Scam calls to Tunisia

[jimk]

Well that was interesting... On looking at my latest bill in MyO2 I got a nasty shock, seeing a whole string of outbound calls to a range of different but similar-looking numbers in Tunisia:  about two every night, at variable times, for variable lengths of time, averaging about £3 per call... adding up to £200 ish.

I'm as sure as I can be that the phone itself is not sitting there calling Tunisia every night (I have BitDefender installed against malware, and nothing in the Android outbound call logs, and it does tend to switch itself off at night) - more likely something weird is happening at the level of the O2 account?

I spoke to an O2 customer service guy today who was very helpful - he stuck a zero spending limit on the account (I never want to phone internationally anyway) - and said that they will work to cancel / refund these charges - but all the same - is there more I should be doing here? 

I'm not sure how my O2 account is secured at this level, and how someone could be doing this, nor what their pay-off would be.

As an extra passing thought - I initially ignored the warning "You've spent more than usual on your mobile" emails from O2 because they are quite oddly written and formatted, and look very much like fake spam-scam emails themselves.  Someone in the O2 comms department presumably thought it would be a good idea to use weird infantile language like "When we sent this email, all this information was right. Things might have changed since."  Turned out they were authentic after all..!

[TallTrees]

Hey @jimk 

Welcome to the o2 Community Forum

Have a read through these guides ~ may be of some help

Guide: A Guide to Deal with Spam/Scam Calls and Text 

Guide: Have you fallen for or been conned into a premium rate scam? What to do next 

Sorry to hear of the scam.

You should be able to get all your money refunded @Payforit_Sucks 

are really good for help if needed.

Bye and good luck best wishes

[Payforit_Sucks]

@jimk 

This doesn't sound like the usual type of premium rate scam. You say that you have been charged for outgoing calls which you never made. I'm disappointed that O2 have so far failed to investigate this. As you say, it looks to be a problem with O2's billing system. 

You need to get a clear answer from O2 as to whether they believe you made the disputed calls. If they insist that you did, they will almost certainly insist on charging you for them! Issues like this are exceedingly rare, but check your phone for malware just in case.

You've done all the right things so far - let's hope that O2 are able to explain what happened. It is disconcerting when something like this happens.

It's always worth turning off premium rate charges unless you really need to use these services, and putting a cap on any "out of bundle" charges such as international calls.

The problem with the warning text messages you received is that we have become so used to spam texts that we no longer trust them. Any message sent by O2 should be taken seriously, but bear in mind that it is possible to "spoof" the identity of the sender of such texts.

Good luck with resolving this.

Paul

[jimk]

Many thanks for the replies, Paul and TallTrees.

So far I had a verbal response from the O2 service agent saying it was "very unlikely, to be honest" that the calls were initiated from my actual phone, but he was going to pass the case on to his manager to see about a refund. So it's just been a couple of hours, to be fair to them.

I have BitDefender on the phone running an automated daily scan against malware, and it's showing clean.  In fact, looking at some of the dates/times of the supposed calls to Tunisia, the phone would have been here on my desk right beside my elbow... It actually stretches anybody's powers of argument that I would have been making a string of 1-minute calls to disparate numbers in Tunisia (never the same number twice), about 3 to 5 per day.

22 Oct 21 - 23:28 - 0021625169865 - 2m 47s - £6.958

23 Oct 21 - 02:18 - 0021627092582 - 1m - £2.500

23 Oct 21 - 02:25 - 0021652001892 - 21s - £2.500

(and so it goes on....)

But as you say it's unusual if this is a hack to the O2 billing system... presumably some other phone somewhere else could be using my O2 account to make premium rate calls, with the pay-off at the receiving end?  I'm not 100% sure if I'm responsible for holding any security credentials on that O2 account (if I did, it would be different from the MyO2 username and password, I guess...)

Will report back here if I get some kind of resolution to this.  Since I now have the zero spend-cap on the account I expect them to stop - though it feels like a poor solution if you have to cripple your own account in order to secure it... I can't now phone abroad if I had wanted to, for any rare reason.

I didn't actually receive any overspend warnings text messages from O2 at all - they were emails with a clickable link in them (which I mistrust by instinct).

Thanks again folks - will report back.

[madasaf1sh]

@jimk 

What phone do you have?

Have you installed anything recently on your phone? or has an app updated and requested new permissions. 

As this looks like an App is trying to send a GUID back to a server and the phone is interpreting it as a phone number... 

Bare in mind Bitdefender is only as good its antimalware engine and heuristics... 

It wont be a hack to o2 billing system (you have watched too many rubbish hacker films 🙂 ) and for that someone would have to have financial incentive to do so, and call charges go to o2, so I cant see why people would do this. 

Do you have another phone to put the sim card in and leave over night to see if anything is attempted?

You can't replicate SIM's as the sim and phone number after match on the HLR to authenticate...

[jimk]

Hi madasaf1sh

That's a really interesting hypothesis - I can see how a Guid might explain the fact that the outbound number is different every time (though not the consistent first 5 numbers... maybe some other auto-code, not a Guid?).  It's also odd though that none of these supposed outbound calls show up in the call history of the phone app... if the phone were jumping in and actually calling, then would the phone app call history show that?  Maybe not, if I were not calling manually via the actual phone app...
Maybe some other log file on the device might register that call though.

Since I now expect the call charges to stop, the best I can do is look back through the install history of any apps to see if I installed anything on the same date that the charges started... there will probably be a way of getting at a log that shows you that.

To my shame, it's an old and very cheap phone - the cheapest I could get on Amazon - Ulefone S8 (I think, from memory) because I really don't care about phones sufficiently to spend real money on one (other than pretty much having to have one for daily life these days, e.g. for 2-factor auth to various services).  I only keep a minimalist data service from O2 and typically just pay about £10 per month for the very little use I ever make of it.  Sometimes I even do very retro things like actually talking to people on it - but not in Tunisia  

Many thanks - jim
PS - I never watch rubbish hacker films...  Bergman and Tarkovsky more my style   

[TallTrees]

Hi @jimk 

Thank you and you are welcome. 

True you have to put on bars to stop scams etc. to keep an account reasonably secure which is quite ridiculous. 

Good luck and best wishes