Calls have also been made from Finnish phone numbers. The recording is in good Finnish and the call is claimed to be from OP Pohjola's cybersecurity or fraud prevention unit. The recording asks you to select, for example, number 0 to be connected to OP Pohjola's cybersecurity, fraud prevention or security department.
Customers have been asked to confirm their identity or perform caller authentication by revealing their OP user ID during the call. After this the fraudster says they will send a confirmation message to OP-mobile, but in reality the message in OP-mobile is a confirmation request as the fraudster just logged into op.fi. This is the point when the fraudster is able to access the customer's online bank.
The customer may be led to believe that their account has been accessed by an unidentified device or that a payment is being made to an overseas account. During some calls, it is claimed that a loan is being applied under the customer's name. The fraudster may say, for example, that the account must be scanned for viruses, and all funds must be transferred immediately to a 'secure account' by confirming the payment or revealing their banking user ID to the caller. In reality, the customer is duped into confirming a payment made by a criminal and giving away their banking user ID.
This is how one call was described: "First the recording said that 'This is an urgent data security announcement from OP bank' and that someone is trying to hack into my bank account. I was then asked to select zero so that OP's fraud prevention team could contact me. I selected zero and the call ended. Then I received a call and I was told that someone from abroad had hacked into my account. They didn't know how much was being transferred out of my account, but they wanted to have my user ID so that they could run a virus scan on my account. The fraudster said that they never ask for a PIN over the phone. I was told that unless they can run a virus scan, my account would be closed for 3–7 days and they could also be sacked."
How to recognise a scam call?
Fraudsters try to create a situation in which a sense of urgency and fear of financial loss override sensible decision-making. Scams like these are run by professional criminals whose daily work involves the manipulation of people. You should be suspicious of any callers urging you to do something quickly. No real banking matter is ever so urgent that you cannot think about it for a moment and get back to it.
- A bank will never call customers to take some action to save their funds.
- If you receive a call from someone claiming to work for a bank or the authorities, always treat it with some suspicion. You can tell it's a scam call if you're asked to take quick action and that failing to do so will have serious consequences.
- Never reveal your user ID or confirm notifications on your phone when urged to do so by anyone.
- Read all notifications carefully and confirm only actions that you have yourself started.
- You can ask for the call to be confirmed in OP-mobile. To confirm a call, go to the front page of OP-mobile and select Instructions and settings - Customer Service - Identify yourself for Customer Service.
- Make sure that instead of confirming the call you don't confirm a payment or the fraudster's login to op.fi.
- If you suspect a scam, end the call and assess the situation by calling the bank's Customer Service.
Do as follows if you suspect that your user ID has fallen into the wrong hands
If you suspect that your user ID has fallen into the wrong hands, deactivate your user ID by calling 0100 0500 (personal customers) or 0100 05151 (corporate customers). Our Customer Service is open on Mon–Fri, 8.00–16.00. Outside these times, call the OP Deactivation Service on 0100 0555; this service is open 24/7. Be sure also to call the Customer Service during service hours to report the incident.