The scam in a nutshell

Someone from an unknown number contacted us on WhatsApp asking about the menu, even though orders can be made on the biggest online platforms like GoFood, Grab, ShopeeFood (1.❗). The name on WhatsApp suggested that the person making the inquiry has military affiliation (2.❗). We sent pictures of the menu, then an unusually big order was placed for 20 portions + 5 jars of Sambals (3.❗). While preparing the food we had several calls with the "customer", as he was asking for updates about the order and saying that his driver will pick up the food (4.❗). When all the items were packed and ready for pick-up he asked for more pictures about the items, which we provided. We also sent a picture of the receipt and provided the bank account number to complete the transaction as requested by the "customer" (5.❗). We quickly received a picture of a completed transaction, with accurate bank account number, name of recipient and date, but with a much higher amount of money on the transaction receipt compared to the price of the food (6.❗). However, we received NO notification from the bank about the successful transaction, so we told the "customer" that there was no transaction to our bank account, after which the scammer(s) disappeared immediately, blocked our number on WhatsApp, and we never heard from them again (1.✅). 

After the initial disappointment we decided to turn the experience into a more positive one so we gave all portions of food to people in need and we decided to share our experience so others may not fall for this or similar tricks (2.✅). Let's try to understand the events and the psychology of this and other scams in retrospect:

Warning signs we should have noticed

Watch out for common signs and tactics scammers use to reach their goals (free lunch or worse getting your bank details and draining your account) using social engineering:

• Our story illustrates a textbook example of social engineering. It makes us wonder whether our "customers" were educating themselves at this site describing pretexting. Pretexting is about shaping the situation (i.e. creating a story that may sound legitimate and convincing) to induce potential victims to act in the interest of the scammers (e.g. fulfill a fake order or share sensitive information).

• Does the situation appear in any way unusual or out of the ordinary? Why not place the order for food on established platforms where our menu is already available? (1. & 2. & 3.❗).

• Appeal to authority - people tend to comply with persons perceived as having some kind of authority. Choosing to impersonate an important military officer is indeed a great choice guys (2.❗).

• Manipulating the situation to induce stress and a sense of urgency - keeping you under time pressure and stress makes you less likely to critically evaluate the situation and identify signs that may reveal that the story you are presented with is in fact fake (4.❗).

• The goal of the majority of scams is to get access to the victim's bank account details which can be used to authorize transactions. In this case the goal might have been just to get a lot of food for free, but we can never be 100% sure about the scammer's motivation. (5.❗).

• Does the situation sound too good to be true? Many old-school scams lure victims by offering an unexpected payment or prize (6.❗). 

• Waiting for a notification from the bank whether the transaction really succeeded and not releasing the order until the confirmation were our first good choices during the scam (1.✅).

• Mistakes are great teachers and we learned a lot from this experience. Last but not least, our food was really appreciated by people who received it (2.✅).

Some suggestions for staying secure

• Did you initiate the interaction? Always be extra cautious when you are not the initiator of the interaction irrespective of the medium (in person, physical mail, e-mail, SMS, phone call, requests on social media, etc.). Take a few moments to think through what the real costs and benefits would be if you compiled with the request or offer. What the others might gain / loose if they succeeded in making you comply with the request? Is the effort required to pull off the scam proportional to the expected gains? Scammers need to invest time, energy and resources to make convincing impersonations and pretexts. They also need various accounts, phone numbers, etc. If the effort required to run the scam seems to outweigh the potential gains (e.g. free lunch), they may be after for something bigger, like your bank account.

• If you feel stressed by the interaction give yourself time and reflect a bit on the situation, delay giving answers, take a step back and think critically about the requests. Scammers aim for quick results, but asking questions and delaying to provide answers makes their job more difficult and may even cause their story to collapse. 

• Don't keep all your eggs in one basket - use one bank account to accept and make payments and use a separate bank account for your savings which you never share with anyone. This gives you more control by minimizing the maximum losses if scammers were to succeed.

• If you think that you have been a victim of a scam, report the event immediately to the relevant services (e.g. bank, online service providers) and authorities (e.g. police or tax authorities).

• Tactics used by scammers keep evolving and they use new technologies like AI, so keep yourself updated from security experts and by following best practices. 

• Try to help your family members, friends and colleagues by informing them about threats and recommended best practices to make them less likely to become victims! Stay secure and enjoy your Sambals!

The story on Instagram: