Association of Ukrainians files complaint with national data protection commission
The Association of Ukrainians in Portugal has filed a complaint with the National Data Protection Commission (CNPD) after hundreds of immigrants in Portugal have been contacted by mobile phone by someone who introduced himself in Russian as an inspector from the PJ Judicial Police (PJ).
The caller asked for personal information, including bank account numbers.
Russian immigrants (“opponents of Moscow”) living in Portugal have also been among people contacted in this ‘vishing’ scam, association president Pavlo Sadokha tells reporters.
voice phishing
Vishing, short for voice phishing, refers to fraudulent phone calls or voice messages designed to trick victims into providing sensitive information, like login credentials, credit card numbers, or bank details.
“About two months ago I myself received a phone call from a Portuguese number, in which a lady introduced herself in Russian as a PJ inspector saying that there had been a scam and that money had been taken from my bank account, asking me to confirm my details”; Sadokha adds. “I realised it was a mistake or even a scam and hung up.
“My contact details are on the association’s website, it’s public, but then there were complaints from other members of the association, and Ukrainian immigrants started commenting on social media that the same thing had happened to them”.
As far as Pavlo Sadokha can tell, “hundreds” of fellow countrymen have been targeted.
“Victims are mainly people of Ukrainian nationality, but some Russian immigrants have also been contacted.
“In most cases, the person on the other end introduces themselves as a PJ inspector, but it has also happened that they introduce themselves as a bank employee or even a public prosecutor.
“It is always someone who speaks in Russian and knows the name and surname of the person they’re contacting,” he adds.
This far none of the potential victims appear to have been taken in. Indeed, some have already filed complaints with police – which is what led the association to report the situation to the CNPD.
Sadokha says he suspects this is all down to some form of “massive leak of data from Ukrainians, following some kind of security breach”.
“As the victims of these phone calls have nothing in common other than being of Ukrainian nationality or origin (they are not members of the same social media groups), we suspect that some bulk personal data – indicating mobile phone numbers with first and last names and possibly nationality – has been breached or stolen,” his association’s complaint to the CNPD explains.
Many of the numbers of the people targeted do not exist in the association’s database, Pavlo Sadokha continues, indicating that the “only common element” is that they are part of social media platforms common to immigrants in Portugal.
He referred to cases where victims were threatened after refusing to hand over their data, but stressed that the conversations “never mention political issues”: they simply concentrate on trying to access bank details.
In the summer of 2023, the PJ revealed a similar vishing scam, but in the English language. Their advice to people beyond saying “do not give out your personal details or follow the instructions you receive”, was “record the number of the contact made and contact the Policia Judiciária or another police organisation to report the situation.’
The good practice guide from the National Cybersecurity Commission (CNCS), available on the organisation’s website, advises that in order to protect personal data no one should click on attachments or links in suspicious emails or messages – and absolutely on no account should any sensitive data be given out.
natasha.donn@portugalresident.com
Sources: Diário de Notícias/ Lusa/
