About 1 week ago, I became a scam victim. I had thought that I was doing everything to keep myself safe from such a thing happening to me but, I was wrong.
Let’s consider why I believed that. I had my privacy respecting fairphone 5, I use a vpn, most of the time. I use cash wherever possible. I do any financial on line transactions on a linux laptop where I have multiple users set up, and each online account has it’s own user with standard permissions. I set up as few internet based accounts that require my personal information as possible. I use a secure browser. And I have a completely separate device for general browsing - also with a secure browser / vpn. I use email aliases exclusively when giving out my email address. I use secure, encrypted email and messaging. Some people might consider that my approach verges on paranoia. But, I have learnt a hard lesson - due to the extent of internet crime in the UK currently, even those of us who take many precautions should never believe they are invulnerable.
What initially put me in harms way, was I decided to change my mobile data provider for my phone. I was already using Giffgaff because I had purchased one of their sims for my 4G router when I cancelled my broadband contract. I had had no problems with them, and this is where I made my first mistake - I should have done some research before putting one of their sims in my phone but, I didn’t. If I had, I would have discovered that many of their customers are victims of sim swap scams. On their community board, there are numerous posts about this. If I had read these posts before migrating my phone over to them, it would have been a red flag and I almost certainly would not have gone ahead. But, I did.
However, one thing I didn’t do, which I am really glad about now, was move my existing phone number over to them. However, nothing untoward happened in the 2 or 3 days, and I had moved many of my contacts, and internet accounts over to the new GiffGaff number by the time I received an email from my bank that I was suspicious of. Due to me always turning off in my bank online settings, marketing, I never get annoying emails from them - so this was unusual. But, apart from that it looked completely authentic but, it did contain links. My bank admitted to me later that they do send out emails to customers containing links. They are one of the big 5 banks in the UK so, I think this is extremely bad practice.
At this point, I had recieved no incoming calls at all on my new number. I was worried about the email. I had recently started telephone banking with them so, I called the number that I usually use for that - the same as is on the back of my debit card. I immediately got a bad feeling about the ensuing conversation with the “bank employee” but, I knew I had called the correct number. At first, I believed I was talking to a member of the bank staff. And he assured me that he also had an account with this bank, had received the same email and clicked on the ‘Opt Out’ link. The problem was, I thought I was safe - with my secure browser, VPN etc. - so I did. But, A message popped up that I had never seen. I hoped that whatever I had clicked on had been blocked. But, after a few more minutes I was so concerned that I challenged the person I was speaking to. He was still encouraging me to click on the links in the email that I had received and I said that this would be exactly what a scammer would do. If he had been a genuine member of staff, he would not have done this. But, very strangely, he said nothing to try to reassure me that he was. Just ignored what I had said. The penny finally dropped and I terminated the call.
Of course, I felt really dumb. I had only ever heard of scam calls as being made by scammers. I didn’t realise that they could intercept a call in the way that had happened with me.
I called me bank again, this time using the 159 number which guarantees to divert your call to your bank. This time, I talked to a real member of staff who confirmed that the email that I had received was a scam. I also used a different phone from that moment onwards, different sim card, different network provider.
First, I had a undo everything I had done - change my phone numbers on all my accounts / contacts, cancel my bank payment card that I had used with GiffGaff and do my best to make everything safe again. Including cancelling my new giffgaff contract. I removed the sim card from my fairphone and put is in a dumb phone I had, while I was doing all of this, as I could not completely avoid getting a few security codes sent through to it, while I was changing everything back to my old number.
Once this was all done, I put my original sim card with my old number back in my fairphone - it could no longer detect the sim. I tried a sim card from a different phone - that wasn’t detected either. I thought that I had perhaps damaged the sim card slot with all the changing of sim cards so, I ordered a replacement part from Fairphone. But, when it fitted, the sim card was still not being detected. I checked the part in my husbands identical fairphone and it worked fine. I didn’t know how it had happened but, I realised that the scam had bricked my phone. It would only work on wifi. The phone no longer had an imei number - it had had it’s identity stolen or erased, somehow.
I did some further investigation and pieced together what I think must have happened. During the call with the scammer, It looks like the phone’s baseband Processor’s NVRAM had been corrupted by a signaling packet sent to my phone and bricked it when I ended the call. The scammer had employed an MITM attack on my phone to disable it. Perhaps to try to prevent me reporting to GiffGaff what had happened. My phone was purchased from Murena pre-installed and the OS was up to date - 3.7. I now know that this has happened to other fairphone users. But, truthfully, I was also very unlucky. I don’t know if clicking on the link downloaded the malware or if it was sent by the scammer, and there was nothing that I could have done to stop it. But, it is a security vulnerability and means that older fairphone users should be much more careful than I was, and probably not choose GiffGaff as their network provider.
I am not blaming Murena - they quite possibly knew nothing about this. I suspect that Fairphone did (and if they didn’t, they should have done). It also seems that the newer Fairphone 6 users may be safe from this as they have newer firmware. I blame myself for not listening to my gut instinct earlier in the call. But, most of all, I blame the perpetrator of this hack who deliberated destroyed my phone because he realised he would achieve nothing from the time he had wasted talking to me.
I reported my phone previously to Murena as initially I thought the phone mainboard had failed and as it is only 18 months old, I hoped that it might be replaced under warranty. But, now I will update them on what I have since discovered. I would be happy to send the phone mainboard to them, if they would like check it out further. If they don’t want that, I will just put it in a drawer for now. I am not really sure if I feel confident about using it, and am using my dumb phone for now.
I hope, that by telling you all my story, you might warn your friends and relatives about what happened to me. If that just saves one person from the experience that I have had, then it will have been worth it.