TikTok prank based on real fraud: How cybercriminals in UAE convince victims to call them

A prank where people call their friends using an automated answering machine voice to tell them that a large amount of money is about to be debited from their account is gaining popularity on the social media platform TikTok.

Cybersecurity experts in UAE warned social media users against this trending fraud scheme, called ‘vishing’. They have said cybercriminals are actively using it.

Researchers at cybersecurity company Kaspersky have detected an increase in the number of vishing emails in June - almost 100,000 – and have collected approximately 350,000 vishing emails between March and June 2022.

What is ‘vishing’?

Vishing is short for voice phishing. It is the fraudulent practice of convincing individuals to call cybercriminals and reveal personal information and bank details over the phone.

Like most phishing schemes, it starts with an unusual email from a large online store or a payment system. For example, it could be a letter from a fake version of PayPal telling you they have just received a request to withdraw a large amount of money from your account.

However, here's the difference - while regular phishing emails ask the victim to follow a link to cancel the order, vishing emails ask that they urgently call the customer support number provided in the email.

Kaspersky experts have emphasized this method was intentionally chosen by cybercriminals because when people look at a phishing site, they have the time to think about their actions or notice signs that the page is not legitimate. But when victims talk on the phone, they are usually distracted and find it challenging to focus.

“Attackers do everything they can to throw people off balance by rushing them, intimidating them and demanding that they urgently provide their credit card details to cancel the 'fraudulent' transaction,” said Roman Dedenok, a security expert at Kaspersky.

After gaining the victim’s bank account details, cybercriminals use the information to steal their money, leaving the victim with an empty wallet.

Kaspersky experts have also said from March to June 2022, they have detected almost 350,000 vishing emails asking victims to call in and cancel a transaction. In June, the number of such emails increased, reaching nearly 100,000, leading Kaspersky researchers to predict that this trend is only gaining momentum and is likely to continue growing.

What does TikTok have to do with vishing?

“TikTokers actively repeat one of the vishing schemes, with the only difference being that they do not send a fraudulent email in advance nor do they steal anything from their victims – their goal is a show, not money,” said Dedenok.

The call is conducted through an answering machine, whose voice is generated by an online translator. Most often, pranksters introduce themselves as a representative from the customer service department of a large online store, claiming they have just received an order from the victim for several thousand dollars and asking for their confirmation.

No matter how the victim replies, the next thing the answering machine says is, "Thank you, your order has been confirmed." People think the answering device misheard them and that the funds will be withdrawn from their account immediately, so they panic, scream and don't realize they are being pranked.

When people are convinced to disclose their data during a phone call rather than on a phishing page, they often don’t have the chance to consider that they are the target of a hoax – and many TikTok videos with this prank are a prominent example of this.

• UAE flights: Don’t post boarding pass photos, travel plans on social media, police urge residents