A woman shares her experience of losing life savings to an advanced text scam. Upon receiving a message from her bank, HSBC, alerting her to fraudulent activity on her account, Suni Wan promptly contacted the bank.
The text didn’t raise suspicions since it was in the usual message thread from her bank. It stated that a new device accessed her account and urged her to call back if it wasn’t her. When she called, the person on the line mentioned an S8 logging in, causing concern as she had owned a Samsung S8 in the past.
Worried that someone might have acquired her old phone to attempt unauthorized access to her bank account, Suni provided all the requested information, such as her name, address, and date of birth, as well as generating and sharing a one-time passcode to address the purported issue.
Suni became wary only when the person on the call began inquiring about her Coinspot cryptocurrency account. Suni promptly contacted HSBC, requesting them to suspend her account, but the scammers had already withdrawn $49,000.
They effectively mimicked HSBC’s genuine phone number, resulting in their message being integrated into the message thread alongside a year’s worth of legitimate communications from the bank.
HSBC released a message, “For customer confidentiality reasons we can’t discuss specific customer situations. HSBC takes customer security very seriously and we thoroughly investigate any reported cases of scam or fraud. The industry has seen an increase in fraudsters using ‘text spoofing’ to deliberately falsify the telephone number to appear as a genuine bank text message. Scam text messages can even appear in the same message chain as real messages from the organisation, making them even harder to spot.”
