Optus customer in $10,000 fraud attack forced to leave telco altogether after second breach

Andrew Ryder says he is changing his phone numbers after being targeted by scammers. (ABC North Queensland: Chloe Chomicki)

Townsville business owner Andrew Ryder says he is ditching his personal number, work number and phone provider after his Optus account was hacked for the second time in weeks.

Mr Ryder said he had been replacing his driver licence, Medicare card and changing bank accounts in the wake of last month’s initial $10,000 loss.

“Then I get an SMS suggesting that my details in my Optus account have been altered,” Mr Ryder said.

He said the first attack came after a scammer contacted Optus impersonating him.

They then illegally moved his phone number to a new SIM card.

Once they had control of his phone number, they used it to steal $10,000 from his bank, which texted a security code to verify his identify.

Mr Ryder said Optus spent six days helping him recover the stolen phone number.

But after it was returned to him, the fraudsters somehow still had access and again changed the contact number attached to his account on April 7.

Mr Ryder, who is also an army veteran, said he was dumbfounded the fraudsters were let in again.

“I obviously had changed the password,” he said.

“It was a completely obscure number and I have now subsequently changed it since the second breach.”

Fraudsters probably retained access

Mr Ryder said staff at Optus told him that because the fraudsters had access to his phone number when he changed his password, they may have maintained access all along.

An Optus spokesperson said the telco informed Mr Ryder of ways it could protect his account, such as changing his phone number and account number as well as adding him to a “hot list”, which would require him to attend an Optus branch with photo ID for any orders.

Mr Ryder said he was initially reluctant to change his phone number as it had long been associated with his jet ski and boat licensing business.

“It is on signage, it is on advertising material and yes, all of that would have to get changed,” he said.

But he said the fresh breach was the tipping point to change his personal number, business number and leave Optus altogether.

“I lay awake at night thinking about it,” he said.

“I’d had a thought that perhaps they have even redirected my mail because things had taken quite a long time to get here.

“My phone lost service yesterday and I immediately suspected further fraud, but it was a technical issue — but straightaway that is where my mind goes.”

Costly fallout

The $10,000 initially taken from Mr Ryder’s bank account was reimbursed by his financial institution but he said changing the branding of his business and further security measures would be costly.

“I’ve gone and bought extra security for all of my devices, and I’ve had those devices professionally cleaned,” he said.

“I’ve purchased a program that searches the dark web to see if more information has been released there — we’re talking in the thousands of dollars.”

Optus said it would continue to work with Mr Ryder and encouraged all customers to be vigilant about personal information.

“Regularly change passwords, [do] not re-use passwords between multiple accounts and be wary of sharing personal details and identity documents,” a spokesperson said.

Mr Ryder said he would lodge a complaint with the Telecommunications Industry Ombudsman.