Central Bank of Barbados alerts public to BiMPay social engineering fraud

A customer lost funds after sharing BiMPay codes with a third party posing as a lender. The Central Bank says the platform itself was not breached.

BiMPay fraud: customer tricked into handing over security codes in fake loan scheme

The Central Bank of Barbados has issued a public warning urging BiMPay users never to disclose verification codes, tokens, passwords or any other security credentials to third parties, Barbados Today reports. The alert follows a confirmed case of social engineering fraud linked to a fraudulent online loan offer.

The BiMPay platform itself was not compromised, the Central Bank confirmed. The fraud was made possible after a customer voluntarily handed a third party three separate pieces of security information — a mobile verification code, an email verification code, and a BiMPay token — in connection with what they believed to be a legitimate loan application. A transaction was subsequently carried out without the customer's authorisation.

The bank was explicit on what these credentials are for: BiMPay verification codes and tokens exist solely to allow a customer to register and access their own account. They are not instruments to be shared with lenders, agents, or any other individual under any circumstances.

The Central Bank singled out social media, messaging platforms and other online channels as the primary vectors through which such requests typically arrive. A genuine lender or financial institution, the bank stated, has no need for a customer's BiMPay verification code, token or password in order to process a loan or transfer funds to that customer.

Customers are urged to independently confirm the identity and legitimacy of any person or organisation that requests financial or personal information, particularly when initial contact came through social media.

Anyone who has already shared a BiMPay verification code, token, password or other security information with another person is advised to contact their financial institution immediately and take steps to secure or disable their BiMPay access. Those who believe they have been defrauded are also asked to report the matter to the Barbados Police Service.

The Central Bank said it continues to work with participating financial institutions to reinforce protections for users and to raise awareness of social engineering and other forms of payment fraud.

Source: Barbados Today