Phone Security

[AnnS52]

At the beginning of September, three texts with an OTP, were sent to my phone from our bank. As this is a joint account, I thought nothing about it until we discovered just over a month later that money had been taken. My question is: How can somebody access my messages to obtain the OPD ?

I contacted O2 today and asked them the same question, their answer was, I cannot comment on that.

Ant help would be appreciated.

[TallTrees]

Hi @AnnS52 

Welcome to the o2 Community Forum.

Very sorry to hear that you have had money taken  

This is a guide we have here at the Community regarding scams maybe 

it would be worth a read through.

Guide: A Guide to Deal with Spam/Scam Calls and Text 

Guide: Have you fallen for or been conned into a premium rate scam? What to do next 

Best wishes 

[MI5 · Accepted solution]

SMS messages are secure and can only be received by the number registered to the account in question.

There are sim swap scams that could steal your number but that would mean your sim would no longer work.

In short, the person who took the money was most likely either the joint account holder or someone who had access to one of your phones at the time.

[madasaf1sh]

@AnnS52 

Have you spoken to your bank, as people can't access messages sent to your phone without having access to it. 

If you get messages you aren't expecting then you should always contact the institution immediately and tell them.

It is a well know fact that OTP's are insecure and banks have been told NOT to use them.. 

What have your bank said to you?  I would be asking then to prove what IP used the messages, or where they where used...

As I imagine they have got past security at your bank by other means such as saying they hadn't received any of them and getting the poor person on the phone to agree and then process the transaction...

The reason that o2 CS answer like that is that they wont understand the question....

[AnnS52]

Thank you for your replies. I am just trying to understand how the OTP codes could have been accessed, as one of these was used to change my phone number on the account. We have received a full refund of the money taken and the bank refuses to give us further details. 
To be honest I feel that, both the bank and my partner, are both blaming me. Accusing me of passing information on and leaving my phone lying around, neither of which is true. I agree with you saying that possibly they contacted the bank to say they were locked out of the account but they would have needed to answer security questions.

[madasaf1sh]

@AnnS52 

It sounds like your bank are culpable as they are been very coy on been open and honest, and it doesn't sound like you are at fault. 

It sounds like they have used coercion of a bank employee to make changes, and / or you are a victim of identity fraud, as it can be very easy to get a lot of information about people from social media and piece together names, addresses etc...