SCAM OR NO SCAM?

[Anonymous]

Hi .Couple of days ago my wife received a text from o2,saying "Hi Teresa we're having trouble validating your account details.Click below to avoid services being suspended. This immediately got the alarm bells ringing.So i went on line to check it out,and was taken to the "o2 website"The first page required name ,address,DOB etc,fine so far,however the second page asked me for credit card details,it was then that alarm bells were really clanging and the red flags waving furiously.It was too late in the day to call the call centre,so i called 4445 this morning but was quite appalled at the response.The agent said it sounds like a scam to me,i then asked if she recognised the the web address but did not get any coherent answer,all she said was that myo2 would not send out texts like this.I then asked here to check if there was anything flagged up against my account,but she said she did not have access.I did have two concerns,but that has risen to three.No1was the attitude of the agent.No2 If this is in fact a scam how the hell did the scammers get my wifes name?My only conclusion is that the o2 database has been compromised.No.3 Why the hell isn't there an email address for anyone to complain?

[madasaf1sh]

1. Yes this is a phishing attack
2. Has your wife used her o2 number on any other website, such as yahoo or talk talk
3, The agents reaction is a bit poor but they arent going to know every URL that o2 uses for its services.

Looks like the phishers have been successful, as they now have your wifes mobile number and personal data, i would recommend , immediatley changing any of your online passwords, as your personal data is now comprimised.

This isnt neccessarily a data breach at o2, as if your mobile number is used to register for online banking, any other alerting, facebook alerts, or is put in facebook, it would take a phisher 10 minutes at the most to work out your network and engineer an attack.

[MI5]

Recent post here https://community.o2.co.uk/t5/Pay-Monthly-and-Pay-Go/Unable-to-verify-payment-method/m-p/1035010#U10... plus a few others on forum.
Quite common unfortunately.

[jonsie]

These scams are getting more devious and ingenious. ...and unfortunately they come thick and fast these days.

[Anonymous]

Thanks for the extremely swift reply,but i can confirm that the phone is used onlly to make and receive calls.We do not have a data allowance,and wifi is always turned off,and i have just checked to be sure,and it is turned off.This must therefore be an o2 problem......John

[Toby]

Hi @Anonymous,

Sorry to hear about this! I have reported the site and its links to the rest of the team to investigate where it originates. I have removed them from your post too, just to be safe.

Please give us a another call about this today and report the issue. PM me any time if you struggle.

[madasaf1sh]

They are indeed, and its not that difficult to engineer and attack vector.

To do one to o2, i can think of a number of sources for mobile numbers, the ofcom spreadsheets of 07 numbers which link the first 5 numbers to the network... so in 10minutes you have the start of the attack

[viridis]

And how do they get the customers name?

[Anonymous]

Thanks to all of you who have taken the time to reply to my post.After reading all of them i have come to the following conclusions.Just to reiterrate the phone is used for calls only,the wifi is permanently switched off.Scenario 1.The o2 database has been compromised,but i think this is doubtful as it would have been all over the variuos media outlets if it had.Scenario 2.This is an inside job where an employee or employees are selling lists of numbers or names to the scammers.Scenario 3.The same as 2,but this time from an external agency that for some reason holds these lists.My money is on no.2.I have also reported this incident to o2 via @phishingo2.com,but have not even had any kind of acknowledgement from them.Do they take this kind of thing seriously?My next port of call is my MP  

[MI5]

@Toby also feeds back any reports on here and they are all investigated.
There are no guarantees that you will get any personal feedback from the reports though.