Lebanese Expat Drained of Entire Bank Balance in Kuwait Mobile ID Scam
A Lebanese expatriate living in Kuwait has been left with a nearly empty bank account after falling victim to a highly sophisticated cyber fraud targeting the official Kuwait Mobile Identity (Hawiyti) application.
A masterclass in social engineering
The incident, which occurred around 8:30 a.m. last Tuesday, highlights the dangerous precision of modern scammers. According to reports, the victim received a call from an individual who appeared to possess intimate knowledge of his personal life.
The caller was able to identify the victim's specific occupation and was even aware of his ongoing efforts to arrange visit visas for his parents. This level of detail allowed the scammer to build immediate trust and bypass the victim's natural suspicion.
The fraudster claimed that the visa application had been rejected due to outdated biometric fingerprints. To resolve the issue, the caller instructed the victim to approve an authentication request that would be sent via the Kuwait Mobile Identity app to schedule a necessary biometric update.
From full balance to 900 fils
Believing he was following a legitimate government procedure, the victim approved the request. The consequences were almost instantaneous.
The victim first received bank notifications for small withdrawals of KD 25. Shortly after, he lost all access to his account. Upon successfully regaining access, he discovered a devastating reality: his entire balance had been wiped out, leaving him with just 900 fils.
Crucially, the victim noted that he had not shared any One-Time Passwords (OTPs), banking credentials, or verification codes during the interaction. This suggests the scam bypassed traditional security measures by using the app's own authentication process to authorize the theft.
Authorities issue urgent warnings
The accuracy of the personal data used by the scammer suggests a potential data leak or highly advanced social engineering tactics. In response to the incident, Kuwait’s General Department of Criminal Investigation and the Cybercrime Department, along with financial institutions such as Gulf Bank, have issued stern warnings.
Authorities emphasize that approving unsolicited authentication requests can grant fraudsters the authorization needed to execute illicit transactions. To protect themselves, residents are urged to follow these safety protocols:
- Never approve unsolicited authentication requests sent to your mobile ID app.
- Verify the source of any official-sounding calls by contacting the relevant government department independently.
- Avoid clicking suspicious links sent via SMS or messaging apps.
- Report suspicious activity immediately to your bank and law enforcement authorities.