The Bhutanese Leading the way.
Sonam (name changed) had been seeing a notification for some days on Facebook, asking clients to update their details with the bank as per instructions from the Ministry of Finance. It warned that users who failed to do so would have their accounts suspended immediately.
While scrolling through Facebook, she came across a similar advertisement from the same bank and clicked on the “Learn More” button, thinking this was her chance to update her account and avoid a suspension.
When she clicked the button, she was directed to what appeared to be the bank’s app, where she entered her CID number and MPIN, believing she had accessed her account. It then asked her to enter an OTP to complete the update, and at the same time, she received an OTP on her phone. She entered it, but nothing happened. Moments later, she received another OTP, entered it as well, but again nothing happened.
Her suspicions were now aroused, and she went to the actual bank app on her phone. She could still log in, but when she tried to transfer her money out, the app kept prompting her to enter an OTP.
In a panic, she tried again to transfer her money to another bank account of hers, now realising she had been scammed, but the app once again asked for an OTP, which never came.
Sonam tried calling the bank’s helpline to freeze her account and prevent further transactions, but she was kept on hold for several minutes and could not get through.
Then her heart sank as Nu 424,000 had been debited from her account by the scammer.
What had happened was that the realistic-looking notification on her Facebook, which took her to a realistic-looking bank app, was actually a creation by the scammer to steal her login details. Once she entered her login details, the scammer gained access to them and used this information to log into her real account, where the scammer changed the registered phone number to one in Canada.
However, such geographical locations can be faked. Once the phone number was changed to one controlled by the scammer, the scammer had complete access to the account and the OTP codes, which the scammer then used to clean out all the money.
The scammer was careful not to completely lock Sonam out of her real account, since five failed login attempts would freeze the bank app.
Because she still had access to her account, she could see the transaction record showing the money had been sent to two accounts at another bank, Nu 400,000 to one account and Nu 24,000 to another.
Realising she needed to act fast to recover her money, she called the bank where the scammer transferred the money to, and the bank asked her to rush to the police station, where she filed a report and shared the two account numbers where the money had been sent. The police immediately sent out a notice through their WhatsApp group, asking for the accounts to be frozen.
The police advised her that it would also be helpful to follow up with the bank where the money had been transferred. She rushed to that bank and met with the Operations Head to explain the situation. The bank checked the accounts and found that the Nu 400,000 had already been transferred further to another bank. The Nu 24,000 account, however, had not moved, so the bank froze it.
She then contacted a family member, who quickly alerted the third bank and, using the police notice, got the account frozen. The bank’s fraud focal person, who normally receives such police notices, had left for Australia at the time, so it was the family member who managed to get the account frozen. Luckily, the Nu 400,000 was still there.
While rushing between banks, she encountered the same person at two different banks, who overheard her mention the account holder’s name, Rajesh (name changed). At the second bank, he approached her, said he knew Rajesh, and gave her his contact number.
Sonam said she called Rajesh, who explained that he had been contacted by an Indian-sounding man who said he was sending him Nu 400,000 to arrange a tour for a group coming from India, since Rajesh owns a tour company. The caller said Nu 200,000 was to be sent back to him as commission, with the remaining Nu 200,000 to be kept for the tour group.
Rajesh claimed he grew suspicious that the caller was a scammer, noticing that several details, including the passport and CID information the caller provided, seemed off. He told Sonam that he then transferred the money to another bank where he held an account, to keep it safe.
The Thimphu police are investigating the case, and the lengthy process of recovering and transferring the Nu 424,000 back to the original account holder is underway.
In the last two weeks, the Thimphu police have received 37 cases of mainly similar OTP and online banking scams, in which people have lost millions. In most cases, police have managed to freeze the accounts before the money leaves the country.
According to sources, scammers typically send the stolen money to another account within Bhutan, since funds cannot be transferred outside the country directly. They then contact the account holder with a made-up story, convincing them to keep a fee and send out the rest, either using USDT crypto, or by exchanging the money (keeping a commission) and depositing it across the border, in the case of border towns.
Sources said that with the rise in OTP scams and their increasing sophistication, banks should reconsider sending OTPs via online channels or phones.
Meanwhile, this reporter tracked down several fake bank scam pages on Facebook and reported around seven of them to the platform, but only one was removed; the remaining six are still active.
Sources said people should be cautious of such notifications asking for online updates.
In the past, Australian dollar (AUD) scams were more common, but OTP-based online scams have become more rampant in the last few weeks.
