Optus customer loses $10,000, digital identity in phone porting, SIM-swap scam

Mr Ryder was surprised to get a text from Optus saying his number was being moved to another SIM. (ABC North Qld: Chloe Chomicki)

Fraudsters made quick work of stealing $10,000 from Townsville business owner Andrew Ryder’s bank account and completely trashing his digital identity in March.

It all happened within 24 hours once Mr Ryder’s phone number was illegally transferred to another device.

“I’ve had a credit line opened against my name [and] I’ve lost access to my email accounts, my Google account and my Facebook account,” Mr Ryder said.

“The money was from my rainy-day account, so I consider myself fortunate there, but my digital identity has been completely trashed.”

Mr Ryder, who is also an army veteran, was a victim of a popular method of fraud via phone porting and SIM-swapping.

Impersonating customers

Phone porting is a legitimate practice people use to move a phone number from one telecommunication provider to another.

But if fraudsters have enough information, they can contact another telco, set up an account in a person’s name, and ask to transfer their number.

SIM-swap fraud occurs when a person contacts a provider and asks to activate a new SIM-card with their number.

Both methods were used by the criminal who began targeting Mr Ryder on March 19.

He received a text from his provider Optus, which read that the telco was processing his request to move his phone number to a new SIM-card.

“I called Optus, they wanted me to identify myself on the phone and I’m thinking I’m not sure if I’m talking to the scammers or Optus at this stage,” Mr Ryder said.

Quick work

Before he could make it into his local Optus branch to speak with staff face to face, his phone lost service, indicating the number had been moved to another SIM.

“I contacted my banks and asked them to shut my account and they investigated it and said there appears to be $10,000 taken out,” Mr Ryder said.

The fraudster had called the bank impersonating Mr Ryder and, using his phone number, repeated a security code the bank sent via text message.

The bank did ask the person what Mr Ryder did in the army, a spontaneous question, which took 20 seconds for the person on the phone to answer.

“That’s easily found online. You just have to Google my name and that information comes up so that should have been an alarm for them, but it wasn’t.”

The bank, which Mr Ryder asked not be named to protect his personal information, initially told him he may not be repaid the $10,000.

However, the bank did agree to reimburse the money after questions were raised by the ABC.

“We have reimbursed Mr Ryder and reassured him that we have taken appropriate steps to ensure his funds are not at risk,” a spokesperson said.

Optus said it had protections to prevent SIM-swap and phone porting fraud, but it occurred when passwords and personal information had been stolen.

“Our customer care experts acted quickly when made aware of this issue and the customer has now regained control of their mobile number,” a spokesperson said.

Rules working

Mr Ryder’s phone number was illegally ported despite new rules requiring telcos to use multifactor ID authentication, which came into effect in mid-2020.

An Australian Communications and Media Authority spokesperson said data from government sources indicated that mobile porting fraud had dropped by 95 per cent because of the new rules.

“There is no indication these types of scams are rising, however, in some cases scammers may still be able to defraud someone where they have stolen a person’s identity,” the spokesperson said.

Mr Ryder is unsure what personal information the fraudsters had before they compromised his phone number.

“I’ve had to reassess my whole concept of what information I keep online,” he said.

He said he would like to minimise his digital footprint, but social media was how most of his customers contacted him to obtain their boat and jet ski licensing.

“I’m just trying to get secure so I can lay down at night not thinking I’m going to wake up with no money in my account,” Mr Ryder said.

Bank statements indicate that Mr Ryder’s phone number was ported from Optus to ETEL, a small provider in Sydney that used the Optus network.

ETEL said it sent a unique verification code via SMS to ensure the customer seeking to port their phone number was in possession of the device.

“The person initiating the port would require direct access to a SIM card with that phone number already on it,” a spokesperson said.

“For someone to gain access to the SIM, the handset would have to be stolen or someone may have done a SIM swap at the original provider.”

The Telecommunications Industry Ombudsman said it encouraged telcos to remain vigilant to the rising threat of fraud and scams.