Tietoturvatiedote

11.9.2023 15:19

Warning: cybercriminals are making scam calls in OP’s name

Criminals are now making scam phone calls to get your and other customers' user IDs. If someone calls you and claims to be from OP’s security unit (they may refer to “turvallisuusosasto” in Finnish), it’s a scam. Don’t do anything that the caller asks for. End the call and notify your bank of what happened.

Scam calls are being made again. A criminal calls, claiming to be from a debt collection agency and mentions an unpaid bill. 

When the victim doesn’t recognise the order or bill, the criminal explains that a computer virus may have caused the problem. The scammer then says that they are connecting the victim to OP’s security unit (turvallisuusosasto). A colleague of the criminal, posing as an OP employee, continues the call. This scammer tells the customer to transfer money to a so-called secure or safe account. 

The scammer may also ask for the victim’s OP online service user IDs, so that they can help the victim to transfer money to a safe place. No secure account exists – the transferred money ends up in the hands of the criminal. 

Calls are also being made by fake police

Scam calls are also being made in the name of the police. The scammer claims to be calling about a loan applied for in the customer’s name. They then ask the victim for OP online service user IDs, to help with the investigation of the matter.

A real bank or official will never ask you to give your OP online service user IDs. Don’t reveal them to anyone. 

Traditional scam messages are also being sent. These tell of a suspicious transaction, information update, account verification or the activation of Mobile key. 

The scam messages include a link with an address resembling OP's website, but spelled differently. Via the link, the criminals transfer their victims to scam websites that phish for their user IDs or card details. Using stolen IDs, the criminals will attempt to make fraudulent payments and gain access to the victim’s Mobile key. 

The scam messages may look like this:

  
 

Please note that scam messages may be in the same message chain as genuine SMSes from OP.

If you get such a message, do not click on the link in the message. Because cybercriminals often change the content of their scam messages, other kinds of scam messages may also be in circulation.  

If you suspect that your user ID has fallen into the wrong hands, deactivate your user ID by calling 0100 0500 (personal customers) or 0100 05151 (corporate customers). When our Customer Service is not available, please call the OP Deactivation Service at +3581000555. It is available 24/7. Also remember to call our Customer Service during service hours to report the incident.  

This is how our messages differ from scam messages  

We will never send you messages with a link to the online bank's login page. The bank will never ask you about your user ID or card details through messages. Such messages are scams – do not click on the links in the messages.  

Even when receiving or cancelling a payment, you do not need to log in via a link, confirm with codes, or give your details. If you are asked to do this, contact the bank's Customer Service.  

Please remember these seven things when banking online  

  1. Do not go to an online bank through a link sent to you or through a search engine. The message directing you to the login page is a scam. You may end up in a scam website through search results on Google, Bing or another search engine too, so type the address on the browser’s address bar yourself.  
  2. Check the address. Always make sure that you are at www.op.fi. Do not enter your identifiers into a site if you are not sure that it is genuine.  
  3. Keep your user ID and password to yourself. The bank will never ask you to provide your user ID over the phone or by SMS or email.  
  4. Do not open email or SMS attachments sent in the bank’s name. Check with your bank’s customer service that the attachments are genuine.  
  5. If a person you don’t know asks you to install an application, do not do so. Install the software you need yourself from your device’s app store.  
  6. Do not confirm transactions you are not certain you have made yourself. Always read the confirmation requests with due care – if there is anything that does not match, do not confirm anything.  
  7. Please ask if you are unsure about anything. If a contact or message is suspicious or your online bank's login page is not working in the usual way (for example, login with Mobile key is not working), please contact your bank before doing anything else.