NoddKD
master brummie
A lesson to us all.I read over the weekend that the Times science editor recently received a scam Royal Mail text explaining that a delivery had failed and clicked on it (when his mind was elsewhere), and when asked for the small delivery fee, paid it. This is what happened when he was in the process of reporting it to his bank some hours later:
I opened the app for my bank, Starling, and checked that there was nothing suspicious. There wasn’t. Then I went to the online chat on my phone app to tell them what I had done. I can still see the conversation now.
“Hello,” I said at 4.50pm on the app. “I think I’ve given a scam site my bank details.”
“Hi Thomas,” came the response 15 minutes later. “You’re through to Peter. Thanks for waiting today!”
A few minutes later, my conversation with Peter on the app stopped abruptly. The reason why is that Matt phoned.
“Hello,” he said, “I’m calling from Starling.” I picked up the call and said: “I was just on the chat.” Matt said: “We know. The hackers have access to your app and your phone.
“Can you see a pending transaction for £224?” he asked. I could, it had just popped up — awaiting my approval. “We think it is suspicious,” he said. It was indeed. I thanked him for calling, and said I felt very silly. He chuckled and said there was no need.
Then I had a niggle. “How do I know you’re not the scammer?” I asked. After all, they had my phone number. He said I was right to ask. “Let’s go through the security questions,” he said.
“Can you tell me my recent transactions?” I said.
“Not until the questions,” he replied.
So we did the dance, him saying bits of my address, me completing it. Fine, he said, you’re verified.
He had called me, he said, because the hackers had access to everything on my phone. Starling Bank needed to upgrade the app. Matt said I should change my email password because the hackers had it. When the call was over, he said, I should contact my other bank. I said “****”. He told me not to swear.
Still, though, I had a slight niggle. What he was saying didn’t make sense to me. Even if, as he said, the hackers had full access to my phone, they wouldn’t be able to just log into my banking apps — they required a thumb print. He brushed aside my worries. I didn’t understand the sophistication of the attack, he said. I checked his number, at his insistence. It was Starling’s. By this stage we had been speaking for 15 minutes. He said it was imperative I upgraded my security.
“The hackers are in your bank app now,” he said. He was calm, but authoritative. “We need to send an authentication notification under an alias. It will come from ‘Warehouse Utilities’.” When I clicked on this, he said, it would upgrade the app without the hackers knowing, and kick them out.
I didn’t really understand. I took the phone from my ear, and opened the Starling app. The notification popped up: “Warehouse Utilities”. I also saw that it required I approve a £1,000 transaction. You need to understand, I’m panicked. I’m worried I’ve compromised all my bank accounts, and all my work. Matt has warned me that the hackers could have got access to the work wi-fi. Still, my stupidity has limits. I’m not clicking on that. I said: “I’ll call you back immediately on this number.”
“There is a long wait and we can’t guarantee your funds if you do that,” he said. “They may clear you out.”
“That makes no sense, just block transactions,” I said. For the first time, he sounded flustered.
Then I asked: “What were we saying just now on the online chat?”
He said: “You were asking to verify this call.”
I wasn’t. I hung up.
Here is my attempt to reverse engineer what happened. It was, I believe, a total coincidence that the moment I realised my mistake and was on the bank’s online chat was the moment Matt called. Everything that came after was planned. His goal throughout was to sound calm and professional, while making me increasingly flustered. So much so that I didn’t notice that he was “verifying” me more than I was verifying him. He had my “security details” because — I’d autofilled my address on the “Royal Mail” page. Part of the verification involved me telling him my bank balance “to confirm it’s you”. So he knew how much I was good for. There were nice touches too. He could ad-lib — telling me not to swear was genius. This man was clever. He had options in life, but the tragedy is he chose this. Ultimately though, in this instance, his labour was for naught. I didn’t click. Instead I rang Starling — the number of which he had spoofed — and it sorted it all. After seeing how it worked, it seems obviously laughable that the bank would use an approach like his.
So what is the moral of my tale? I wonder how I would react reading this about someone else. Probably I would find the mechanism intriguing. Maybe I would warn elderly neighbours. Smugly I wouldn’t consider it an issue for me though. And yet. In that moment, when I thought someone was in all my bank accounts, all my emails, thinking the whole office might have been compromised by my idiocy? Well, I can see why people may, in a moment of madness, click.
I was given a sound piece of advice concerning this type of situation. If alarm bells are going wild take a few moments to calm down before doing anything.
NoddKD