Alert – ‘You’ve been rumbled. You’ve been caught’: Moment BBC’S Scam Interceptors hack into system of phone ‘fraud factory’ in Pakistan and confront the criminal mastermind who has conned thousands of Britons into handing over cash from a Lahore call centre

This is the moment the mastermind behind a prolific phone scam conning Britons out of their hard earned cash by pretending to be 02 was finally caught out. 

Ahmad Sarfraz is the boss at the centre of one of Pakistan’s most prolific fraud factories targeting British households.

Workers in his scam call centre make calls to UK phone numbers and pose as customer service staff from mobile phone provider O2. The scammers do this to gain access to customers’ accounts so they can order mobile phones worth thousands of pounds which they sell on. 

But BBC‘s fraud-busting show Scam Interceptors finally tracked Ahmad down and confronted him over the phone – telling the fraudster: ‘Why are you pretending to be from O2 and scamming people from the UK?

‘Why are you pretending to be from the big mobile phone companies when you’re nothing to do with them?

‘You are lying and you are scamming people and you have been rumbled’. 

The investigators then watched remotely as Ahmad frantically tried to cover his tracks by changing the name and photo of his fake O2 online profile. 

But the BBC team did not back down, with presenter Rav Wilding telling him: ‘Why are you trying to sign out Ahmad? We know you have been breaking the law. Why are you scamming people out of money?’ 

A distorted voice on the other side of the line told Rav he’d got the ‘wrong number,’ but Ahmad was told ‘this is not the wrong number, this is the right number’. 

Through a colleague who speaks Punjabi, investigators then overheard a panicked Ahmad telling someone in the background ‘I don’t understand how they got my number though’. 

Whilst Ahmad denied the BBC’s allegations, the broadcaster said it was clear their call had shaken him and his business. 

His busy and active call centre was completely shut off following the confrontation and the business is believed to have stopped trading – for the time being at least. 

Money Mail had raised the alarm over the scam in April, but a new investigation run by Scam Interceptors lifted the lid on the unscrupulous people behind the con.

With the help of hacker Jim Browning, who works undercover to use his technology skills, Scam Interceptors was able to break into Ahmad’s operations and listen to the Lahore centre’s phone calls, following their movements for nine weeks.

Its findings provide an extraordinary insight into just how these criminals operate.

Official fraud data, sent to the Government today by industry body UK Finance, reveals that 17 pc of all scams begin with a phone call or text — and the losses are enormous.

Ahmad’s criminal gang, it appears, purchased a hit-list from the black market containing hundreds of UK mobile phone numbers. 

However, they don’t know which belonged to O2 customers.

Ahmad begins by methodically entering the phone numbers into O2’s website, which then instantly confirms whether the number is linked to an O2 account.

Those that do belong to an O2 account holder are passed on to a call handler, who immediately dials the number. The call handler then poses as O2 staff, calling to offer a fake one-off promotional deal.

When the customer answers, a friendly man’s voice says: ‘Hi, good morning, this is Ali here, calling you from O2. First of all, how are you?

‘The reason for my call is that O2 are running a promotion and we are going to reduce your monthly bills. For six months, you’ll pay just £7 without any change, all right?’

It sounds like a great deal, but there’s a catch — in order to unlock the offer, you have to verify your account. Ali asks for the email address linked to the account.

He then says he will generate a one-time passcode that will be sent to the victim’s phone, which they must read out to confirm their identity.

But this code isn’t linked to any deal. Instead, it’s the key that will give scammers access to their target’s account.

While the scammer is on the phone, Ahmad is busy on his computer. He enters the target’s email address into the log-in on O2’s website and clicks ‘Forgotten your sign-in details’.

This automatically sends a six-digit passcode to the account holder’s mobile phone. Once they’ve handed over this code, Ahmad and his team can log into their account and are a step closer to taking full control.

Within seconds, Ahmad has changed the password and email address linked to the account. He then orders several expensive mobile phones, tablets and smart watches to arrive at the victim’s home, all of which they will be billed for.

As part of the promotional deal offered by Ahmad’s team, victims are often told they will receive a phone upgrade. However, a few days after the phone call, they receive several electronic devices — none of which matches the one they were promised over the phone.

The Lahore-based scam factory relies on the good-natured honesty of their victims. Most are quick to report the incorrect parcels to the number left by the scammers.

In the programme, O2 customer and victim of the scam Tracey Underwood explains how the rest of the con works.

Tracey, 51, says she was delighted when she received a phone call out of the blue telling her she qualified for a promotion to reduce her monthly bills and replace her phone.

Since she had worked for a mobile phone company previously, the fitness instructor from Cornwall knew the terms that were used in relation to phone contracts and the call handler appeared to be genuine, she says.

‘I felt confident — their language was so convincing,’ she said. 

‘A code came through and a message on it said it was not to be given to anyone. I questioned them on this but they said: ‘We’ve just sent it to you and if you don’t give the code, you will have two mobile phone accounts set up in your name and you are going to be charged twice.’ ‘

Reassured, Tracey read out the code. . . and in doing so, she had unwittingly given the scammers the code that would start the process of changing her password.

She was then tricked into giving the answer to her security question. Now the scammers had full access to her O2 account.

A few days later, an iPhone 13 and an iPad arrived in the post at her home — she had not been expecting either of these devices.

‘The phone that arrived wasn’t the right one and I knew it was much more expensive, so I messaged them on the number they had provided during the call. They said they had an angry customer who had received my phone and I had his order.

‘They told me it was no way my fault and said that if I could package them both up and send them to the distribution warehouse, they would issue my new phone as soon as they’d received it.’

Tracey was given a PO box number in Nottinghamshire to which she was asked to post the devices.

She sent the phone and tablet in the post and waited for her parcel to arrive — but it never came. And any calls she made to the fake O2 centre went unanswered.

She says: ‘The moment it dawned on me I had been scammed is when I messaged them — on the number they gave me during the call — on the final day my new phone was meant to turn up.

‘I felt anger and embarrassment that I’d been conned. And stupid that I’d let them convince me.’

In reality, the PO box belonged to a person acting on behalf of Ahmad’s criminal ring, according to Scam Interceptors. Once they received the package, they sent it on to Lahore in Pakistan, where the phones were unboxed by Ahmad himself, as shown on the BBC show, and sold at market.

On social media, Ahmad, the unscrupulous young criminal, shared pictures of his lavish lifestyle, funded with the money stolen from Britons via the O2 scam.

On Instagram, he can be seen in expensive 4x4s and what appear to be designer clothes, including Louis Vuitton logo belts and sharply tailored suits.

He posts photos of himself unboxing expensive phones, smirking at the camera while holding up what appear to be the proceeds of his crimes. However, Ahmad’s bragging came to a sudden halt after he was confronted by the Scam Interceptors team, who managed to pin down a location for the fraud factory after a member of his staff placed a food order online to be delivered to the call centre office in Lahore.

After the show aired on Monday, presenter Nick Stapleton told Money Mail he believes the gang is likely to change location and phone numbers and start up again.

‘We informed the police and know they stopped operating at that address, but it is like whack-a-mole — they are usually quite quick to set up operations again elsewhere,’ he says.

‘It’s a fiendishly clever scam,’ adds his co-presenter, Rav Wilding. 

Wilding and Stapleton question how these gangs can be allowed to input hundreds of phone numbers and generate password reset codes from one internet address in Pakistan without raising any suspicion from phone network provider O2.

When asked why there is no alert system in place, a spokesman at O2 explains that the company has ‘different monitoring capabilities in place to detect unusual activity and block suspicious IP [Internet Protocol] addresses’.

He said that its focus is ‘very much on customer awareness and education’.

In April, industry insiders told Money Mail that O2 was lagging shamefully behind its peers in the fight against fraudsters. The UK’s largest mobile network has been leaving millions of customers exposed to scam text messages and calls, experts revealed, because it has taken years longer than its rivals to implement anti-spam shields that stop scam messages reaching mobile phone users.

O2 provides 34.1 million mobile phone connections — and, as well as its regular customers, many vital services rely on its network, including more than half of the UK’s police forces, many ambulance and fire services, local councils and Network Rail.

A spokesman for the company says: ‘We’re grateful to BBC Scam Interceptors for helping to raise awareness of this highly sophisticated, organised, and international crime, which is using professional scam call centres to target innocent consumers in the UK. Customers should never share a one-time code with anyone who has called them unexpectedly. We’re doing all we can to keep people safe.’