Last week, Singaporean businesswoman Labina Fariah took to her Facebook page to share with the public the story of how her 60-year-old mother was tricked into allowing the transfer of nearly all her personal savings to four bank accounts in two Indian banks.

On Saturday afternoon, following a very tedious and stressful five days of tapping the extent of her personal and professional networks, as well as several meetings and calls with DBS Bank, the 32-year-old and her husband sat down with Mothership to share the full story of what happened to her mother, Arjuman Ara.

She says she is stepping forward in the hopes of helping Singaporeans to better understand how this can happen, what goes on after the fact, and also to remind others to be more vigilant and careful.

It started with two Viber calls

Arjuman is a Bangladeshi national who holds Singapore permanent residency.

Her husband, who passed away in late 2010, was previously the breadwinner of the family. "He gave me and my brother and my mother a good home," says Labina.

After his death, Arjuman took up three jobs — giving tuition, teaching at a kindergarten and doing interpreter work at law firms and hospitals — to support both Labina and Labina's younger brother over the past nine years, as they transitioned from university to starting work.

"She never took a break, she worked every day of the week," says Labina. "We are blessed, me and my brother, to be where we are in society today."

The savings Labina's mother squirrelled away over the years of work amounted to just over S$55,000 in her personal savings account by Jan. 8 this year.

Which brings us to Monday, Jan. 13.

Her mother received a call on Viber, a platform she uses quite often to make free calls to her friends and relatives back in Bangladesh.

Caller knew she had a problem with setting up her digital token

She hung up shortly after picking up, however, informing the caller, who spoke with a thick Indian accent, that she was unable to hear him clearly (she was in a crowded area at the time).

Before she hung up though, the caller informed her that he was calling from DBS Bank's Marina Bay branch customer service team, on a matter pertaining to her iBanking digital token.

Which, oddly enough, just happened to be an issue she was having — days prior she had indeed contacted the bank about problems she was having with her iBanking account, and she received an SMS from the bank asking her to contact a bank officer. She planned to make a trip physically to the bank to sort it out, but it slipped her mind until that day.

This could have been a lucky coincidence that worked in the caller's favour — but not till we get to what he told her next.

Also knew her bank account balance

When Arjuman returned his call at 3:57pm, asking him why he wasn't calling her from a land line and offering to physically go to a bank branch to solve her iBanking problem, the man on the other end warned her that someone was trying to hack into her account.

He told her that he was calling to help her "update" it and if she did not stay on the line, the unknown hacker would gain access to her account.

He then informed her that he was aware she had a bank balance of S$55,000, without her giving him any information on her end — not even her name, although he knew that information too (obtainable on her Viber account).

So these were two bits of information that were too accurate to have been a lucky guess — they also happened to be what hoodwinked Arjuman into believing him.

Before she realised the implications of what she was doing, she had handed over her iBanking login details, and the fatal move — a one-time password (OTP) sent to her phone via SMS that he asked her for.

The caller continued to keep her on the line, and here's a timeline of what happened:

3:57pm: Arjuman returned the Viber call.

Sometime between 3:57pm and 4:04pm: Arjuman handed over her iBanking login details and OTP, her digital token was activated and her account's withdrawal limit was increased to S$90,000.

4:04pm: The first transaction. S$17,999.05 was sent to a State Bank of India (SBI) account located in Ghazipur, Uttar Pradesh. Two SMSes came in (one warning her of a potential scam, and the other informing her about the successful transfer of funds with the amount listed. Both were accompanied by a number to call if the transaction wasn't authorised) as well as an email from DBS informing her of the transfer.

4:06pm: The second transaction. S$18,000.01 this time, to another SBI account in Bilimora, Gujarat. Again, another two SMSes came in, and another email.

4:10pm: The third transaction. S$18,000.00, wired to an ICICI Bank account in Andheri, West Mumbai. Two SMSes, an email.

4:13pm: The last transaction. S$1,000, sent to a fourth SBI account also in Bilimora. The SMSes and email followed shortly. By this point, Arjuman's account was left with S$99.03.

Arjuman's caller held her on Viber all the way until 4:36pm, so she wasn't able to view the SMSes coming in. But for some reason, somewhere between the start and the end of the call, she opened the first email that came in, saw the transfer, and was able to call Labina to alert her to what had happened.

Went to DBS Westgate branch & police

By this point, Labina had arranged with her mother to meet at Westgate to visit the DBS branch there to attempt to halt the transactions, and recalls that they arrived at the branch by 4:57pm.

Labina's husband tried to call the number listed in the SMSes Arjuman received, but waited on the line between five to 10 minutes before giving up — by this time, Labina was able to meet with an officer at the branch.

Meanwhile, she told her mother to update her passbook outside — that's when she discovered the other three transactions:

The first transaction for S$100 at the top of the page was her topping up her EZ-Link card at an MRT station machine, while the S$250 cash deposit at the bottom was made by Labina and her husband in order to help her pay for some bills due that were to be deducted by GIRO from her account.

After some back-and-forth, including going to the nearby police station to file a report, the bank teller told them she had sent tracers to the DBS Mumbai branch, where the money should be passing through before being sent on to the four Indian bank accounts.

Labina requested the details of the four bank accounts, and was able to retrieve them from the branch officers the next day at noon. She also called the hotline listed in the SMSes Arjuman received on Tuesday, and was told they were already aware of the fraudulent transactions and that they had reached out to DBS Mumbai about them.

On Tuesday, Jan. 14, Labina went to an SBI branch to enquire about her mother's case, but was told that the Singapore branch was a separate entity from the Indian SBI, and so they could not help her.

On the same day, she received a call from DBS, which informed her that they had heard back from their Mumbai counterparts, and they had sent tracers to SBI and ICICI correspondingly.

Taking matters into her own hands

Now that things appeared to be in the hands of individuals more than 3,000km away, Labina decided to take matters into her own hands, tapping on her personal networks.

Clients she worked with were able to connect her to a chairman at DBS Mumbai who, according to Labina, told her client in a conversation on Wednesday (Jan. 15) that the money never passed through them.

She subsequently discovered in a meeting later that day with DBS Westgate representatives that the bank uses a cost-saving measure called a "straight-through process" for overseas bank fund transfers — basically, it sends monies immediately to an overseas receiving bank without needing to send them through any human intermediaries like DBS's foreign counterpart.

Labina then went to the Bangladeshi and Indian High Commissions in Singapore, filing reports there and getting them to send letters to their counterparts in India.

She even managed to alert officials at the International Criminal Police Organisation (INTERPOL) branches in both countries about the case.

"This is all done informally because of channels that I am blessed to have connections with. We have managed to inform INTERPOL both on the Bangladesh and India side to hold the funds, so as of now, they have managed to block the accounts, but the money was already withdrawn (from the Indian accounts) on the 13th and 14th."

But the money was already taken out from the accounts

Sadly, Labina would eventually find out from contacts at SBI and ICICI -- that she eventually managed to reach on Jan. 17 -- that the transferred funds were withdrawn from all four accounts by Tuesday (Jan. 14).

Only one of the three SBI accounts, which the bank has since frozen, was left with a balance of 500 rupees (S$9.48).

Their corresponding owners' contact numbers registered to the accounts were all incorrect and didn't work either, according to Labina's understanding, after managing to speak to personnel from both banks.

Filed reports with 214 officers at 4 police stations

On ICICI's end, the bank required a local police report to be filed before it would be able to freeze the account that received the S$18,000, so Labina filed reports with all 214 individual police officers she could find at four different police stations.

By the time she did that, though, the funds were already gone before the bank could freeze the account — and they did, eventually.

What can other people do?

Through all this, Labina remarked that she was only able to find out as much as she did because she was able to tap on connections she had to the respective authorities in India.

And while Labina had a helpful and positive experience with the lower-level customer service staff at DBS Singapore, her experience with more senior-level managers left a poor taste in her mouth.

She mentioned in particular a director at DBS's Westgate branch who entered a meeting with her, her mother and her husband asking "how long is this meeting going to take?"

"If you're not connected the way I am, you are at a loss. They (other people who lose money to scams) trust the bank (to pursue the missing funds to the fullest extent). But if you're going to have officers, directors, managers, people working for a bank at management level like that, they're not going to be helpful. What kind of people is DBS bank hiring? Why are they so incompetent? ...

If you're putting your people first, your customers first, why is it I felt like you were mocking me? We sat down in a meeting, he is in a rush to go. Other people who lost money never got a chance to do that. It's based on my insistence... and he could brush me off that I could reach Piyush Gupta (DBS's CEO)."

Her mother, in the meantime, has been having trouble sleeping and eating from the stress of losing her savings. Labina says she and her husband are in a place where they can still replace the losses her mother suffered from her mistake, but she is still looking to seek compensation from the bank for what they went through.

She also shares with Mothership that numerous other scam victims who lost money have also reached out to her since going public with her story, sharing their own accounts of what happened to them.

In almost all the cases shared with her, Labina says none of them got their money back either.

In short, though, the most simple thing to remember from all this is to protect your bank login details at all times — one thing she says the DBS staff repeatedly told her was that staff will never ask for a user's login details or OTP, whether on the phone or in person or over email or text.

So if this can at the very least be a learning lesson to any of your parents or grandparents, remind them never to give anyone their iBanking login details or one-time passwords.

Or, as Labina and her husband now think, it might be better to resort to storing your savings in tins under your pillows at home.

Related articles:

Top photos courtesy of Labina Fariah.