A BRIT expat nurse has revealed how a hacker took control of his mobile phone in a “simjacking” scam and stole his life savings totalling £19,000.
Mark Donnelly had just finished a shift at a hospital in Sydney, Australia, when he noticed his iPhone had lost signal and could not connect to the network.
2
It turned out a crook impersonating him had hijacked his device’s eSIM card and was then able to take over the banking apps linked to his number.
Before he knew anything was wrong, around $35,000 had been siphoned from his accounts and converted to untraceable Bitcoin.
Shockingly, the thief was also able to get hold of Mark’s immigration documents including his UK passport.
These were used in a failed attempt to open another bank account in his name.
Mark, 46, said he was “devastated” by the hack, and slammed phone company Optus for failing to stop it.
The hacker was able to pass security checks TWICE via an online messaging service, reports 9News.
Most read in News Tech
Mark’s ordeal began earlier this month when his phone suddenly went into “SOS only” mode and he contacted Optus to ask why.
He said they failed to call him back for two days, so he went to an Optus shop where an employee replaced the SIM card and got him back on the network.
Crucially, the worker did not check why the signal had been lost and so did not notice that someone else had activated an eSIM on another device, Mark claims.
Hours later, the hacker was then able to seize control of his number for a second time.
Chat logs show how the criminal demanded Optus reactivate the eSIM – a virtual SIM that does not require a physical card.
It was approved after the hacker passed security questions, possibly using personal data bought on the dark web such as his date of birth and address.
However, Mark says he was not told his number was being used on another device when he was cut off for the second time.
Instead, an Optus shop worker told him his phone must be broken and needed to be repaired by Apple.
‘Absolutely hellish’
It was only when he got a Facebook call through his laptop from his frantic partner that he found out he’d been hacked.
By then, three bank accounts had been emptied of $35,000 which was transferred to crypto exchange CoinJar.
The hacker also rinsed more cash by increasing the spending cap on his ZipPay account and trying to do the same for his Afterpay account.
And they got access through his phone to his IMMI immigration account, which contains various ID documents including his passport.
Mark fears these will now be sold on, making future hacks more likely.
He described dealing with Optus as “absolutely hellish”.
Mark added: “I’m devastated.
“I’ve completely lost my identity. Mark Donnelly is ruined.”
Luckily his banks have refunded most of the money he lost, but he spoke out to warn others of the dangers.
Optus offered Mark just $80 compensation.
The company said: “In the vast majority of instances, an individual’s personal information is often already compromised making it easier for fraudulent activity to occur.
“In this particular case, an individual posing as the customer was able to access the Optus profile and change the contact details for the account, and then proceed to activate a new prepaid plan using the customers personal information (which all matched what Optus had on file).”
It added it had “strengthened its processes” for SIM swap hacks.
Experts say criminals have recently turned to hijacking eSIMs after the previously lucrative “porting” scam was blocked by phone companies.
That involved requesting for a number to be ported to a new network, allowing fraudsters to take over a victim’s identity and raid bank accounts.
2
Cyber security company show how hackers could use your PRINTER to access your Gmail in new cyber security threat
