Something drasticaly wrong has screwed up my account

[Miphla]

On Wednesday I contacted O2 to discuss my account which has two phones and was advised the tariff would be £18.33 for each but was discounted by 40% to give a charge of £10.99 each.

I was then informed I would receive a gift and chose an Android Watch on Thursday.

However on Thursday I received an i-phone, and was contacted to be told of the error and I should return the phone using the bar code that would be included in an e-mail, which I did.

Today I had a postman arrived with a label for me to attach to the return item, he wasn't surprised when I told him it was sent back the previous day.

I have today logged on to my account and found reference to my PURCHASE of an android phone which I haven't done

Can you please advise me of what has happened as soon as possible?

[pgn]

Contact O2 immediately, it seems you have fallen for a scam, @Miphla 

Guide: A Guide to Deal with Spam/Scam Calls and Text 

Guide: Have you fallen for or been conned into a premium rate scam? What to do next 

You may need to contact your bank and/or credit card firm to confirm your accounts are intact - and to change your security details and passwords on all. Good luck!

[jonsie]

Complete scam and I find it deplorable that our details are shared with scammers without any redress to the complete lack of security required legally

Too many untrustworthy partners

And one of the many repercussions of outsourcing customer service 

[Enlli]

@jonsie Phoned me today. Started usual 40% off (I'm £8 pm Sim Only!) We have sent you a code etc.

Told them it was their unlucky day as they had got through to the International Temple of Satan and they had just been consigned to the lowest deaths of hell.. call dropped!

Not had the same problem with an EE or Vodafone account. And asking family none them either.

O2 seems to be the target. My banks and credit card have ditched OTP. Time O2 rethought it's security.

[jonsie]

I completely agree! 

Apathy prevails with O2 and most of their employees these days

I'm afraid that any faith in O2 and my personal security data vanished a long time ago

[madasaf1sh]

Was talking about this at work, and it does seem to be a lot of social engineering attacks going on against o2 at the moment, and some of these as I have said in the past are all about persuading people to give over the OTP, as soon as this happens the caller has the keys to all your personal data, including name and address, DOB everything, to do with your o2 account...  

And that is what scammers prey on, people been gullible  and sorry to say stupid enough to agree to these things.

The biggest thing o2 and others can do is educate customers, and tell them not to accept any calls that ask for the OTP or offer a stupid discount, and free gifts.

It wont be long till they move onto EE and Vodafone wholesale, 

Totally agree about the MFA with o2 and many organisations that OTP's are insecure and the fact the FCA have told banks and other financial institutions to stop using text based services.. Wish o2 would use Authenticator Apps, or Certificate and Authenticator Apps... or let me choose how to secure my account, and to be fair Virgins Account pages are even worse for security...

The other thing to note, people do not secure things like Facebook, Twitter and other sites that have lots of material for social engineering attacks and just put them behind a simple password, or let the world see them... 

[pgn]

In this instance, the original post said "I contacted O2" - people using either a stored, and incorrect, number for O2 in browser or address book, or picking the first number returned in a Google search that is not genuine?

eg: 

In this example, genuine, but not offered from O2's website - people need to be savvy enough to cross-check!

I have made a similar mistake when paying car tax online, thankfully nothing bad came of it, even if I thought the web site, which had a similar look and feel to the real DVA site, did not normally ask for credit card details first before vehicle details... Trying to do things in a hurry in that case was my undoing.

[Enlli]

Not sure how they got to send me an OTP. OK, so they could find my number was issued by O2 18 months ago. But I have never given out that number anywhere even family and friends. It is used mainly for data.

Now the only place that number is associated with my email address is O2.

Technically they should not know me from Adam

[madasaf1sh]

@Enlli 

Quite easy to be honest.. 

Publicly Available Data from OFCOM 

Spreadsheet

VPN Connection to get a UK IP

Human in India gets given a cut of the spreadsheet, makes a a call from spreadsheet via autodialer with spoofed number , as soon as you answer CTRL+C and then CTRL+V into o2 website for forgotten details,  then bish bash, OTP Sent, they only have to rely on the person on the end of the phone to be stupid enough to give over the OTP, and ignore the warnings...

And they are in..