Sydney man wakes up to find he had lost $52,000 in terrifying phone hack

The Sydney dad rushed home from work after a strange message appeared on his phone. It would cost him thousands and give him weeks of “hell”.

Oren Vaknin thought the worst thing that could happen to him was waking up in the morning and discovering that hackers had taken $32,000 out of his bank account.

It was December last year and the Sydney dad was in a state of panic as he rang up his bank.

They admitted they had noticed some unusual activity and assured him that they had suspended his account and no more money could be taken out while they investigated.

But then the next day the exact same thing happened again.

“The following morning we were missing another $20,000, we were stressing out as hell, wondering what the hell is going,” Mr Vaknin told news.com.au.

In total, bank transactions showed that $52,000 had left his account in the space of 24 hours.

A scammer had remotely gained control of his phone by applying for an eSIM card and was then able to steal his phone number.

This meant that his passwords – including to his bank accounts – were reset and redirected to the hacker’s phone rather than his own.

Want a streaming service dedicated to news? Flash lets you stream 25+ news channels in 1 place. New to Flash? Try 1 month free. Offer ends 31 October, 2022 >

Oren Vaknin is still being impacted six months after the hack.

Mr Vaknin vividly remembers the first sign which made him realise something was terribly wrong.

It was 2.59pm and he received a text message from his telco provider, Optus, saying his contact details had been updated. He had made no such request.

An hour after that, his phone changed to SOS only mode, meaning he couldn’t make or receive calls or text messages.

He now knows that was because the cyber criminal had successfully ported his phone number over to their device.

Optus did the SIM swap because the hacker got their hands on his phone number, address and date of birth which was all they needed to authorise the transaction.

There’s no way to know for sure but the dad suspects a list with some of his details on it was intercepted which gave the fraudster all the information they needed.

What followed in the next few days, Mr Vaknin describes as “hell”.

“Once they had my email and my phone number they could change everything,” he said.

The message on his phone alerting him that he had lost signal.

Mr Vaknin drove home from work, then he and his wife and 18-year-old son worked together to try to shut down all his accounts.

He called Optus and after explaining the situation they assured him they had suspended his mobile number.

“After 20 minutes the hackers manage to reinstate the number again.”

This went back and forth three times as he and the criminal wrestled for control of his phone.

“On the fourth time they migrated my number onto a different telco,” he said.

Only by a sheer stroke of luck did he realise this.

“Luckily enough I managed to discover it was Telstra because I didn’t have any Wi-Fi. It was completely unrelated; they said you have a phone number with us.”

He also received emails from eBay, PayPal, Facebook, Spotify, Google and ServiceNSW informing him his password had been changed.

But the worst was yet to come.

In the following days various accounts were hijacked by the hacker.

PayPal, eBay, Facebook, Spotify, Google and ServiceNSW were all hacked.

Mr Vaknin went to bed the same day of the hack and when he woke up the next morning $32,000 was missing from an account linked to a significant loan he had taken out for his business.

Despite talking to the bank, the next morning he’d lost a further $20,000.

“The hackers managed to get $52,000 in two different days. Which is absolutely ridiculous,” he said.

Calling banking staff “idiots” for allowing it to happen the second time, the dad finally did manage to get the account suspended.

Mr Vaknin’s bank told news.com.au they kept track of the money the whole time and that all the funds had been fully recovered.

However, he has little faith and has kept the money locked down ever since and is unable to access the funds.

“Since then we’re scared to open the account,” he said. “I’ve been suspended from this account since December last year and it’s a big loan.”

As for Optus, Mr Vaknin remained a customer but insisted on a four-letter pin before any changes to his account can be made.

To test this out, he went into an Optus store to change some things on his account and a staff member asked for his pin, prompting him to make up some random numbers.

“She got into my account in two seconds, willing to change whatever, without even checking,” he said.

“We went through hell only for this to happen. It was absolutely a joke.

“They [Optus] gave me $100 in compensation which was really pathetic.”

Optus wouldn’t comment on Mr Vaknin’s individual case but said: “Optus, along with the wider telco industry, is working to enhance existing protocols and controls to prevent unauthorised access to customers’ accounts and services.”

The initial response from Optus was that it was ‘sad’ he had been compromised.

Government responds

Last month, the Australian Communications and Media Authority (ACMA) announced that phone companies will need stronger customer identity checks for “high-risk transactions” like SIM swaps or account changes.

The new requirements, called the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022, will come into effect on June 30.

From then on, telcos must use multi-factor authentication of their customers’ identities such as confirming personal information and responding with a one-time code, similar to how banks operate. Currently, they mostly only require a customer’s name, phone number, date of birth and address to authorise a change.

Under the new guidelines, ACMA can punish telcos who breach the rules, including by taking them to court.

An Australian SIM swap victim will on average lose a whopping $28,000 to hackers, according to the ACMA.

Between January 1 and September 30 last year, there were at least 510 incidents of reported SIM swaps, resulting in 163 cases of financial loss.

These losses amounted to $4.68 million, with the largest single reported loss being $463,782.

Have a similar story? Continue the conversation | [e-mail] | @AlexTurnerCohen

Originally published as Sydney man wakes up to find he had lost $52,000 in terrifying phone hack