Paula, Mariana and Antonio, Maria Fernandes. All have received messages from WhatsApp as if they were from their children. The formula is almost the same in all and there have always been requests to transfer money. High values. Experts say that anyone can be tricked. The most important thing is to be vigilant and never pay without confirmation.
“Everything made sense. I really thought it was my son”. Paula is one of the many victims of the “Hello Mom/Hello Dad” scam. In her case, she was actually tricked into sending money. She filed a complaint with the judicial police, but she will probably never get the money back. The scam known as “Hello Mom/Hello Dad” continues to claim victims and has been on the rise again in recent weeks. In addition to parents, elderly people receive “Hello Grandpa/Grandma” and others receive “Hello Sis.” For those who complain, authorities admit that there have been many, many reports. When the scam first appeared, the amounts were more limited, but now they reach thousands of euros.
TVI/CNN Portugal spoke with victims and a cybersecurity specialist about the formula these scammers use to find victims and others.
The first message arrived on December 29. “Hi mom, keep my new contact ok, I’m letting you know that I changed my cell phone 😘. Are you ok?”. Paula’s son lives abroad, is an adult and independent. Changing phone numbers is not an impossible thing to do. She asked him if he was okay, and at first it seemed like a conversation between mother and son. Half an hour later, the call for help came. He could not make a transfer “because the bank was from abroad” and needed help. It was 1,879 euros and he asked, “Do you have it? He sent a NIB and the name of the account holder. By coincidence, the first name was the same as the son of a friend she knew. “It all made sense. I really thought it was my son.
And when the “alleged son” asked for an “immediate transfer,” the friend thought she was in serious trouble. She didn’t have all the money in one account and made two transfers. “The first one was 1,000 and immediate. The second one I didn’t have that option and did it normally.” She was able to recover that second tranche a few hours later.
In a Whastapp group she shares with her sister and son, she warned them that her number had changed. “And then my son says, ‘No,’ that he didn’t change his number. Don’t say that and don’t play games with me,'” Paula replied. “Then who did I send the money to?” I asked. Only then do you know what happened and try to get the money back. She was only able to get one.
The next day she went to the judicial police. They told her that there were many, many complaints and that she was not the only one who had been cheated. They gave her worse examples: someone had transferred 6,000 euros to a “daughter”. They told her that they called the scam “Dear Mom, Dear Dad”. About the bank accounts to which the money was transferred, they said they were “stepping stone accounts. Money came in and went out. And there were some account holders who had nothing to do with the scam and didn’t even report the activity.
For now, he is waiting for the trial to unfold. But the next day, the “alleged son” started talking again, asking for help with another payment. This time it was a different name and a different account.
He wanted a picture to prove it.
Mariana and Antonio have a son who is almost 30 years old. They both received messages a few days apart. On January 23, it was Antonio: “Hi Dad, my cell phone has display problems, I have this temporary number until I solve the problem with the other one!
Antonio had heard about these messages and wanted to see how far the conversation had gone. A few minutes later, the request: “Dad, I have to make an important immediate payment today, but the passport for the application is on the other phone.
He gave the account number and the amount: “2,500€”.
The person at the other end of the phone was insistent in his request and even tried to make a voice call. He wanted “a photo as proof”. But the picture Antonio sent was different.
On January 27, it was Mariana’s turn. “Hi Mom, I lost my phone and this is my new number until tomorrow at 6 pm”. She didn’t even answer right away, she told TVI/CNN Portugal. A few days later, she asked “who I was talking to,” but got no answer.
But they both realized that the account to which they were supposed to transfer the requested money was in the same bank where they had their own account. The bank was alerted. They gave NIB the details of the account they had received in the fraud attempt and, after insisting, the bank finally launched an alert in the application to all customers.
Mariana and António also tell TVI/CNN Portugal that an elderly friend, old enough to be a grandfather, also received a message. This one said, “Hello Grandpa,” but in fact he had no grandchildren.
“This is my new number”
On January 1, early in the evening, Maria Fernandes, 73, received a message on WhastApp: “Mom, note the number (xxxxxxx), this is my new number.” She automatically registered the number as her daughter’s new number. And she didn’t think about it. A few minutes later, she received another message: “Mom, are you busy?
“Yes, I’m sitting on the couch,’ I replied to the person I thought was my daughter,” Maria Fernandes told TVI/CNN Portugal. It wasn’t long before a request came: “Could you go to the ATM and pay a bill I have to pay? Could you do that?”. Maria Fernandes replied, “Yes. She was given a name, a NIB and the amount: “950 euros”. “You will pay and send the receipt so I know you have already paid,” said the next message.
Faced with that higher value, Maria Fernandes became suspicious and called her daughter. A daughter already in her 50s. Or rather, she called the number she had saved as her daughter’s new number. No one answered. She called a friend with whom her daughter was staying with, and soon spoke to the daughter herself. She realized that they were trying to trick her.
They insisted several times. “Have you paid? I still don’t send the receipt”. Fed up with the situation she replied: “I’ll send you an m****”.
That night she called the police and the next day she filed a complaint. At the police station the first thing they told her was that now there are many cases like this and the second was that they would not be able to find out who had done it. But with a clear conscience, Maria Fernandes says that she did what she thought she had to do.
But where are they going to look for the victims’ details?
The first news about the “Hello Mom/Hello Dad” scam appeared in October last year and since then it hasn’t been in the news again. But the scam is not over and is back in full force, with slightly different contours. The victims are not only parents with high school age children, but also victims with adult children, completely independent, who almost fall into the trap.
“All of a sudden, we start seeing denunciations on the Internet again,” Nuno Mateus Coelho, a university professor with a doctorate in cybersecurity, tells TVI/CNN Portugal. But in fact, you only have to look around. “Recently, a colleague of mine, a professor, a university professor, very well informed, was about to send money to one of her daughters. But she stopped for a while and started asking questions,” she says. That’s when she realized it was a scam.
“It happens a lot. I have colleagues who call me to ask what they can do because they sent 100, 150, 200 euros to a son or a friend. And the reasons are very different: “They couldn’t do it, their phone battery died, they didn’t have a card, they couldn’t use MBWay”. For this specialist, any person, regardless of age and profession, can fall for these scams.
But where do they look for the victims’ data? “On the dark web. There’s a lot of free data, so they don’t have to make a big investment,” he explains. One of the biggest problems is “the ‘dumps,’ the leaks of information from social networks.” “Facebook lost 1.5 billion accounts, LinkedIn lost 500 million accounts,” the cybersecurity professor illustrates. Officially, on Facebook, 533 million users had their information compromised, but hackers have put up for sale 1.5 billion accounts of this social network that they allegedly obtained through “scans” and scrapers. And there are “names, occupations, contacts, emails, birth dates”. With a simple Excel, you can separate the victims by gender: men and women.
Opening a bank account is also not a problem, as there are many identity cards for sale on Darkweb. Or, in other situations, the owner of the bank account is a “mule” and “keeps” part of the money.
The speed at which money circulates is impressive: dozens of accounts in just one hour. And the formula can also be learned on the dark web, “there are hackers who give courses,” explains Nuno Mateus Coelho. And this is another issue that should be addressed: the responsibility of banks. “Nobody can convince me that there isn’t a computer system that doesn’t detect a transfer in 25 accounts within an hour,” he laments.
There are situations where even if the victim tries to recover the money “which is still in the possession of the bank, he can’t, the money is sent to the criminal and he is left without it”. “By excluding yourself and not ruling in favor of the weak, you are siding with the criminal,” he argues.
“If this were in the United States, you would move the next day. There, if you fall or trip over something, you sue for a million euros. Imagine a U.S. account holder who makes a $5,000 transfer, the bank is notified that it’s a scam, and they transfer it to the criminal anyway. The bank has been dishonored,” the professor concludes.
Although it is difficult to find the perpetrators of these scams, it is important that they are reported, even by those who do not send money. This can be done at the GNR, the PSP and the Polícia Judiciária.
Recently, for example, in mid-January, the PSP of Braga published a specific warning on its Facebook page about this scam. Something they do whenever they notice an increase in complaints and as a form of prevention.
TVI/CNN Portugal requested data from the GNR, PSP and Polícia Judiciária (Judicial Police) on the number of complaints about the “Olá mãe / Olá pai” scam and a possible increase in cases in recent weeks.
This Tuesday is the European Safer Internet Day, an initiative of the INSAFE network with the support of the European Commission, which aims to contribute to the consolidation of a safer internet for all. The PSP has chosen this day to launch an awareness campaign and highlight this “Hello Dad/Hello Mom” scam.
And publishes data that give us an idea of the reality: “From January 2022 to January 10 this year, the PSP received 1244 reports of this type of scam, including 1205 since October 1. This corresponds to an average of 10 reports per day and about 300 per month, with a total value of fraud of more than one million euros.
Also, according to information released by the PSP, “the reported incidents are recorded throughout the country, with particular incidence in urban areas of higher population density. The initial contact, always by written message, is followed by a conversation that can last for hours, with informal content and records of daily life, in order to assess the close relationship between the potential victim and his descendant.
To prevent the fraud, the PSP advises
“Do not send money without at least being able to speak loudly and recognize the person you think you are talking to;
– Thwart possible fraud attempts by asking simple questions that your family member should know (what are their birthdays, what course and university they are attending or have attended, what is the license plate number of the family car, etc.)”.
The GNR confirmed the existence of these scams, but did not provide any concrete data. “The described frauds do not have an autonomous statistical classification and can be computerized as other frauds or computer and communication frauds, and it is not possible through the GNR computer system to specifically disaggregate this type of fraud. However, the Guard confirms the existence of scams using the described method, as well as other methods of fraud using the MB Way platform”.
But until almost the end of October 2022, the GNR had already detected about 25 cases related to this scam. Three months later, the number will certainly be higher.
The Polícia Judiciária (Judicial Police) did not respond to the request for data until the publication of this article. But still regarding the Judiciary Police, in October they reported the identification and arrest of a foreign citizen, 25 years old, as a suspected perpetrator of this type of fraud. And, at that time, they “reinforced the warnings”, assuming that there was “an increasing number of reports of this type of fraud”.