JMPD 0fficer scammed R33 000
A YOUNG City of Joburg Metro law enforcement officer has learnt the hard way to never again give away his bank details over the phone – even if the person requesting those details claims to be a bank employee.
Thirty-year-old Lwando Xolo's lesson came too late when he lost R33 000, which was withdrawn in one transaction from his FNB account without his consent in July last year.
His attempt to force FNB to reimburse him came tumbling down when the Ombudsman for Banking Services (OBS) ruled against him, saying there was no “evidence that the bank's system was compromised, or that the information was obtained from the bank”.
“I will never again agree to discuss my finances over the phone even if I am offered to use the phone inside the bank. I will insist on being assisted face-to-face at the customer service desk,” Xolo said.
The OBS's findings were made in October last year, but Xolo only received them this week. The findings indicated that he was a victim of a phishing scam whereby his card details, along with the one-time password (OTP), were used to perform illegal transactions.
Phishing works by sending communique to unsuspecting people that look like they are from a legitimate company or website.
In his submission through his Clientele lawyers, Xolo told OBS that he was scammed after receiving a call from a “bank employee” requesting his bank card details – but the OBS ruled that the phone number used to call him did not belong to the bank.
“It is also evident that when the transaction was processed, the card was in your possession at all material times. It is common cause that the card was and/or is your responsibility to protect and to ensure it is not used by a third party,” read the OBS's report.
Trish Ramdhani, FNB's head of card fraud, said the OBS had exonerated the bank from any wrongdoing.
“Our investigation found that our customer was a victim of telephonic and/or online phishing. In addition, the disputed transactions were processed using a one-time PIN (OTP),” Ramdhani said.
Xolo's financial trouble started on July 29 last year when he went to FNB's Lenasia branch to reverse an amount of R824 that Nedbank had debited from his account, despite the fact that he had already finished paying for a loan that he had taken with the bank.
Instead of being assisted face-toface at the FNB's customer care service desk with the reversal, a consultant dialled a number for him to talk to another consultant he could not see. The call was answered by a man who transferred him to a woman consultant.
The reversal was successful, but while he was in a taxi making his way back home, Xolo received a call from someone who claimed to be working for FNB and whose voice resembled that of the man who spoke to him over the phone before transferring him to a woman consultant.
This man told him that FNB required his bank card number and upon Xolo giving it to him, the man then told him that he should read to him an OTP number sent to him in an SMS. Xolo read out the number as he did not suspect anything fishy about the instruction. Upon terminating the call, Xolo received two SMSes indicating that more than R33 000 had been withdrawn from his FNB bank account.
The R33 000 was part of a R120 000 loan which Xolo had taken from FNB in June last year to build a house for his elderly mother in the Eastern Cape.
When the theft occurred on July 29, 2022, Xolo had already withdrawn R80 000 and sent it home to buy building material. He also used some of the money to settle some of his debts. He had kept about R34000 in the bank account to pay for labour.
“After receiving the SMSes indicating that R33000 has been withdrawn from my account, I immediately phoned the bank's fraud line which then blocked the card to protect me from further fraud,” Xolo said.
Xolo said he never lost sight of his bank card nor had he given it to someone else.
“I am confused when FNB refuses to take responsibility for my loss because a woman at the bank is the one who, instead of helping me at the customer care desk, dialled a number using the bank's phone for me to talk to a consultant. I strongly believe that the man who answered the call and asked me some questions before transferring the call to a woman consultant is involved in the fraudulent withdrawal of my money,” he said.
According to the OBS, without taking responsibility and reimbursing Xolo, FNB offered him “R10 000 as a goodwill gesture which your (Xolo) rejected”.
According to the Banking Association of South Africa (Basa), there were possibilities of this type of fraud happening when cardholders might have conducted transactions when ordering goods, travel or accommodation arrangements are placed telephonically, by internet, mail order or fax. “Account takeover fraud occurs when a perpetrator poses as the legitimate account holder and takes over someone's account, and then uses the account for their own benefit. Access to personal information is used by perpetrators to pose as their victims for both account takeover fraud and false application fraud,” read Basa's website.
After 10 days of waiting for the internal investigation, the bank called to tell Xolo that it could not take responsibility for the theft, meaning it could not reimburse him.
“I then approached Clientele, whose lawyer advised me to open a case with the police. When I returned to them (Clientele), they gave me an ombudsman form to fill,” he said.
Xolo said both Clientele and the OBS kept quiet for almost a month. He then directly approached the OBS, which said it could only communicate with Clientele about the matter since it had launched the complaint with the ombudsman on his behalf. “I then approached Clientele, which asked me if I still had not been reimbursed. They told me that the bank had told them that it had refunded me, which was not the case,” he said.
He said the bank told him that his card was swiped. “I never ever swipe R5 000 because my swiping daily limit is only up to R3000, which makes me wonder how the fraudster was able to swipe R33000 in one day.”
Ramdhani said: “The bank confirms that the R3000 limit referred to by our customer is an ATM withdrawal limit, however, the disputed transactions were e-commerce transactions.
“Our customer's e-commerce limit was much higher, and such transactions require approval through a one-time PIN (OTP).”
Ramdhani also disputed that the scammer was linked to the bank.
“There is no evidence to support the customer's claims regarding any of our employees.”
Xolo opened a case at Lenasia Police Station.