Chapter 60: This is My New Number: A WhatsApp Message from My Son

Welcome to the ninth part of the book, perhaps one of its most painful and complex sections. If previous parts dealt with distant scammers, 'princes' from far-off lands, or enticing financial investments, here we touch upon the holy of holies of human existence: the family. The current chapter, and the one that follows, deal with the most sophisticated weapon in the digital scammer's arsenal—the ability to impersonate the people closest to us, or wear the mantle of state authority.

During my professional career as an attorney and notary, I have learned that the most effective scams are not those that breach secure servers, but those that breach the heart. When the phone vibrates and a message appears on the screen from someone we identify as our child, our logical defenses collapse. The critical mind, which usually identifies awkward phrasing or strange requests, gives way to the basic parental instinct: to protect, to help, to rescue. This is the place where the digital criminal meets the purest love, and uses it as a tool to attempt to steal life savings.

The following scenario is an educational example based on common scam patterns. The characters and events are for illustration purposes only.

The Meal That Never Was: An Educational Scenario Regarding Miriam

Friday, two o'clock in the afternoon. The kitchen of Miriam, a retired teacher from Haifa, was filled with the aromas of cooking. Miriam always prided herself on being 'technologically savvy for her age.' She uses Facebook, performs transactions in her banking app, and even knows how to order products online. But nothing could have prepared her for the simple message that arrived on her WhatsApp that afternoon.

'Hi Mom, it's Tomer. I dropped my phone in the toilet and it's completely fried. This is a temporary number I'm using for now. Don't call the old number, it's disabled. Save this number for now ❤️.'

Miriam stopped chopping. Her heart skipped a beat. Tomer, her eldest son, was right in the middle of a busy work week. She immediately felt a need to comfort him. 'Oh honey, what a bummer!' she typed quickly. 'The main thing is that you're okay. Do you have a backup for everything?'

'Yes, most of it is in the cloud,' the quick reply arrived. 'But I'm in a bit of an embarrassing predicament. I was supposed to pay the supplier for the new furniture I ordered for the apartment, and my bank's app requires verification through the old phone that I lost. I can't log in to the account from this temporary device. Is there any chance you could help me pay him? I'll pay you back on Sunday when I sort out the new SIM.'

For a moment, a slight thought of doubt crossed Miriam's mind. Tomer had never asked for money in such a way. But the wording was persuasive. The use of the heart emoji, the fact that he mentioned seemingly personal details—everything seemed to fit. And besides, it was her son. He is under pressure, he needs her.

'Sure honey, how much is needed?' she asked.

'It's a sum of several thousand shekels. I'm sending you his account details. It's a 'Delivery and Distribution' account, he said it's faster that way. Thanks Mom, you're a lifesaver!'

Miriam entered the banking app. She entered the details, approved the transfer, and took a screenshot. 'Sent, my dear. Did you receive it?'

'Queen! I received it. Listen, there's another payment for the mover... can you do that one too?'

Here, something in Miriam's gut turned. The additional request felt like a red flag. She tried to call the 'temporary' number. The call was immediately rejected. 'I'm on a call with work on the other line, can't talk, only messages,' she was told. She decided, despite the warning, to try calling Tomer's old number.

But it wasn't turned off. After two rings, Tomer answered. 'Hi Mom, what's up?'

Miriam's silence on the other end of the line was heavy. 'Tomer? Your phone... did it not fall into the toilet?'

'What? No. Why would it fall in the toilet? Mom, is everything okay?'

At that moment, the fraud was exposed. The money Miriam had saved from her pension had been transferred to a foreign account. The feeling of the breach of trust was just as difficult as the financial loss in this scenario.

Anatomy Analysis of the 'Hi Mom / Hi Dad' Scam

What was described in Miriam's scenario is one of the most common and successful scams in recent years, known globally as the 'Hi Mum' scam. During my professional career, I have encountered many cases based on this modus operandi, which relies on 'Social Engineering.'

The scammers do not always need a complex technological breach. Sometimes they use databases or send mass messages to thousands of random numbers. The statistics work in their favor: out of a large number of messages, there will be parents for whom the situation seems reasonable under the circumstances of time and place.

Why might it succeed? First, the creation of 'urgency.' The scammer tries not to leave the victim time for deep thought. He presents a situation of a small crisis leading to a financial dead end. Second, 'isolation.' The request not to call the old number is critical—it is intended to prevent the simplest form of verification. Third, the 'compliment.' The use of warm words activates the parent's natural desire to help their child.

From a legal perspective, these cases are complex. Unlike certain cases of account hacking where liability may be imposed on the bank, here the customer is the one who performed the transfer (even if under deception). This is where the examination of the duties of care of both the bank and the customer comes into play.

Legal Aspects: Examining Possibilities for Recovery of Funds

When examining a case of a customer who fell victim to a 'new number' scam, the question sometimes arises as to whether the action could have been prevented in the banking systems. The legal analysis may rely, among other things, on the Payment Services Law, 5779-2019.

This law regulates the relationship between the customer and the payment service provider. In a case where an 'unauthorized payment transaction' is executed, the law grants protection to the customer. However, when the transfer was performed by the customer themselves due to deception, the legal situation requires a deeper examination. In such cases, one can examine claims of deception and lack of good faith by the receiving party, as well as the bank's liability in the circumstances.

As part of the professional analysis, we examine whether the bank fulfilled its obligations according to the Banking Law (Service to Customer), 5741-1981. Did the bank identify an unusual pattern of behavior? If a customer who usually performs transactions in small amounts suddenly transfers a significant sum to a new account, one can examine whether the monitoring systems should have raised a question mark. In case law, there are various approaches regarding the heightened duty of care of banks, especially towards populations that may be more vulnerable.

It is important to note that the law states that if the customer acted with 'fraud,' they will bear the full damage. The question of whether 'gross negligence' amounts to fraud is examined in each case on its merits, taking into account the warnings presented to the customer and the circumstances that should have aroused suspicion in a reasonable person.

The Architecture of the Deceit: How the Story is Built

To improve protection, one must understand the dynamics of the conversation. Scammers may use 'Mirroring' techniques, in which they wait for the victim to provide them with information inadvertently. In many scenarios, the victim is the one who mentions the child's name, and the scammer just confirms the information and continues the story.

In some cases, information is gathered from open social networks—names of family members, upcoming events, or apartment moves. This information makes the approach much more persuasive. The scam may also move to voice calls, sometimes using technologies that simulate voice, a topic that will be discussed extensively in the following chapters.

Family and Emotional Aspects

During my professional career, I have encountered many cases where the damage is not just financial but also familial. Sometimes tension arises between children and parents regarding the subject of naivety or loss of self-confidence. It is important to remember that the scammers have extensive experience in emotional manipulation, and the responsibility lies with the perpetrators of the fraud and the entities that are supposed to provide protection, not on those who acted out of a desire to assist their family members.

Courses of Action: What to Do When the Screen Displays 'Message from Son'?

The most effective protection is based on behavioral change. It is recommended to adopt a 'Family Verification Protocol':

First, it is recommended to avoid transferring funds based on a text message alone. One should always strive to make a voice call to the old, familiar number. If there is no answer, it is better to wait. If the other party claims they cannot talk, one can request a voice message that includes a detail only family members would know, or use a pre-determined 'code word.'

Second, one should examine the account details. A request to transfer money to a stranger's account, an unknown company, or the use of fast cash transfer services should trigger a red flag. Financial institutions may view these as high-risk transactions.

Legal Aspects of Funds Recovery

In the event of falling victim to a scam, the speed of the response may be of great importance:

1. Immediate contact with the financial institution: The bank or credit card company must be updated immediately upon discovering the suspicion. If the money has not yet been withdrawn from the recipient's account, there is a technical possibility of stopping or freezing the transaction.

2. Filing a police report: The police report confirmation is a legal document that may be required in proceedings against the bank or insurance companies.

3. Examining the bank's conduct: As part of a legal review of the case, the bank's monitoring systems are checked, as well as the existence of alerts, and whether verification was performed with the customer in the case of a particularly unusual transaction.

4. Payment Services Law: One can examine the sections of the law dealing with liability for misuse, and check whether, in the circumstances of the case, the legal interpretation can be expanded to a case of significant deception.

Red Flags

• The unknown number: An approach from a new number claiming a phone was lost or broken.
• Preventing verification: Various excuses as to why a normal voice call cannot be made.
• Extreme urgency: Creating pressure to perform the transfer immediately.
• Unusual speaking style: Use of language or expressions that are not typical of the family member.
• Third-party account: A request for a transfer to an account that is not in the family member's name or to an unknown business entity.

Action Plan

1. Stopping communication: Do not continue the correspondence and do not perform further transfers.
2. Direct verification: Try to contact the family member through other channels or through people in their vicinity.
3. Documentation: Keep screenshots of the entire correspondence and the account details provided.
4. Reporting to the bank: Contact the bank's emergency center and ask to examine the possibility of stopping the transfer.
5. Reporting to authorities: Filing a police report and reporting the number as suspicious within the app.

Legal Aspect: Summary of Risks and Prospects

It is important to clarify that the possibility of recovering funds depends on many circumstances and is not guaranteed in every case. In many cases, funds are quickly withdrawn from end points. However, the legal infrastructure allows for examining the liability of financial entities as gatekeepers.

During my professional career, I have encountered diverse cases where the bank's compliance with professional procedures and the duty of care was examined. In certain scenarios, managing a legal process or a thorough examination of system failures may lead to reaching a compromise between the parties regarding the return of some or all of the funds, depending on the specific circumstances of the case.

Awareness is a key tool for defense. In a digital world, it is recommended to adopt an approach of 'trust but verify' and perform verification before any significant financial action. In the next chapter, we will continue to examine the world of impersonation, this time in the context of law enforcement authorities.