Social media "Customer Services" scam

Cloudane

A vent and a warning

TL;DR: accounts that appear to be "Customer Services" replying to you when you vent to a company on social media may not be as they seem!  And some things to watch out for with PayPal-like apps.

I've been trying to squeeze a refund out of Three for a monthly payment they took when my account was already closed (that's another story but basically, they flat out refuse to refund even their own mistakes no matter how far you escalate your complaint.  All they will offer is credit on a new account.  It wasn't worth it but I wanted it on principle)

This led me to vent on one of their Facebook posts because generally I've found that you can get "impossible" things magically resolved with companies like Three when you publicly shame them on social media.

Unfortunately, duh, the scammers know this too.

So "Customer Service Helpline" replies to my comment that they want to provide an immediate resolution, just DM them my contact number.

I do, they then call.  Indian caller, but you'd expect this from Three so no alarm bells there, or no more than usual.  "They will resolve this and send me a refund".  Direct me to download Afriex which is a PayPal-like app (had I looked into the app I'd have realised it was licensed by the Central Bank of Nigeria - whilst actually a legit app, seemingly it's used a lot for ticket scams etc and well, it's Nigeria.  But I was on my 30 minute lunch break and rushing, which was my fatal mistake). The whole app idea didn't ring many alarm bells either because it's Three, the REAL customer services have already told me they can't refund to my card, so silly me with a brain fart thinks "well it's normal for Three to be this shoddy and unprofessional, so I guess they are working around the limitation by just sending me the refund in a PayPal-like app, and I wouldn't blame them for not wanting to deal with PayPal themselves..."

I've already given them my mobile number, email address and "confirmed" my postal address at this point - my next big failing was just kind of handwaving in my mind how suspicious it is to need to "confirm" my address by spelling it out as if it's the first time they've heard it and need to type it in.  They used this to create an account on Afriex for me and directed me to login with the "temporary password" which I did.  Held on the line while I let Afriex have my card details, driving license photo and facial verification. (Thank goodness I didn't let the scammer himself have the driving license and photo or I'd be extra screwed).  At this point, here's the trick, both I and the scammer have the "temporary" complaints-related password to the same cash app.  The one that now has my debit card registered and ID verified.

Now the scammer says they've sent the refund and I get an email saying transaction failed.  Tell the scammer about it "oh okay I need to re-verify, can you read out your driving license ID to me please" - finally the penny starts to drop and I make him wait while I "find it again".  I check the transactions page - 1 pending transaction for £100 OUT towards some random name.  "Uh before I do that, what's this £100 transaction to soandso?"
"Oh that's a previous customer we refunded"
"....."
"....."
"..... ugh, nice try" *I hang up*

By this point 2x transactions for £100 have gone through.

Immediately contacted my bank who blocked my card for me.  They're doubtful they'll be able to get it back as I used a secure money transfer app which is my responsibility but since I didn't technically authorise the transactions (the scammer did from their access to the Afriex account) they'll see what they can do.

Meanwhile contacted Afriex who locked that account and are seeing if they can reverse it.

I doubt either will, it's probably a £200 lesson, I guess it could've been worse with another zero or more.

I am not normally this bone achingly STUPID.  Literally part of my job is cyber security, which puts even greater shame on me and if you were to say "wow you should be fired if you can't even look after your OWN security" you'd probably be right.  All I can do is take it as a lesson.  It's a good example of what happens when you let your "expertise" make you complacent (and when you're rushing something through during lunch).  It's a lesson not to skip the kind of checks and safeguards one normally recommends to other people just because your complacency thinks you "don't need it".

Brie

They can be so convincing!!!  Glad you acted quickly once you realised what was happening.

What I've noticed though is that when I pick up the phone to a scammer there's invariably a pause, likely waiting for someone their side to connect to the call.  And then they will ask if I'm the home owner or similar.  I expect their computer system is calling a new number every few seconds looking for someone to answer and because of us needing to take calls from random numbers there's no way to screen these out.  

Cloudane

Just can't believe I overlooked so many red flags!  Crazy.

It's only really that Three's customer service is on a level I'd consider "not that far above random Indian or Nigerian scammers" that there was enough plausibility to it in my mind in the first place - if I were to point the finger anywhere but myself, anyway.

Albermarle

Brie said:

They can be so convincing!!!  Glad you acted quickly once you realised what was happening.

What I've noticed though is that when I pick up the phone to a scammer there's invariably a pause, likely waiting for someone their side to connect to the call.  And then they will ask if I'm the home owner or similar.  I expect their computer system is calling a new number every few seconds looking for someone to answer and because of us needing to take calls from random numbers there's no way to screen these out.  

At least half the time, I find there is nobody there at all. Somebody told me if you do not say anything ( like Hello) then the system just cuts you off, but I am not sure if that is true or not.
I find that usually if somebody is there, they usually say 'is that Mr ....' ' How are you today?' you can normally hear a lot of chatter in the background as well. 

Mr.Generous

The social media sites who allow random people to set up accounts named BT-Customer-Services or whatever are also to blame. They can make any excuse they like, but any new account should have a verification process before being allowed to post, an if it obviously looks like a legit company account rather than a random person - then more so. Why isn't the wonderful AI able to spot these new accounts - a person could??

Cloudane

Had a call from the bank it's being accepted as fraud and redirected off my account to their special fraud one.  

They did warn me that if they find I did authorise the transactions then they'll come back to me.  Well the only one I went through the bank/MasterCard 2fa and scanned my fingerprint for was the <£1 pre-auth when adding the card (PayPal do this kind of thing as well, to prove it's a real card) the other transactions just went out automatically.  It's interesting actually as I thought ALL online card transactions had to go through the "secure by MasterCard / visa" thing now but these didn't. If that's all they meant, I should be okay.  If it's more that Afriex can claim I authorised them (despite having a log at their end of an IP address in India doing it while my IP address in the UK was logged in simultaneously??)then maybe I have a future argument on my hands. Hope not. 

Mr.Generous said:

The social media sites who allow random people to set up accounts named BT-Customer-Services or whatever are also to blame. They can make any excuse they like, but any new account should have a verification process before being allowed to post, an if it obviously looks like a legit company account rather than a random person - then more so. Why isn't the wonderful AI able to spot these new accounts - a person could??

Facebook do have a bit to answer for here.  They don't care at all. I reported the account and their posts and messages baiting me and got a near instant response back saying the account hasn't done anything against the community standards (and a somewhat patronising point that if they're hurting my feefees I can always block them).  And yet friends who say something even slightly inflammatory about a certain chap in the US end up in Facebook jail.