nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

AIB fraudulent transactions

redmissb

My son has a student account with aib. Unfortunately the other day he got a text that came in on the AIB messages thread and he clicked the link and entered his details and also a verification code. Shortly afterwards he had a text from genuine AIB regarding suspicious activity on his account, sure enough it had been cleared..14 transactions one after the other. AIB are now saying they won't refund because he authorised the transactions, he didn't. What are his chances of getting his money back? He's distraught.

Find more posts tagged with

Quick Links

Comments

Deub

https://www.boards.ie/discussion/comment/118842685#Comment_118842685

Thanks. I read the article and searched for some more. It says it is a collaboration with several stakeholders. It means that AIB on its own cannot stop these texts appearing as AIB messages. It also says that, in Ireland, 3 mobile operators are part it. There are 9 mobile operators so it will continue to happen to some customers unless all of them decide to take part of this process (to be honest, it should be mandatory).

HalfAndHalf

https://www.boards.ie/discussion/comment/118842762#Comment_118842762

Something doesn’t add up here.

If AIB are saying that your son authorised by approving the MFA push then if he hadn’t, the transaction would fail. That’s how it works. The bank is literally holding the transaction until you approve, if you don’t approve then it fails the transaction.

Without knowing more about what details he provided the scammers then for all we know the scammers were able to redirect the MFA pushes to themselves, if he’s provided the relevant info to sign into the app.

Again that wouldn’t be AIB’s responsibility.

redmissb

https://www.boards.ie/discussion/comment/118842816#Comment_118842816

AIB texted him an hour after transactions went out, it happened on Monday and they were pending till Thursday.

I'm not sure if they were SEPA etc,

Ohmeha

How soon after your son entered his details on the fraudulent text were the 14 transactions processed on the account and how soon after all this did AIB contact him? Have AIB provided full information on the transactions, were they all instantly processed, were they sent to crytpo.com as SEPA, SWIFT transactions etc.?

All banks were required recently enough under PSD2 regulations to upgrade their fraud detection systems, obviously something was flagged after the horse had bolted. I would be quizzing AIB on all the above questions because if a fraudulent transaction is identified quickly enough before processing they can internally block transactions to fraudulent accounts held with external banks and with SEPA if its processed and caught on the same day a cancellation will reject the transactions back

redmissb

https://www.boards.ie/discussion/comment/118842659#Comment_118842659

The letter stated he authorised the transactions by clicking on push notifications, he says he didn't click on any push notification. Yes he logged in and entered one verification code.

Look I'm not saying AIB have a responsibility to refund him, it was an AIB staff member who told him he should appeal the decision so that's why I was wondering if anyone got a refund in similar circumstances. I'm not arguing that he's entitled or should expect a refund as you seem to be implying.

Yes I did say I know about these types of scams, not sure what difference that makes.

stopthevoting

https://www.boards.ie/discussion/comment/118842319#Comment_118842319

It is explained in this thread on the Bank of Ireland forum, from post 25 onwards:

https://www.boards.ie/discussion/2058214640/is-this-a-genuine-text-message/p1

HalfAndHalf

https://www.boards.ie/discussion/comment/118842158#Comment_118842158

Your OP you say he did not authorise the transactions and that AIB are resuming to refund.

The thing is he did authorise the transactions as he clicked the link in the spoofed text and entered his details and the verification code. At that point the spoofers have all the details they need to do what they like. They acted fast enough as to clear the account before AIB’s algorithm flagged the account as possibly compromised.

I’m sorry for the lad and I know it’s not what you want to hear but there’s no responsibility for AIB to refund him.

It’s a hard lesson learned but hopefully it is learned. You said yourself you knew about these types of scams.

HalfAndHalf

https://www.boards.ie/discussion/comment/118842328#Comment_118842328

I suspect the ‘verification code’ was contained in the spoofed text that was received.

crypto.com is a legitimate site so perhaps AIB don’t enforce MFA for that site.

BOI only ask me to approve in the app on some sites and usually ones I haven’t used before. Like footlocker the first time I used them but never since.

The simple fact is, banks have been telling us for ages now that they’ll never text or call asking for information or details or to do anything that involves moving funds. People should know this by now.

HalfAndHalf

https://www.boards.ie/discussion/comment/118842212#Comment_118842212

This isn’t true. There is no way to stop spoofed texts or calls as yet.

[Deleted User]

The principle remains the same across the industry.

No bank will send you a link and ask you to enter sensitive information (passwords etc)

The most they'll do is ask you to sometimes confirm if a transaction is genuine (usually send a yes or no response)

The fake texts always come through on genuine message threads.

It's a harsh lesson to learn but they would be seriously out of pocket if they had to refund everybody who has been scammed.

L1011

https://www.boards.ie/discussion/comment/118842212#Comment_118842212

That's not something the bank has any control over at all. Phone networks side of things.

Deub

https://www.boards.ie/discussion/comment/118842317#Comment_118842317

That doesn’t seem very secure from AIB. I would contest the last 13 transactions saying I had never authorised them.

Deub

https://www.boards.ie/discussion/comment/118842212#Comment_118842212

How is it possible?

on the spam text thread, they say it is the responsibility of telecom companies to fix it. How could the bank fix this?

redmissb

It was payment to a website crypto.com. Yes he gave on verification code, maybe they allowed the rest because they were all to the same website?

Deub

what kind of transactions was it? Payment on a website or transfer via his bank account ?

from your OP, your son gave one verification code so I don’t think he can claim the first transaction. However, how were they able to complete the following 13 transactions?

Ficheall

14 successive transactions totalling 4k to a new 'contact' on one verification code? Doesn't say much for the MFA.

steve-o

https://www.boards.ie/discussion/comment/118835811#Comment_118835811

It is now possible to stop misuse of sender ids. If the banks are still allowing their sender ids to be faked then they are in some part responsible

redmissb

https://www.boards.ie/discussion/comment/118842183#Comment_118842183

I'm not sure tbh, AIB are saying he clicked on a push notification and he's adamant he didn't.

Ficheall

How did they get around the multi-factor authentication stuff?

The only reason I have ever done anything on my phone with AIB is because they've enforced MFA, with an app/text messages.

redmissb

https://www.boards.ie/discussion/comment/118842144#Comment_118842144

I didn't say I expected them to refund him, just asked what the chances were as the person he spoke to on the phone said he should appeal the decision.

HalfAndHalf

https://www.boards.ie/discussion/comment/118842093#Comment_118842093

Tbf there are countless adverts on all forms of media, this isn’t a new thing and the message is always ‘we will never contact you asking for personal or banking details’.

Granted, your son didn’t want the fall out from said mistake but expecting AIB to refund 4k due to it is also uncalled for.

Where do you think AIB would recoup all the costs from if they refunded everyone who made a ‘mistake’ after spending millions on advertising educational material to stop people making those ‘mistakes’. it would be in account charges to all other customers who have educated themselves on the unfortunate world we live in now.

It’s a harsh life lesson but he’ll have to take it and move on. He won’t do it again. (Hopefully).

redmissb

https://www.boards.ie/discussion/comment/118841775#Comment_118841775

That's a bit uncalled for, he knows he messed up..anyone can make a mistake.

[Deleted User]

Bank of Ireland have increased their security for clients greatly in recent times. I don’t use AIB so I can’t compare. All I know is you can’t simply clear out a BOI account quickly, there is a daily limit as to what you can draw out., and the app has extra authentication required per transaction.

People had previously complained on Liveline about how poor the security in BOI had been, and they duly got their act together. I’d love to know what the AIB experience is, ie are they still operating somewhat like BOI did.

TuamJ

I know so many people who have been caught with this text message. I got it sent to me 3 times last week and they tried sending me a BOI one too only I don't use BOI. The aul fella has his entire life savings in his current account. Getting him to open a bank account at all was hard work, getting him to invest etc out of the question so he has it sitting in his AIB account. I dread getting the call that he's wiped out. My mate lost 800 euro and never got it back.

I did get an email from them that shows the exact text I keep getting only it went into my spam folder and I only found it when I went looking for it after my mate got stung. They basically told him 'we sent an email, if you missed it, too bad'

Pentecost

https://www.boards.ie/discussion/comment/118836137#Comment_118836137

Each case is assessed individually and they will try to be fair despite the poor reputation banks have but the fraud levels are well up in the millions these times I believe.

redmissb

https://www.boards.ie/discussion/comment/118835986#Comment_118835986

I wonder if he has any chance in that case:(

Pentecost

https://www.boards.ie/discussion/comment/118835436#Comment_118835436

This. Someone I know works there and they can't or won't do that any more due to how prevalent the scams are. They used to do it out of goodwill but refunds went through the roof in recent years. Under EU regulations if you give away your authorisation details the bank isn't liable.

redmissb

Yes I know not to trust any sms from the bank with a link to follow, I thought my son did too but there you go. At least the person he spoke to yesterday seemed to think there was grounds to appeal the letter. Just wondering what the chances are of getting anywhere with them.

L1011

https://www.boards.ie/discussion/comment/118835776#Comment_118835776

Yes, and that's also why its impossible for them to be liable - the bank would go bankrupt if they had to refund everyone who was scammed.

You cannot trust any SMS as to where it appears to come from - phones will bunch messages with the same sender ID together but sender IDs are 100% fakeable (and have been since the first SMS in the early 1990s)

redmissb

https://www.boards.ie/discussion/comment/118835766#Comment_118835766

Isn't that how the majority of people are caught out? By giving information to phone scammers etc.