Fraudsters Ordered on my Account, How without the OTP??

[MLouise18]

This afternoon I received a one time passcode, which was ignored as I was in a meeting. 20 minutes later I received emails stating that I’ve placed an order for a iPhone 16 Pro. 

I called O2 straight away and they said that they’d lock my account and make sure that the order wouldn’t be shipped.

A couple of hours pass and to my surprise I get another text with an OTP, which makes no sense if my account has been locked. I again called O2 and explained and their response was don’t worry about it 🤯

I’ve also looked at the tracking number and it shows that it’ll be delivered tomorrow, so clearly the fraud team were lying.

I ended up calling DHL and the best they could do was delay the delivery to hopefully give O2 time to actually pull their finger out and sort it. 

So my question is how have these scammers managed to order a phone and change the delivery address when I never gave out the OTP code?

[Oxonian]

A warm welcome @MLouise18 to this O2 customer to customer community. This might interest you :-

Fraud : Alive and Kicking! - O2 Community

https://community.o2.co.uk/t5/Discussions-Feedback/Fraud-Alive-and-Kicking/td-p/1780240

[madasaf1sh]

@MLouise18 

Sounds like a MITM attack, I would check your phone for any dodgy apps, as that could be the source, if using an Android Device there is an way to get to SMS without needing to be near your phone if you have ever setup Google messages for Web, I would start by securing any google cloud services if you have them enabled.

[MI5]

@MLouise18 

If you’ve been the victim of fraud , there are things you can do:

Contact your bank if you think they have accessed your financial information. They can help protect your account and stop transactions.

Change your account and online account passwords. Not just your O2 account. All of them.

Forward fraudulent texts to O2 for free on 7726.

Contact Action Fraud on 0300 123 2040.

Call your Virgin Media or O2 customer services number if you think somebody’s taken out a contract using your details.

Virgin Media customers can phone 150 from their landline or 0345 454 1111 from any other phone.

O2 customers can call 202 from their O2 phone or 0344 809 0202 from any other phone.

You can block the number that called you, or any number you think may be suspicious.

How to block a number:

https://www.samsung.com/us/support/answer/ANS00062352/

https://support.apple.com/en-us/HT201229

There are also these links to look at:

https://www.o2.co.uk/help/safety-and-security/phishing-and-smishing-advice

https://www.o2.co.uk/help/safety-and-security/unwanted-calls-and-messages

https://www.actionfraud.police.uk/