Phish head curry: Woman loses $33k to malware scam

She knew all about the latest scam trends and had been warning her friends not to fall for them.

But Kelly, not her real name, a retiree in her mid-60s, loves fish head curry. So when she saw an advertisement for the dish on Facebook, she clicked on it to place an order.

This allowed scammers to hijack her phone and siphon about $33,000 from her bank accounts.

Fortunately, the rest of her savings with OCBC Bank had been protected by the money lock feature, which allows users to lock up a specified portion of their funds. That money can be withdrawn only in person at a branch or an ATM.

This is the first such reported case of the money lock effectively thwarting scammers, said OCBC.

Kelly said she saw the ad on Facebook on the morning of Sept 5.

“I’ve always been telling others not to fall for scams on Facebook, where I’ve seen a lot of these kinds of ads for food,” she said. “But when I saw fish head curry, I let my guard down.”

The ad led her to WhatsApp, where a man told her about the different portions and prices of fish head curry that was supposedly available.

He even told Kelly the cook was purportedly from an eatery in Defu. But to place an order, she would have to download an app.

This was actually malware disguised as a delivery service.

It was initially blocked by her phone’s settings. But Kelly let him talk her through disabling the security settings using her biometrics to install the app.

This gave the scammers full control over her phone.

Over the next few hours, her phone screen repeatedly blacked out. When she asked the man if it was because of the app, he said it was just updating and there was nothing to worry about.

He added that her order was confirmed and the fish head curry would be delivered on Sept 7.

By then, the scammers had transferred about $33,000 out of her bank accounts.

They also saved a number listed as “Police Station” in her contacts list.

The next day, on Sept 6, she received a call from “Police Station” claiming she was involved in a case. The man on the line tried to convince her that they were legitimate by reciting her bank account details to her.

Her son, who was beside her, immediately took her phone and stopped the call.

She admitted she had downloaded the app and later realised the money was gone.

Her son helped her to clean her phone and filed a police report.

The police had issued an advisory about such malware scams involving Facebook ads of food items in September.

A few days later, five people linked to such scams were arrested.

Kelly said she was upset about losing her money but was thankful that most of her savings were safe because of OCBC’s money lock.

She had put more than $110,000 in money lock in January and June, preventing the scammers from stealing it.

OCBC, DBS Bank and UOB rolled out the feature in November 2023. Maybank, Standard Chartered, Citibank and HSBC followed in June.

As at July 31, more than 114,000 people have used the money lock function, with over $9 billion of savings set aside.

OCBC said that as at September, more than 70,000 OCBC accounts with more than $8 billion have been locked.

Mr Beaver Chua, head of anti-fraud at OCBC’s group financial crime compliance, said the bank traced Kelly’s money to a digital bank account. Future transactions to it have been blocked.

Mr Chua said: “We continue to encourage all customers to adopt money lock to protect themselves from scams.”

More than $2.7 billion here has been lost to scams since 2019, with victims losing a record of over $385.6 million in the first half of 2024.

Kelly said: “I think banks should make all their customers use money lock. It may be a bit troublesome for some because they have to physically go to an ATM or bank, but at least their money will be safe.”

She added that while the incident has made her more wary of shopping online, it has not dampened her love for fish head curry.

“I really like fish head curry. I still suggest going to eat it whenever there’s a celebration,” she said.

Inspector Kalai Mahran, a senior investigation officer with the police’s Anti-Scam Command who handled Kelly’s case, said scammers frequently change their tactics.

He said: “We urge everyone to stay informed about the latest scam tactics, to be sceptical of unsolicited contacts and to report any suspicious activities promptly.”