When one multinational telecommunications company enabled iPhone purchases through its system, its contact centers became a target for chameleon-like fraudsters trying to illegally access free phones and then resell them.
How did they do it?
Profile 1: Max
This fraudster is performing a phishing attack, where, through multiple call, he collects authentication details which allow him eventually to change the account mailing address and purchase an iPhone device.
In his first contact, a fraudster calling himself Max explained to the agent that he was phoning from a different number than what was listed on his account and thus avoided the one-time PIN security measure. During this phishing conversation, he was able to learn from that agent the exact date of the account's last bill.
On his next call, he once again avoided the one-time PIN and used that bill date to gain full access. At this point, he had the agent change the account's mailing address.
Then, on his third call, he successfully purchased an iPhone to be sent to that mailing address. When the agent requested a payment for the delivery, he explained that his wallet was in his car so the fee was instead added onto the bill.
It was a clean sweep. With the free iPhone on its way to him and a method proven to work, this fraudster went on to make four more calls targeting this cluster.
Profile 2: Lewis
In this alarming case, a fraudster employed a "man in the middle" attack to purchase a large number of iPhones.
The fraudster masqueraded as a mobile phone reseller, luring the victim with an enticing promotion for new customers. The fraudster took great pains to ensure that the victim was not already an existing customer of the telecom company, in order to evade detection. Unfortunately, the victim fell prey to the scheme and willingly shared their authentication and billing information with the fraudster.
Using this ill-gotten information, the fraudster then contacted the telecom company and posed as the victim, providing all the necessary details, including the fraudster's P.O. box address. Shockingly, the fraudster repeated this same strategy under different aliases multiple times, exploiting the victim's trust and the contact center's lack of voice biometric tools that could have alerted the agent to the scam in real time.
Piecing it together
With such iPhone schemes, Max, Lewis, and many others like them succeeded in scamming the telecommunications company for thousands of dollars—and deeply compromising its brand reputation.
They executed their deceptions with acrobatic fluidity – managing to phish, switch gears, pivot when needed, then bypass and even manipulate highly trained agents for their own purposes.
Yet they could have been stopped with top-level fraud prevention that incorporated AI interpretation of their high-risk behavior, voice biometrics detection, and real-time blocking measures.
To learn more about such a solution, reach out to us at NICE (link).
