RICO’s Q — The problem. I got scammed. How did the scammers get to my account? It must be an inside job (at the bank). Well, maybe, but most likely, you had a prepaid cellular phone line linked to your bank account to make a Sinpe Movil transaction and then forgot about it.
The solution. The Banco Central de Costa Rica (BCCR) – Central Bank, and three mobile phone service companies in the country – Kölbi, Liberty, and Claro (telcos), have teamed to launch a plan intended to
The Central Bank of Costa Rica (BCCR) and the telcos that offer mobile phone services in the country are close to launching a plan aimed at closing the door (to your bank account) to scammers.
The goal is for any of the telcos to confirm with the Central Bank that a phone number being issued to a customer is not associated with another individual’s bank account.
According to investigations by judicial authorities, there are cases in which users associate their phone number with their bank account in order to use the Sinpe Móvil service and make expedited transactions.
Over time, the customer stops using the phone line or cancels the service and the telcos reuse them, that is, assign the number to other people.
However, their number remains linked to their bank accounts unless the customer takes action to unlink the number from their bank account.
For example, if you don’t use your prepaid line for more than 90 days, telcos can reuse prepaid phone numbers, that is, offer them to other customers, and with your link to your bank account.
How do scammers obtain these prepaid lines?
I suppose you could say they go on a fishing trip, buying up SIM cards and testing them one by one. They “test” until they find a line linked to a bank account and transfer funds through a Sinpe mobile phone by text message.
The director of the Central Bank’s Payment Systems Division, Carlos Melegatti, explained that under the new plan, verification would be done immediately, and can unlink the number before it is issued to the new customer.
To achieve this goal, all stakeholders involved must make changes to their IT systems.
Melegatti explained it’s a palliative solution, a way to ensure that whoever buys this phone line cannot access that customer’s previous account.
Central Bank defends the need to maintain Sinpe movil
One way to end any chances of customers being scammed, at least as explained above, is not to have a Sinpe Movil connection to your bank.
Or the Central Bank eliminates the Sinpe Movil.
Melegatti explained that Sinpe Mobile transfers can be made through two channels: via apps or websites, and via text messaging (SMS).
The SMS method is faster, as it only requires sending a text message from the phone line linked to the bank account. This is the scammers’ intent. They purchase the lines from which they repeatedly send the SMS corresponding to Sinpe Mobile transfers. Many will not be linked, and the message will fail.
But they try until they “hit” a phone chip from which they can send the message and, therefore, transfer the funds from the victim’s account, linked it to the phone number, to the criminal’s account.
Although it is faster, it also requires fewer controls. However, Melegatti argues that it is also necessary to maintain the SMS option for two reasons. The first is a contingency measure in case the internet fails. The second is that some people cannot afford a cell phone plan, so sending SMS is more affordable.
OIJ questions the ease with which one can obtain one of these lines
The head of the OIJ’s Fraud Section, Yorkssan Carvajal, said that they have already criticized the “ease with which people can activate these lines in Costa Rica” before the Superintendency of Telecommunications (SUTEL) and the Cybercrime Prosecutor’s Office.
Carvajal complained about “the lack of controls that exist in these types of mechanisms, which, unfortunately, is a great way for cybercriminals to hide behind.”
From his perspective, telephone companies should be required to implement stricter controls to prevent criminals from using these chips as a means to defraud.
What do the telcos say?
Claro, which stated it always follows the guidelines of national authorities, made two recommendations to people who use its prepaid service:
- Keep the line active with regular recharges of no more than three months
- If the user loses a phone line registered with a financial institution, update the corresponding information as soon as possible to avoid inconveniences
For its part, Liberty also stated that it is willing to collaborate with the authorities in whatever way is necessary.
“We are currently in talks to finalize an agreement with the Central Bank of Costa Rica, which will allow for notification and facilitate the removal of a number from the system when it no longer belongs to its owner,” Liberty states.
The company also urged users to update their information in case they stop using the lines.
For its part, the state-owned company ICE-Kölbi stated that it applies strict verification controls to the information of individuals who purchase a prepaid SIM.
It also states that advanced technical measures have been implemented to detect patterns that may suggest illicit practices. This is done without accessing, analyzing, or filtering the content of user communications.
Finally, another line of defense for customers of prepaid services is to voluntarily register their line with the SUTEL to facilitate the identification of the actual user of the service.
It is important to note that this registration is not yet a mandatory requirement.