Don’t be the victim of a phone ping with pong of total fraud
THE text pinged into my phone from Bank of Ireland. ‘An unauthorised transaction was performed using your BOI Visa card. You can authorise or cancel this request at 365online-banking.com.’ Helpfully, the last bit was a link, so I clicked on it.
It brought me to the login page of Banking 365, where I was asked for my login and my date of birth. It then asked for an authorisation code and my phone dutifully pinged again, code delivered. I inputted it and was asked for three digits of my PIN. In they went.
‘Incorrect PIN,’ the page told me, and asked me for the other three digits, which I typed in. The page said something about processing my login and sent me to the spinning thing. I thought that was odd; I don’t normally get the spinning thing with BOI, but I was outside a hospital and on my phone, so I supposed it was struggling to connect.
When it continued spinning, I decided to abandon the login attempt and go through the app instead. I was immediately in, looking at my accounts, which seemed in order. There was no mention of an unauthorised transaction – and it was then that the alarm bells all went pinging in my head at once.
I was lucky. I have priority banking, which doesn’t mean much to me but it does mean that when I phone my bank a real person answers a real phone real quickly. Enter Fintan, the man who saved my money last Monday. I began to explain what had happened and he stopped me in my tracks: did you click on the link? And did you enter your PIN? And in that moment, I realised I had entered all six digits of my PIN.
I don’t know if Fintan is an athletic type, but I’ve rarely known somebody move so fast on the phone. Within seconds, he had blocked all my accounts – I have three connected to my 365 profile. Once that was done, we both breathed easier and he began to check for damage. Miraculously, there was none.
I had reacted fast, Fintan even faster, and we had accessed the accounts before the fraudsters could. But they could have cleared out all three accounts (though they’d have been bitterly disappointed with the €6 in my savings account) and if I hadn’t had priority banking and had got stuck in a vortex of recorded messages, they probably would have.
Now, I am not stupid, nor do I think I’m especially gullible. I laughed at the Nigerian princes and the Gulf War veterans with their millions in dusty boxes in the desert. When the Department of Social Protection or the Gardaí phone me up in their odd American accents to tell me there has been fraudulent activity regarding my PPS number, I hang up.
I never answer the phone if the call originated in Papua New Guinea. But this was a whole new level of sophistication. For starters, the bogus text appeared in my legitimate stream of BOI texts.
THE one before it was an authorisation for a recent Revolut transaction. They can do that, Fintan explained, because they use software that disguises the real origin of a text and fools your phone into thinking it comes from somewhere else. The Banking 365 home page they presented me with was identical to the real thing. They even warned me, in the text with the authorisation code, not to share my personal information with anyone, including Bank of Ireland.
There were two things left to do. Change my PIN and report the fraud. For the first, Fintan said he’d put me through to an automated service. But the call didn’t go through and Fintan told me he’d have to hang up and call me back. When he did, it was from a different number to the one I’d called.
And then I was paranoid all over again. What if Fintan was part of the whole scam? He now had all my details, and I had none of his. I explained my concerns to him and he suggested that this time, I hang up and phone back. I did, and this time my query was ‘Do you have a Fintan working there?’ They did, and hallelujah, after that it was plain sailing.
I texted my best friend when I got home to tell her of the drama. She called me back, minutes later, to tell me that her daughter had, just that afternoon, received the same bogus text. Only she didn’t have priority banking and by the time she got her bank account blocked, she was down €3,160. My mother’s neighbour, a week earlier, €27,000.
It is rife. It is ingenious. And it is incredibly easy to fall for.
The takeaway is, don’t believe anything that pings into your phone, no matter how apparently legitimate the source. And never reveal all six digits of your PIN to anyone. Not even your priest. Oh, and be careful out there.