South Australian family ‘devastated’ by terrifying phone hack

When their phone lost its connection, they didn’t think much of it. But soon they were racing to protect their life savings.

A South Australian couple has issued a stark warning after nearly losing their entire life savings in a terrifying phone hack.

Back in October, Adelaide man Abe Walters, 36, was picking up his youngest child from school when he noticed something strange.

His phone had changed to “SOS only” mode, which indicated it had lost signal.

The father of three could still connect his device to Wi-Fi but was unable to make calls.

“I looked on the Optus website and saw that there were tower upgrades going on and thought nothing of it,” he told news.com.au.

But what followed saw him and his wife Kylie lose hundreds of dollars, have their identities stolen, shut their bank accounts and almost lose the savings they had been amassing for a home deposit.

Three months later, they are still experiencing the blowback and fighting for compensation as they claim it was the result of a blunder from their phone provider Optus.

The family is warning others what to watch out for.

Abe and Kylie had linked their mobile accounts as part of a family phone plan and for two days they were both stuck on SOS mode.

During that time, the pair had to use their son’s phone to make important calls.

Abe sought help from his provider, Optus, via its web chat feature, where he was told to try turning his phone off and on again. The problem persisted.

“Those staff had no clue what was going on,” he recalled.

That was when their bank notified them that two cardless cash withdrawals had occurred to the tune of $500.

“I was like ‘what the hell?’” Abe said.

Confused as to how this withdrawal could have occurred, the couple rushed to their nearest bank branch.

The customer service officer got a glimpse of their phones on SOS mode and warned them that there was a new scam going around.

They soon learnt they were victims of a “SIM swap” hack.

Have a similar story? Continue the conversation | [e-mail]

Abe and Kylie Walters have had a stressful three months fighting off the hacker.

A scammer had remotely gained control of their SIM cards by applying for an eSIM card and was able to steal their phone numbers.

This meant that their passwords had been reset and redirected to the hacker’s phone rather than their own.

The couple found out that over two days, this hacker had impersonated them, accessing identifying documents, starting a new bank account in Kylie’s name, and increasing the maximum spend on their buy now pay later services.

The hacker was in the process of transferring the couple’s savings into a new account.

“They tried to delink my current account, not to mention a home deposit we’ve been saving up for, it would have been quite a bit of money,” Kylie said.

Luckily they stopped the transfer in time, Kylie said, “otherwise we would have been screwed”.

The Walters family blames Optus. Picture: NCA NewsWire/Bianca De Marchi

“I was devastated,” Kylie said, with Abe adding he was “stunned”.

His phone had been linked to a OneDrive account with an old photo of Kylie’s driver’s licence, which had allowed the hacker to create a new account in her name, to start cashing out on her savings.

They notified their bank, changed their passwords and added an extra layer of security questions so that the hacker couldn’t gain access through just a phone.

However, the bank initially blamed Abe and it took over a month for a fraud investigation to reimburse them for the lost money.

“While that was being investigated that entire time, he was not able to access lunch money, utility bills, there was also a loan attached to that, those three things went unpaid,” Kylie pointed out.

It was only when Abe could prove that he had been in South Australia the whole time while the transfer occurred in NSW did the bank conclude the investigation in his favour.

While the hacker had control of their accounts, the thief used their PayPal login to purchase sunglasses.

As it was a delivery, the hacker listed an address in the NSW city of Newcastle, the same place where the illegal bank transfer occurred. Abe and Kylie are hopeful that the hacker was stupid enough to leave a trail leading right back to where they live.

The couple contacted police, providing them with this address. The investigation is still underway.

Example of a phone on SOS only mode, which was the first warning sign for the couple.

As the Adelaide mum and dad learned more about the SIM swap, they soon became outraged at Optus and are demanding compensation.

“No-one actually picked up on the fact the SIM card had been switched to a digital one,” Abe said of his initial conversation with Optus after the hack.

“The response from Optus is highly insufficient in our minds.”

An Optus employee showed them the conversation the hacker had with the company and at no point did the fraudster produce identifying information that proved they were Abe. When they requested for an eSIM card, the Optus employees happily obliged, Abe claims.

“There was no identification thing, this theoretical system of security that they have is bogus,” he said.

He also said a senior Optus worker told him web chat staff weren’t even authorised to change a SIM card to an eSIM.

Optus has since offered Abe and Kylie $190 in compensation for a reduced phone bill, which Abe described as “a really pathetic response on their part”.

In a statement to news.com.au, Optus indicated the credit on their phone bill was ample compensation.

“Optus is very sorry for Mr Walters’ experience,” a spokesperson said.

“Our team was in contact with Mr Walters earlier this month to offer a credit to his account which was accepted.”

The telco giant also did not acknowledge whether it was at fault for issuing the eSIM card without adequate identification.

“Customer security is an issue that Optus takes very seriously, for this reason we have put in place a number of steps to securely identify customers before they can make any changes to their existing services,” the statement continued. “In the vast majority of instances, an individual’s personal information is often already compromised making it easier for fraudulent activity to occur.

“Unfortunately identity theft continues to be an issue for many Australians and we encourage customers to regularly change their passwords, not re-use passwords and aim to keep their personal information secure.”

Threat not over

Although Abe and Kylie managed to avert disaster, they have been constantly on edge in the three months since they were hacked.

“How do I know they (the hacker) haven’t opened up another account in our name, and as a result we can’t get our first home because they’ve opened up something and ruined our credit rating?” Kylie said.

Abe added: “This has caused both my wife and I quite a bit of emotional distress and financial issues as we have changed banks and no longer trust in the security of our phones as we once did.”

After they gained control of their phones, for the next 24 hours the hacker kept changing their Optus details back, causing them to stay vigilant.

They now have two separate bank accounts at two different banks so that if this happens again, they’ll lose some but not all of their money.

Originally published as South Australian family ‘devastated’ by terrifying phone hack