Money lost because OTP code was stolen

By the time people enter their OTP code into the screen as requested on the fake website link, the scammer has completed the fraudulent transaction, while the account owner still thinks he is making a transaction to receive money from abroad.

After waking up one night, Ms. HTNH was shocked to see a notification that there were 7 money transfer transactions from her account at Vietcombank to several intermediary accounts at other banks, with a total amount of up to 500 million VND. The important thing is that Ms. H. did not receive a text message containing an OTP (One Time Password) code to authenticate the transaction, but the money in her account was still evaporated.

Upon receiving Ms. H.'s report, Vietcombank has retained 300 million VND that has not yet been transferred out of the system, while the remaining 200 million VND has been withdrawn through an ATM in Malaysia.

Many methods of OTP hijacking

According to the information provided by the victim, Ms. H. had previously accessed a fake bank website and accidentally provided her account name, Internet Banking password, and OTP code so that the scammer could activate Smart OTP (software that allows users to proactively obtain OTP authentication codes for transactions) on another mobile device. From there, the scammer illegally withdrew money from her account.

This incident is one of the recent cases of loss of money in accounts due to stolen OTP. Through working with the victims, the police identified a number of criminal methods used to steal OTP codes.

For example, these subjects impersonate bank employees to call or text the account owner to notify that money, gifts, promotions, etc. have been transferred into the account; or use social networks, emails, and text messages impersonating electronic banks to notify that the account owner's E-banking account has been illegally hacked and ask the account owner to provide login information and OTP code. After obtaining the OTP code, criminals transfer money from the victim's account to another account to withdraw and appropriate.

Another method is for scammers to create fake Facebook pages of relatives and friends, then ask their "prey" to receive money sent through foreign money transfers. If people access the fake international money transfer website provided by the scammer and enter their username and password, they will inadvertently provide information for criminals to initiate money transfers on the bank's website.

By the time people enter their OTP code into the screen as requested on the fake website link, the scammer has completed the fraudulent transaction, while the account owner still thinks he is making a transaction to receive money from abroad.

Be careful when trading online

From cases of account owners losing money due to stolen OTP codes, Ho Chi Minh City Police asked people to increase their vigilance against this type of crime.

To avoid accidentally becoming victims, people should not open accounts and register for e-banking services for others to use; not disclose login names, access passwords, PIN codes of any e-banking services, OTP codes, service activation codes to anyone via phone, email, social networks, applications; not access strange website links and be careful with emails, messages, calls announcing winning prizes, receiving money, warnings about accounts being suspected of being illegally accessed with requests to provide personal information, service access information...

At the same time, people should not use their username and password to access electronic banking services as passwords to access systems other than the bank.

In addition, during use, account holders should register to use the SMS Banking service at the same time to receive messages notifying balance changes when there are transactions on the account, in order to minimize risks and losses. When receiving an OTP message, account holders need to carefully check the message content (usually including: transaction type, transaction amount, transaction channel). If the message content does not match the transaction being performed by the account holder, absolutely do not enter this OTP code on any website, nor disclose it to anyone in any form.

It is especially important to note that after discovering that you have just accessed a suspected fake website link, or accidentally responded to a stranger's phone call, the account holder must immediately change the password to access online banking services, Mobile Banking. When facing information technology crimes, taking good preventive steps is never redundant.

According to Saigon Giai Phong Newspaper