Mother of all scams thread

[Windwaver]

58 minutes ago, Jp66 said:

 

The problem is the url is not showing on the top when you click on the link,  watch the attached video. 

 

Avoid clicking any hyperlinks that you cannot tell directly from source.

Unfortunately most end users still don't have that kind of awareness.

 

[Voodooman]

9 hours ago, Volvobrick said:

Nothing compared to nickel trading..... 

A lot of scams are easy to avoid if you are not greedy, this is a hell lot more insidious. Most people are not cybersecurity experts. 

The SMS appears to be from the usual SMS channel sent from OCBC and the notification alert from OCBC on transfers to unknown parties was also delayed by hours.  

Won’t be surprised the second factor authentication was also hijacked when OTP was sent by OCBC. 

Will digital token avoid such incidents?
 

 

 

 

 

[BanCoe]

24 minutes ago, Voodooman said:

A lot of scams are easy to avoid if you are not greedy, this is a hell lot more insidious. Most people are not cybersecurity experts. 

The SMS appears to be from the usual SMS channel sent from OCBC and the notification alert from OCBC on transfers to unknown parties was also delayed by hours.  

Won’t be surprised the second factor authentication was also hijacked when OTP was sent by OCBC. 

Will digital token avoid such incidents?
 

 

 

 

 

When OTP is sent it’s a genuine one as a debit or charge has been requested by your account to someone else’s favor or access to your accounts  , because they ( the scammers ) are in control of your savings account and have full access to your account once they get the OTP to perform transfers 

[Mkl22]

16 minutes ago, BanCoe said:

When OTP is sent it’s a genuine one as a debit or charge has been requested by your account to someone else’s favor or access to your accounts  , because they ( the scammers ) are in control of your savings account and have full access to your account once they get the OTP to perform transfers 

But if you didn’t initiate anything why would a genuine otp be sent. In the end people aren’t smart enough

Edited January 9, 2022 by Mkl22

[Ct3833]

First is these scamers have to have our account info before they can trigger a request for OTP, why is this happening to OCBC only ? Has any user account info been leaked or stolen ?

[Playtime]

32 minutes ago, Ct3833 said:

First is these scamers have to have our account info before they can trigger a request for OTP, why is this happening to OCBC only ? Has any user account info been leaked or stolen ?

And who is responsible for the losses. 

If bank system has systemic loop holes.. cannot just say user problems. 

[Voodooman]

34 minutes ago, Ct3833 said:

First is these scamers have to have our account info before they can trigger a request for OTP, why is this happening to OCBC only ? Has any user account info been leaked or stolen ?

My son got the OCBC SMS too. He didn’t have an OCBC account. 

Those who clicked on the link provided the account info and password.

 This is a pro syndicate. 

[Sdf4786k]

12 hours ago, Windwaver said:

Let's start with this

https://www.straitstimes.com/singapore/courts-crime/ocbc-bank-customer-lost-120k-in-fake-text-message-scam-another-had-250k-stolen

Young couple lost $120k in fake text message scam targeting OCBC Bank customers

SINGAPORE - It took a man and his wife five years to save about $120,000, but in just 30 minutes, scammers using a fake text message stole the money they had kept in their OCBC Bank joint savings account.

The couple in their 20s were among at least 469 people who reportedly fell victim to phishing scams involving OCBC in the last two weeks of December last year.

The victims lost around $8.5 million in total.

The husband works in the e-commerce sector, while his wife is in the hospitality industry. The man said he received the phishing message with a link at around noon on Dec 21 last year.

A 38-year-old software engineer who fell prey to the same scam on Dec 28 told ST that he lost about $250,000 he had been saving since 2010.

The father of a young child with special needs said the loss has been devastating, and he has been hiding it from his family.

The bank said it has since halted its plans to phase out physical hardware tokens by the end of March this year, and has also stopped sending SMSes with links in them in the light of the spate of phishing incidents.

Cyber security expert Anthony Lim, who is also a fellow at the Singapore University of Social Sciences, said scammers have advanced software enabling them to spoof telecommunications services and send SMSes that appear in the same threads used by real organisations.

He added that even if victims did not provide their one-time passwords (OTPs), they would have sealed their fate when they entered other bank details on the fraudulent sites.

"Once the victim unwittingly responds by entering the bank account credentials, the hackers' technologies can divert and capture a copy of the SMS OTP issued by the bank," he said.

Obviously sometimes is not so obvious. It’s gets worst if you are a IT guy, yet clueless about phishing…

[Hamburger]

Law needs to be change for scammer. 

Minimum 10yrs sentence and 24 strokes of rotan. 

If perps are oversea, send in the black ops. 

Frankly, the bank should also have a defense mechanism to better protect the customers. 

[Lala81]

I think some people are busy doing other things at times, that's when you can be vulnerable.

And the first part is always meant to make u bit emotional or gan chiong, and hence less likely to think clearly. Just like how the kidnap scams work. Or alerting you are being scammed, then you be like "wat the hell ? I better do something fast"

Edited January 9, 2022 by Lala81

[badlammy]

Have always been wondering why police can't work with banks to have some sort of bait numbers and accounts to catch the mastermind.

[inlinesix]

7 minutes ago, badlammy said:

Have always been wondering why police can't work with banks to have some sort of bait numbers and accounts to catch the mastermind.

Usually this is syndicated. Underling may not know who’s the boss.

[Atrecord]

43 minutes ago, badlammy said:

Have always been wondering why police can't work with banks to have some sort of bait numbers and accounts to catch the mastermind.

maybe they pay high taxes? 

[Voodooman]

2 hours ago, BanCoe said:

When OTP is sent it’s a genuine one as a debit or charge has been requested by your account to someone else’s favor or access to your accounts  , because they ( the scammers ) are in control of your savings account and have full access to your account once they get the OTP to perform transfers 

The OTP is sent to your specified mobile number to authorise new transfer. You need OTP, so what happened? It went to another phone, same as notification, which was delayed by hours?

[Mkl22]

Largely overseas and SPF will not have jurisdiction. Need to provide lots of evidence etc to get them. Who knows such scammers might even state sanctioned to get income for the country. 

[Kopites]

https://www.asiaone.com/singapore/og-department-store-customers-personal-details-leaked-data-breach

Data that may have potentially been compromised includes the names of OG members, their mailing addresses, e-mail addresses, mobile numbers, genders, dates of birth, as well as encrypted NRIC data and passwords.

Edited January 9, 2022 by Kopites

[Jman888]

2 hours ago, Ct3833 said:

First is these scamers have to have our account info before they can trigger a request for OTP, why is this happening to OCBC only ? Has any user account info been leaked or stolen ?

it could be accounts saved in online shopping sites, DBS kena many times. 

I old school,  when received such messages I will call the bank hotline and get to someone on the phone to confirm, it may take some time but no need to panic. But then again I dun have much money in the bank for them to scam.

[BanCoe]

1 hour ago, Voodooman said:

The OTP is sent to your specified mobile number to authorise new transfer. You need OTP, so what happened? It went to another phone, same as notification, which was delayed by hours?

I think once you go into the link and key in your PW PIN number they ( scammer) must be doing it sort of parallel into your account ( with full sighting of your PW/PIN) number and after ……….. I’m still puzzled if they personally call or what to get the OTP or token number ??