‘My savings account was emptied from my own phone.’ How to prevent transfers from being made after an assault?

“Criminals emptied my savings account from my own phone in less than 20 minutes,” he laments Gabriella Torreswho was the victim of an assault at the end of January this year.

She recounts that at around 7:00 p.m. on January 27, while walking through the streets Jose Mascote and Quisquis, in the center of Guayaquil, was intercepted by a couple to steal her wallet and cell phone. “I ran to my house (after the assault) and from my brother’s cell phone I tried to access my account, but it was blocked.”

The young woman says that, given the time of the assault, it was not until the next day that she went to the bank to report the theft and block two credit cards. There, after asking for a transaction history, they told him that his main account was at zero.

“In the history that they gave me, there was a withdrawal without a card of $200 that had been authorized from my own phone application at 7:20 p.m. and two transfers, each of $100. The password had been changed to make the procedure at 19:05 ″.

At the bank, says Gabriela, they told her that should have reported the theft immediately to take precautions to block electronic channels. “My phone has no password and all my account data is in a notepad that I have on the main screen.”

Likewise, a doctor from Guayaquil was also a victim of crime under the same mechanism: bank transactions made from a mobile device. The man, who would have been robbed at a traffic light on Perimetral Avenue at the end of January, lost more than $12,000, a watch, wallet and personal documents.

In the statistics, the Los Ceibos circuit has low crime rates, but drivers and passersby lament repeated robberies at traffic lights

The notifications to two financial entities were made an hour after the robbery, since during the assault he was hit with a firearm. However, in that hour, three transfers were made from his main account. In the banking entity they were able to state that the security validation was carried out and the movements were notified, in which the bank’s systems were not violated.

The doctor also filed the complaint with the Prosecutor’s Office for the case to be investigated.

The Association of Private Banks of Ecuador (Asobank) points out that current regulations establish that, in these cases, financial entities suspend or block electronic channels “from the day and time on which the client notifies the event, either in writing, by telephone or by any other means that constitutes test medium”.

“It is essential that the client informs the bank of the change of telephone number so that, after the cell phone is stolen, the bank does not continue sending authentication messages to that telephone line”

Marco Rodríguez, surrogate executive president of Asobanca.

Diego Alvarez, an expert lawyer in data protection, explained that when robberies and assaults occur and fraudulent transactions are carried out that were validated in the banking systems, it is very difficult to attribute responsibility to the entity. “Banks have a series of protocols and validation mechanisms to carry out the transactions and the services they offer to customers.”

However, it points out that this is a type of crime to be investigated because it is typified in article 190 of the Comprehensive Criminal Organic Code (COIP) as fraudulent appropriation by electronic means. The rule determines a custodial sentence of up to three years on who makes the appropriation of someone else’s property or who seeks the non-consensual transfer of goods, values ​​by electronic means.

In this sense, it recommends immediately notifying entities of the theft and filing the complaint with the Prosecutor’s Office so that investigations can begin.

The Asobancafor its part, recommends that users must apply basic concepts and key cybersecurity rules to use digital tools correctly.

How do I protect the information on my iPhone from theft and fraud?

For example, he cites that in addition to the authentication code (known as OTP) that is usually sent by text message or email when a person tries to access an account through digital channels or make electronic transactions, to enter mobile banking the client is always required to enter an authentication mechanism that only that person (the owner of the account) should know, such as the username and personal key or password.

In addition to these mechanisms, financial institutions apply other verification factors such as secret questions and biometric factors. The union details that, when cell phones are stolen, there are people who change their phone number with a new chip, but do not report the change of telephone line.

“It is essential that the client informs the bank of the change in telephone number so that, after the cell phone is stolen, the bank does not continue sending authentication messages to that telephone line,” he says. Marco Rodriguezsurrogate executive president of Asobanca.

Basic cybersecurity tips

For users who frequently use digital channels, it is recommended:

1. Be cautious in the use of your passwords and users of digital channels.

2. In the event of a change in mobile communication equipment (cell phones) or emails, the banking institution must be informed immediately, since these are the mechanisms that are regularly used to receive notifications about operations or passwords.

3. Download applications from official mobile stores or bank websites. This in order to avoid downloading fraudulent applications in the AppStore (for iOS) and PlayStore (for Android).

4. Install a licensed antivirus on the computers with which banking operations are carried out, also on cell phones.

5. Do not respond to emails or communications in general where personal information and passwords are requested. Banks do not request that information by any means.

6. Consider emails and web pages written with misspellings or syntax errors in sentences as a warning sign. (I)