ANN/THE STRAITS TIMES – A woman found herself facing a SGD76,000 bill for a mooncake order, as scammers exploited a third-party app to hijack her phone and withdraw funds from her bank account.
On September 14, Lee, an administrative executive, came across a Facebook ad featuring bunny-shaped mooncakes filled with Mao Shan Wang durian. These delectable treats were offered by the bakery “Sunshine Cake House”.
Captivated by the SGD29.90 deal for a box of eight mooncakes, she initiated contact with the seller on Facebook, who subsequently shared her contact information with a supposed “delivery man.”
This “delivery man” texted Lee on WhatsApp and instructed her to download a third-party app on her Android phone. The app prompted her to make a SGD1 payment through PayNow as a “deposit” before her order could be placed, but wary of divulging her bank details, the 51-year-old pretended not to have PayNow.
“I’ve read about all these scams so I refused to give my PayNow and the fraudster paid the deposit for me,” said Lee, who only wanted to be known by her surname. “I was so careful but I got scammed all the same.”
Later, she deleted the third-party app after she had trouble logging into her mobile banking app on her phone.
She did not tell the purported delivery man about this, but he immediately called to say her order had been cancelled and pressed her to download the deleted app again.
Lee relented because he was “very courteous”.
The man continued to text her about the delivery through the day, constantly postponing the delivery time until his last message at about 11pm – when she went to bed.
In the morning, Lee woke to find that her phone had been “compromised”. She could not make any calls or log in to her mobile banking apps.
She rushed to the nearest ATM to check her bank balance only to find that “everything was gone”.
The grifters had raised her transaction limit from SGD500 to SGD20,000 and transferred SGD76,000 out of her DBS account in a series of four transactions.
Lee said the money had been set aside for the down payment on her new build-to-order flat and renovation works.
Her compromised phone meant she could not make any calls and had to plead with several passers-by to borrow a phone just to call the bank. Immediately after, she lodged a police report.
“The scammer even had the audacity to text me about more mooncakes that morning,” she said.
The police confirmed that a report had been lodged and investigations are ongoing.
Lee, who hopes to recover the stolen sum from DBS, questioned how the “unusual” transactions went through without any notifications sent to her.
“Why didn’t DBS call me? It might not be convenient but banks should protect their customers and ask more questions,” she said.
“I feel terrible, I can’t sleep or eat. My heart feels ill,” said the mother of two, adding that her two children were still in school and she was going to have trouble paying for her new home.
With the Mid-Autumn Festival approaching, scammers are turning to bogus mooncake advertisements to swindle people online. In August, at least 27 people fell prey to these scams, losing some SGD325,000 in total, said the police.
These mooncake scams take the same tack: “Sellers” send victims payment links that download malware into their phones, enabling scammers to control victims’ devices remotely and drain their bank accounts.
