Beware of these four ways that cyber-scammers can steal your money

What if we told you that a bank’s chief information security officer, who was visiting Mumbai, fell prey to cyber scammers? What if we told you that you should be suspicious even when a caller, who is a stranger to you, refers to a close friend of yours? What if we told you that cyber scammers are as adept at technology as they are at human psychology?Cyber scammers are lifting the sophistication levels of their cheat tricks so often that it has now become important for us to refresh our awareness about what they could be up to just as often.TOI+ sat down with Amit Dubey, a well-known cyber security expert, who’s better known as Cyber Dubey, to understand how criminals can access your bank accounts, WhatsApp, credit cards, and social media accounts without you ever sharing an OTP, clicking a link, or scanning a QR code.Sharing screen – think ten times before you do it medium nocaption118788394Let’s go back to that bank’s chief information officer and his Mumbai visit. All names in this article have been changed to protect victims’ identities. Let’s call this man Avinash.Avinash wanted to spend a day sightseeing and was looking for some cheap cab options online. He found several websites and chose one where he could pay a nominal booking fee of Rs 100 to get the driver’s details and pay the rest at the end of the trip based on how many kilometres he travelled.But when he tried to make the payment online, it kept failing. Frustrated, he wrote a complaint to the cab company about the portal not working. Almost immediately Avinash received a call from someone claiming to be from the cab company. “Oh, the website isn’t working? We’ll fix it, no problem.”Since the payment was just Rs 100, Avinash offered to pay through UPI but the person on the phone said their server was overloaded. “I’ll send you a link,” he offered instead. “You share your screen, and we’ll check what the problem is. It might be an issue with your browser.”Avinash was given a Google Meet link, where he shared his phone screen and proceeded to fill in his credit card details. Just as he finished typing, a notification flashed on top of his screen: Rs 15,000 debited. And then another: Rs 20,000 debited.That’s when he realised what he’d done.He had shared his screen with a stranger and typed out his credit card details for them to see. But the criminals on the other end still needed an OTP to be able to use his credit card for any transactions, right? Right. And that OTP notification had also flashed across his screen while it was still shared with the scammer.Avinash quickly called the man back. The man on the other side seemed unfazed. “No, no, I haven’t transferred anything. I think you’re mistaken. Here, talk to my boss.” He then handed the phone to someone else who also claimed to not have made any transactions on Avinash’s card. “We can prove it very easily,” he said. “Show me your screen.”And Avinash shared his screen again. “Can you beat that?” asks Dubey. “You see how our mind works?”Dubey explains that the criminals played with Avinash's psyche. He was in a new city on his day off, his guards were down. He was also in a rush to quickly book a cab and get on with his day. Unsuspecting and in a hurry, Avinash was a sitting duck for them. medium nocaption118780652Call merging – sounds harmless, but... medium nocaption118788409“This is a very common technique nowadays,” says Dubey.Suppose you are Amit’s friend and an unknown person calls you and says, ‘Hi, Amit gave me your number and I wanted to invite you to host a talk show we’re organising in a five star hotel.’”Now, since they’ve named someone you know and trust, you’ll likely continue the conversation.But just 20 seconds in, the person on the other end says, “I think Amit is also calling you, why don’t you merge the call and all three of us can discuss this together.”You check your phone and see an incoming call, but it isn’t Amit’s number.“This isn’t Amit’s number,” you say.“Oh, don’t you know? This is his other number,” the scammer responds. “Just merge the call.”And you go ahead and merge the call. And in seconds somebody starts withdrawing money from your accounts or somebody gains access to your social media handles, or your phone is hacked. “Did you share an OTP? No. Did you scan a QR code? No. Did you click any link? No. Did you install any app? Also no. So, how did this happen?” asks Dubey.As it turns out, there’s now an option to get your OTP via phone call through IVR (Interactive Voice Response). Earlier, OTPs would usually come through an SMS, says Dubey. But OTPs can be generated through calls for most platforms like Facebook, Google, WhatsApp and even banks.What we need to understand here is that the scammer already had a lot of your information. They had your name, your friend’s name, and perhaps your bank details, email address, social media handles, etc. All they needed then was an OTP to gain access.The second unknown call — which the scammer said was Amit’s number you did not know of — was an OTP call that was generated by the scammer. As soon as you merged the two calls, the scammer could hear the OTP number. And before you could do anything, they had begun making transactions from your account or had gained access to your social media account.“It’s just a 12-second job,” says Dubey. “The learning is that you shouldn’t merge calls from two unknown numbers.” medium nocaption118780681Call forwarding – there are dangers lurking medium nocaption118788424Dubey remembers it was sometime around Diwali when he started getting calls from doctors in Gurugram about their WhatsApp accounts getting hacked.It started with one doctor, but soon 30-40 doctors were calling for help. In every case, the modus operandi of the scammers was the same.Each doctor got a call from someone claiming to be from a pharmaceutical company, who wanted to send them a Diwali gift.When the doctors said they were fine receiving the gift, the caller said that “it’s an expensive gift, there’s gold jewellery, we can’t send it without recording your permission.”He then said that this permission would have to be recorded electronically. “You’ll receive an SMS from our server with a code in it. You can just dial that code to record your permission,” he said.The doctor then got a message with a code: *62* , *21* , *1401* , etc, depending on the kind of sim card they had.As soon as they’d type in the code, they’d start losing money, or access to their WhatsApp.What’s important to understand is that this isn’t the first time the scammers were contacting these doctors, explains Dubey. They already had access to other details like their names, phone numbers, email addresses, etc. The only thing they needed now, just like in the case of call merging, was an OTP. The code the doctors typed in didn’t actually send any permission for a Diwali gift, instead it activated call forwarding on the doctors’ phones. This meant that any incoming calls on their number would be forwarded to a different number.“There are two types of call forwarding,” explains Dubey. “Conditional call forwarding or all call forwarding. Scammers usually activate conditional call forwarding, which means that calls will only be forwarded when the doctors’ phones are either busy or unreachable.“So, they wouldn’t notice anything is wrong right away since they would still be getting their normal calls,” he adds.The scammers would then keep the doctors on call so their phones are busy, and then request an OTP through call, which will be forwarded to the scammer. WhatsApp is usually the easiest to hack because the scammers already have the phone number and just need an OTP, says Dubey.“Don’t ever dial any code from your phone,” warns Dubey. He also highlights the importance of enabling two-factor authentication on all social media, including WhatsApp. http://youtu.be/G6UpCltz864?si=zJ-wKrZcr9zvn76mVoicemail – a useful tool until it turns harmful medium nocaption118788454Voicemail is a feature that’s usually available on all phones but isn’t really used as much in India as it is in the West. This trend, however, is slowly changing.Voicemail allows people to leave you a voice message in case your phone is busy or unreachable. But how can scammers use it?Well, depending on your operator, you usually only need to send an SMS to a server from your mobile number in order to activate voicemails. You can set a password and then listen to your voicemails at your own convenience.The problem is, scammers can also send an SMS from your number to activate your voicemail and set a password.This is called spoofing, and it’s quite common, says Dubey. Call spoofing, SMS spoofing and email spoofing are three powerful tools used by criminals to defraud unsuspecting victims. The goal of cyber spoofing is typically to gain unauthorised access to information, systems, or to trick individuals into taking actions that benefit the attacker, such as providing personal details, transferring money, or installing malware.“The criminal can make a call from your number to anyone, send SMSs from your number, and even email people from your ID,” explains Dubey. “But they can’t receive the calls, texts or emails being sent to your number or ID.”Criminals can send texts from your number to your operator, enable your voicemail, and even set your password. Then, they will keep you busy on a call and generate an OTP via phone call, which will get recorded in your voicemail.“And they can hear it, they know your password,” says Dubey. medium nocaption118780750If you find yourself a victim of cybercrime, or would like to discuss ways to keep yourself safe with Dubey, you can reach out to him on Instagram (@cyberdubey) and X (@CyberDubey).Lead image: Sajeev Kumarapuram