they “do up” their new house.

They’re adept at multi-tasking (obviously too adept as it turns out) and is (as many of their age are able to do) capable of nestling their phone between chin and shoulder whilst doing other tasks!

What happened next!

She had a phone call purporting to come from HMRC (we’re presuming this was just a fortuitous coincidence from the fraudster’s point of view – they had no way of knowing the employment status of the family member) – saying that they had a refund owing. As explained above she thought this was quite possibly the case as she had just completed a tax return – again an unhappy coincidence! She was told to click on a link in a text message to complete the process of getting the refund. She had their youngest child on her hip, was preparing a meal and was “distracted”. She filled-in the required information from the link!!!!

Agh! No!

Shortly afterwards (the same day) she presented her credit card at a supermarket and payment was refused. She realised something was wrong. She found she didn’t have access to her online banking. She contacted the bank by phone. The bank “supposedly” froze the account there and then but it was apparent that at least two transfers of money had been made to someone who was a Payee in her account – why? That’s the clever bit of the scam, I’ll explain later!

More payments appeared to have been made … help!!!

How could this be? The account was frozen … wasn’t it?

Get the family involved!

Having a son who’s an IT expert comes in useful, especially if he lives on the other side of the world! He worked through the night (day) in securing as many of her accounts as he could. Changing passwords, which were admittedly rather weak and used more than once (should have listened to Dad) – but he had no idea just how much data had been downloaded, or indeed just how much they had to start with as a result of perhaps a previous “pwned” event.

Having another local son who’s also very practical and logical helps also. He suggested that she contact the payee and tell them about the payment and request it be refunded. What transpired next turns out to be the “clever” part of the scam, although on this occasion it wasn’t conducted very expertly because they attempted multiple payments to the same payee. The payee confirmed that they’d had this payment, wondered what it was and had been a bit puzzled as to why Mr X had contacted them and requested a refund to a bank account because “he’d made a mistake”.

This was obviously NOT the same account as that from which the payment had originated and turned out to be the way the scammers were hoping to transfer funds from the hi-jacked bank account to one of their own! Fortunately, my son’s suggestion alerted the payee and the payee advised their bank NOT to transfer the money.

Phew! How did this all happen when the bank account was supposed to be frozen?

The key to this scam was getting control of my daughter’s mobile phone number. She didn’t realise it immediately, but soon became aware that it had been “stolen” through a scam called SIM swapping. This usually is done by a seemingly distressed person going into a mobile phone shop and pleading for a new SIM with a phone number “because their phone has been stolen” and “it’s absolutely imperative they have their number back immediately as there’s something very important happening right now”.  This is described here.

Why do they want to do this? Because they can transfer calls made to the rightful owner of the phone to their own phone.

Why do they want to do this? Because they can then request the bank account to be unfrozen, and also use their access to the phone number for any number of authorisation features.

And what is more they can lock you out of your phone accounts.

How did they do this in this case? Well GiffGaff is an online service provider and they have stated that they did everything they were supposed to do to authenticate the request for a SIM swap – but it is evident that there are serious weaknesses in their processes. They have stated they are looking at this for the future. Just Google “GiffGaff SIM swap Fraud” to see what is returned – it’s frightening!

So what happened next, and was there a happy ending?

Well, believe it or not, even with a personal visit to the bank and assurances that no more payments would be made, the bank did allow the account to be unfrozen and transfers out of her account were attempted. A second visit to the bank resulted in heartfelt apologies being made and offered over the way their fraud department had handled the problem and a complaint being raised by the branch against their own department on my daughter’s behalf – I don’t know the outcome of that!

Well, there was a happy financial outcome. Thanks to the prompt action and thinking of my local son, the initial transfer was halted. It’s not conclusive whether my daughter could have received compensation (as detailed here) as she was the instigator of the problem through her own mistake (the HMRC phone call). All other attempted transfers were eventually trapped by the bank and refunded to her – so no financial loss.

However …

Much more significant than the potential financial loss was what it did to her confidence. She insisted on getting a new phone, because she wouldn’t accept any advice from any family member (especially me) that there wasn’t anything on her phone that wouldn’t continue to monitor her.

She also lost all confidence in using any online systems – which up until then she’d been very reliant upon.

She also lost a lot of confidence in herself as she realised just how gullible (but extremely unfortunate) she’d been … but the positive side of this, and the main reason for sharing this is that she’ll be much more careful in the future!

Postscript.

We don’t know whether the identity theft side of this will ever be resolved. We all know that a huge amount of information is held on us on the internet. We all know that some websites have had their security breached and identity information stolen. We don’t know what was held by others about my daughter. She had a public profile, they now have the potential to add even more information to their database about her if they had managed to download information from her email (and other) accounts before my son locked them down. We just don’t know.

There was a mysterious book that arrived at her house with a cryptic message in it.

There have been some scamming emails purporting to come from her since this event.

She now uses a different email account.

We just don’t know whether these are connected to the fraud event or are just strange random occurrences … and I suppose we never will know just how much additional information they may have downloaded – emails, photographs, documents, etc. etc. Very frightening.

NatWest Guide to Fraud
Some privacy tips for iPhone users.

Posted on

Scams, SIMs and security – 27th June 2019

Boot-up
Feedback from the last meeting (John). Any progress with websites from anyone else??
Thought grazing: Jim posted on Google Photos, Google Drive and Backup and Sync. This is Google’s blogpost on the changes they are making and here is the help document explaining what will happen after July 10th.
I posted about using URL shorteners and reminded you how I use Pocket and Flipboard.
The Computer Group for next year. We’ll meet as we meet now, every second and fourth Thursday of the month.
Digital Picture Frames – anyone use them? I’ve had Nix recommended to me. Alternatives – try Foliobook on an iPad, or a screensaver linked to Dropbox on a Desktop PC.
Travel and digital photography.
SMART meters, SMETS2 and Hive. Discussion on options – switching suppliers. Hold off for now?
How do Password Managers Work?  Should you use one? Which one should you use?
Anything else, issues, problems.
News
Apple’s WWDC Showcase summary – loads of updates and new hardware. The 8-minute video summary. Apple’s promotional videos from the event. Apple splits iPhone and iPad operating systems by introducing iPadOS – what’s new in both?
What new features will there be in iPadOS? Mouse support for the iPad. Finally, external drive support for the iPad – this is how it will work.
New features for MacOS – Catalina coming in the autumn.
Apple’s iOS 13 will provide some protection against spam phone calls.
New features in iPadOS, iOS and MacOS for photographers. Click here and here too!
Apple finally kills off iTunes!
New features for Dropbox on the Apple platforms.
What Wireless Security are you using, and should you consider changing your router?
Don’t charge your phone/tablet under your pillow at night – and other electrical tips!
Identity Theft
This will probably be one of the most challenging posts I’ve ever attempted to write because in all truth, I don’t think we really still know what actually happened to my daughter’s online identity, let alone wholly knowing how it happened, but I’m going to try and explain the sequence of events as an alert to you all, and a reminder to us too!
Some background and a plausible explanation of why she got herself into the situation she found herself.
She’s been self-employed for a short while now, working as a freelance journalist, and had just submitted her first tax returns in that capacity.
She’s working from home, with two young children with one under six months old and both very demanding of her time.
The family is living in my local son’s house whilst they “do up” their new house.
She’s adept at multi-tasking (obviously too adept as it turns out) and is (as many of her age are able to do) capable of nestling her phone between chin and shoulder whilst doing other tasks!
What happened next!
She had a phone call purporting to come from HMRC – we’re presuming this was just a fortuitous coincidence from the fraudster’s point of view – saying that she had a refund owing. As explained above she thought this was quite possibly the case! She was told to click on a link to complete the process of getting the refund. She had her youngest son on her hip, was preparing a meal and was “distracted”. She filled-in the required information from the link!!!!
Agh! No!
Shortly afterwards (same day) she presented her credit card at a supermarket and payment was refused. She realised something was wrong. She found she didn’t have access to her online banking. She contacted the bank by phone. They “supposedly” froze her account but it was apparent that at least two transfers of money had been made to someone who was a Payee in her account – why? That’s the clever bit of the scam, I’ll explain later!
More payments appeared to have been made … help!!!
How could this be? The account was frozen … wasn’t it?
Get the family involved!
Having a son who’s an IT expert comes in useful, especially if he lives on the other side of the world! He worked through the night (day) in securing as many of her accounts as he could. Changing passwords, which were admittedly rather weak and used more than once (should have listened to Dad) – but they had no idea just how much data had been downloaded, or indeed just how much they had to start with as a result of perhaps a previous “pwned” event.
Having a local son who’s also very practical and logical helps also. He suggested that she contact the payee and tell them about the payment and request it be refunded. What transpired next turns out to be the “clever” part of the scam, although on this occasion it wasn’t conducted very expertly because they attempted multiple payments to the same payee. The payee confirmed that they’d had this payment, wondered what it was and had been a bit puzzled as to why Mr X had contacted them and requested a refund to a bank account because “he’d made a mistake”. This was obviously NOT the same account as that from which the payment had originated and turned out to be the way the scammers were hoping to transfer funds from the hi-jacked bank account to their own! Fortunately, my son’s suggestion alerted the payee and they advised their bank NOT to transfer the money.
Phew! How did this all happen when the bank account was supposed to be frozen?
The key to this scam was getting control of my daughter’s mobile phone number. She didn’t realise it immediately, but soon became aware that it had been “stolen” through a scam called SIM swapping. This usually is done by a distressed person going into a mobile phone shop and pleading for a new SIM with a phone number “because their phone has been stolen” and “it’s absolutely imperative they have their number back immediately as there’s something very important happening right now”.  This is described here.
Why do they want to do this? Because they can transfer calls to the rightful owner of the phone to their own phone.
Why do they want to do this? Because they can then request the bank account to be unfrozen, and also use their access to the phone number for any number of authorisation features.
And what is more they can lock you out of your phone accounts.
How did they do this in this case? Well GiffGaff is an online service provider and they have stated that they did everything they were supposed to do to authenticate the request for a SIM swap – but it is evident that there are serious weaknesses in their processes. They have stated they are looking at this for the future. Just Google “GiffGaff SIM swap Fraud” to see what is returned – it’s frightening!
So what happened next, and was there a happy ending?
Well, believe it or not, even with a personal visit to the bank and assurances that no more payments would be made, the bank did allow the account to be unfrozen and transfers out of her account were attempted. A second visit to the bank resulted in heartfelt apologies over the way their fraud department had handled the problem and a complaint being raised by the branch against their own department on my daughter’s behalf – I don’t know the outcome of that!
Well, there was a happy financial outcome. Thanks to the prompt action and thinking of my local son, the initial transfer was halted. It’s not conclusive whether my daughter could have received compensation (as detailed here) as she was the instigator of the problem through her own mistake (the HMRC phone call). All other attempted transfers were eventually trapped by the bank and refunded to her – so no financial loss.
However …
Much more significant than the potential financial loss was what it did to her confidence. She insisted on getting a new phone, because she wouldn’t accept any advice from any family member (especially me) that there wasn’t anything on her phone that wouldn’t continue to monitor her.
She also lost all confidence in using any online systems – which up until then she’d been very reliant upon.
She also lost a lot of confidence in herself as she realised just how gullible (but extremely unfortunate) she’d been … but the positive side of this, and the main reason for sharing this is that she’ll be much more careful in the future!
Postscript.
We don’t know whether the identity theft side of this will ever be resolved. We all know that a huge amount of information is held on us on the internet. We all know that some websites have had their security breached and identity information stolen. We don’t know what was held by others about my daughter. She was a public figure, a journalist on a national newspaper, they now have the potential to add even more information to their database about her if they managed to download information from her email (and other) accounts before my son locked them down. We just don’t know.
There was a mysterious book that arrived at her house with a cryptic message in it.
There have been some scamming emails purporting to come from her since this event.
We just don’t know whether these are connected to the fraud event or are just strange random occurrences … and I suppose we never will know just how much additional information they may have downloaded – emails, photographs, documents, etc. etc. Very frightening.
NatWest Guide to Fraud
Some privacy tips for iPhone users.