SINGAPORE - An order of mooncakes cost one woman $76,000, after scammers took control of her phone through a third-party app and siphoned the money from her bank account.
Ms Lee, an administrative executive, had chanced upon a Facebook advertisement for bunny-shaped mooncakes filled with Mao Shan Wang durian from a bakery called “Sunshine Cake House” on Sept 14.
Enticed by the deal of $29.90 for a box of eight, she messaged the seller on Facebook, who passed her number to a “delivery man”.
This “delivery man” texted Ms Lee on WhatsApp and instructed her to download a third-party app on her Android phone. The app prompted her to make a $1 payment through PayNow as a “deposit” before her order could be placed, but wary of divulging her bank details, the 51-year-old pretended not to have PayNow.
“I’ve read about all these scams so I refused to give my PayNow and the fraudster paid the deposit for me,” said Ms Lee, who wanted to be known only by her surname. “I was so careful but I got scammed all the same.”
Later, she deleted the third-party app after she had trouble logging in to her mobile banking app on her phone.
She did not tell the purported delivery man about this, but he immediately called to say her order had been cancelled and pressed her to download the deleted app again.
Ms Lee relented because he was “very courteous”.
The man continued to text her about the delivery throughout the day, constantly postponing the delivery time until his last message at about 11pm – when she went to bed.
In the morning, Ms Lee woke to find that her phone had been “compromised”. She could not make any calls or log in to her mobile banking apps.
She rushed to the nearest ATM to check her bank balance only to find that “everything was gone”.
The grifters had raised her transaction limit from $500 to $20,000 and transferred $76,000 out of her DBS account in a series of four transactions.
Ms Lee said the money had been set aside for the down payment on her new Build-To-Order flat and renovation works.
Her compromised phone meant she could not make any calls and had to plead with several passers-by to use their phones just to call the bank. Immediately after, she lodged a police report.
“The scammer even had the audacity to text me about more mooncakes that morning,” she said.
The police confirmed that a report had been lodged and investigations are ongoing.
Ms Lee, who hopes to recover the stolen sum from DBS, questioned how the “unusual” transactions went through without any notifications sent to her.
“Why didn’t DBS call me? It might not be convenient but banks should protect their customers and ask more questions,” she said.
“I feel terrible, I can’t sleep or eat. My heart feels ill,” said the mother of two, adding that her two children were still in school and she was going to have trouble paying for her new home.
With the Mid-Autumn Festival approaching, scammers are turning to bogus mooncake advertisements to swindle people online. In August, at least 27 people fell prey to these scams, losing some $325,000 in total, said the police.
These mooncake scams take the same tack: “Sellers” send victims payment links that download malware into their phones, enabling scammers to control victims’ devices remotely and drain their bank accounts.
