This incident highlights the growing threat of SIM-swapping fraud, questions 2-step verification and the urgent need for stronger security measures to protect consumers worldwide.
A relaxing cruise turned into a nightmare for 64-year-old Stephen Ratchford and his wife Karen from Grimsby, UK, when fraudsters hijacked their mobile numbers and stole Rs 33.75 lakh (£25,000) through unauthorized bank loans and overdrafts.
How the Fraud Unfolded
The couple set sail for a dream holiday to Malta on October 3, 2024. Days later, while in Split, Croatia, their phones suddenly stopped working. Unbeknownst to them, scammers had pulled off a "SIM-jacking" attack—transferring their phone numbers to new SIM cards under their control.
With access to their numbers, the fraudsters intercepted security codes sent via text, allowing them to log into Stephen’s emails and bank accounts. They withdrew money, applied for overdrafts, and even secured a large loan from HSBC—all while the couple was stranded on a ship.
Desperate Attempts to Stop the Damage
With no phone access, Stephen and Karen sought help from cruise staff. "Thank goodness P&O let us use their phone," Stephen recalled. They immediately contacted their banks and mobile provider, iD Mobile, to report the fraud.
The banks moved quickly, canceling fraudulent transactions. While Stephen didn’t lose money permanently, the experience left him shaken. "It messes with your head. I feel paranoid now," he admitted.
The scammers also racked up Rs 20,250 (£150) in premium messaging charges on their mobile accounts. iD Mobile covered the charges and compensated them with Rs 10,125 (£75), promising improved security measures.
Understanding SIM-Jacking
SIM-jacking, or SIM swapping, is a rising cybercrime where fraudsters trick or bribe mobile providers into transferring a victim’s number to a new SIM card. This allows them to intercept security codes, reset passwords, and access sensitive accounts.
Stephen, who considers himself tech-savvy, was shocked. "I’ve never clicked a suspicious link or answered a dodgy call," he said. Experts believe scammers likely gathered his personal details through social engineering or data breaches.
Aftermath and Warnings
Back home, Stephen now questions the reliability of two-step verification. "It only works if you control your phone. I’d never even heard of SIM-jacking. How many others are at risk?"
HSBC and iD Mobile expressed regret, emphasizing their commitment to fraud prevention. HSBC urged customers to stay informed through its Fraud and Security Centre, while iD Mobile reassured users that additional security checks are being implemented.
