We've all heard about the Tinder Swindler and Anna Delvey's Netflix series, just a couple of the popular factual social engineering stories that shook not only social media but also international banking systems. If there's one lesson these stories have hammered into our heads, it's that anyone can fall victim to scams because scammers find ways to game us.

You may be one of the few, like me, who remain unscathed from these scammers, but that doesn’t mean you’ll be safe for long. As you read this, a scammer from Jamaica could be planning his troll farm’s most devious global scam yet, and this information should be alarming enough to get you worried.

This is precisely how social engineering works. By definition, social engineering is the art of exploiting human psychology to gain access to buildings, systems, or data. It involves altering human behavior through indirect means, typically focusing on behaviors that individuals are usually hesitant to change on their own.

Social engineering attacks can take various forms, but they all generally follow the same pattern: establishing false trust, exploiting human error, and using persuasion to access sensitive or confidential information.

In other words, social engineering is a sophisticated term for when someone manipulates you into doing something you wouldn't typically do. Scammers employ social engineering to obtain access to your personal information, finances, or even your computer. Some scamming examples include phishing attacks, manipulation, and impersonation techniques.

Scammers exist in all countries, even in the most developed ones. During my time in Singapore, I received a phone call from a person who identified themselves as my bank's customer care manager. They claimed to be calling to confirm a $5,000 SGD transaction on my newly issued credit card, providing me with a credit card number that should have been mine. Initially, I assumed it was legitimate.

I explained that I had not requested any credit card issuance and pointed out that the bank had to verify my passport and pass card before issuing any bank card. I suggested that they investigate internal fraud at the branch level. The caller then connected me to her "supervisor," and we rehashed the issue.

At this point I was still believing that this was legit.

I only started doubting the legitimacy of the call when they casually responded to my concerns about internal fraud. I expected a more serious reaction, given the severity of internal fraud at a bank. Instead, they recommended that I report the issue to the police immediately and connected me with "Inspector Lee," who began by lecturing me on cybersecurity and the importance of not sharing personal documents online. Following the lecture, he requested that I send him scans of my papers via Line messenger. At this stage, I was already enjoying the conversation and insisted on visiting him in person at the police station until he gave up.

Reflecting on this experience, I couldn't help but wonder how easy it could be for a non-banking individual to fall into such a trap.

My lesson here: Scammers are becoming more sophisticated, and their scenarios are well-prepared. They employ multiple individuals to impersonate actual bank employees. They are familiar with standard bank procedures and even use the same jingle as the actual bank's hotline. They also knew my name. I'm certain they guessed the bank because it's the second-largest retail bank in Singapore. But everything else was impressive. I can't help but wonder what they could have done with my documents. The only thing that comes to mind is using them to apply for a small loan from a lending app. Legitimate banks won't issue a loan without thorough customer verification, but smaller lenders often will.

This case has made me even more convinced that it's the responsibility of financial institutions to protect customers' money and identity, not just to educate them. No matter how much you educate customers about fraud and protection, there's a group of malicious individuals whose full-time job is to outsmart them, and they will eventually succeed. Especially in the digital world, banking solutions should be foolproof. This is what we strongly believe in at Tonik, from day one of our bank's ideation and our very first whiteboard sketch.

You might be wondering: What could I have done if my Tonik Account was the one that got scammed? Here’s my answer:

1. I would immediately search to see if the phone number belonged to Tonik. (You can find our legitimate Tonik hotline numbers here).

 

2. I would log in to the app and check if the "new credit card" is there. If it's present, I can lock it with a simple toggle, preventing any transactions. If it's not there, it means there is no card. Without it being displayed in the application, there's no way to issue or use the card.

 

3. I would chat with a Tonik app customer care agent and address the "new card" issue directly.

 

4. Tonik card issuance can only be initiated from the app. I'm absolutely sure that no one can gain access to my Tonik App. We have a one-device policy, meaning that even if someone knows my password and tries to install the Tonik app on another phone and log in, they would still need to verify their face, matching the one used during the Tonik onboarding process. If it's not the same person, they have no way to access my funds.

If this were another bank in the Philippines, I would ask the operator to block the card. If the bank is legitimate, this would immediately raise a flag that triggers a sequence of actions, buying some time to reach the branch and speak to a bank representative.

But, in the Philippines, we are particularly concerned about individuals impersonating Tonik to gain access to other financial apps belonging to customers. We recently had a case where an impersonator pretended to be a Tonik representative, offering to help people get a cash loan from Tonik. To do so, they requested a screenshot of their GCash account with all the details.

My recommendation here would be to keep your logins into mobile wallets strictly as biometrics. And of course, never share the phone numbers or account numbers of the mobile wallets. But I guess this is obvious.

Let me end this with a reminder: There is no entity or individual within the country authorized to facilitate Tonik loans. If you come across any information suggesting otherwise, please inform us immediately, and we will take swift action. Your vigilance is crucial in maintaining the security and integrity of our services.

Learn more about Mila Bedrenets, Tonik Chief Growth Hacker.