TymeBank online “security” sucks

“If you are happy with your security, then so are the bad guys”

A few days ago a friend sent me a WhatsApp voice message warning about the dangers of “tap to pay” cards. I had a look on my TymeBank app but it provides no information, so I contacted them on Twitter. Big mistake. Someone saw my post and told me that they have a “very helpful” WhatsApp number: 081-591-8538. Turns out it was fake, but I didn't know that at the time. Now the crooks are using 064-022-6823, 062-858-2151, 064-121-8862, 083-539-9981 and 076-847-4973

Fairly convincing: helpful options, no spelling mistakes. But here's the kicker: once you choose your option, you have to provide your ID number and the last 4 digits of your card number. That's all they need to login to your account and steal your money. They left R0.87 behind. How kind. Plus they changed my login password and my login PIN.

• My first problem is this: all the OTP are carefully crafted to fit into less than 160 characters (SMS length), but provide little or no meaningful information:

  TymeBank. Never share this One Time PIN with anyone. Use OTP 9411 to change your Login PIN or Internet Banking password. For help 0860999119. 09Dec 22:14

  
  Had I known that my ID number and the last 4 digits of my card number were all that is required to log in to my account and reset the login password, I obviously would have been more careful.

• My second problem is that neither the SMS messages nor the banking app on my phone bothered to tell me that the login PIN had been changed. They sent me an email. Except I don't receive emails on my phone, and I wasn't in the office on a Saturday evening. They may as well send it by registered letter for all the good it did.
• My third problem is that in order to send money to someone's phone, no OTP is required at all. Nothing. I have checked the OTP messages sent to my phone and there is absolutely nothing referring to sending money to anyone. But the app conveniently told me that the money had been sent, after it was sent. Too late of course, but still. And once it has been sent, the money voucher cannot be cancelled or reversed.
• My fourth problem was when I realised I had been defrauded. I called 0860999119 and reported the fraud. The first lady who answered the call was basically clueless, and didn't ask for my email address or home address, just my ID number. That only happened later when I checked that 0860999119 was in fact a genuine number for TymeBank. On the second call I was asked for my details, and told that I would receive an SMS with the fraud reference number GFD-126181. I'm still waiting for that SMS from the first call, or the second call.
• Another problem: TymeBank claims to be concerned about my security, but my account cannot be protected by secure second factor like a Google Authenticator code. It's simply not an option. Nor is there any option to limit the size of a tap-to-pay transaction. SMS is not secure. Everyone in the financial sector knows that. But they choose to use it anyway. Insecure by design.

Naturally, I will have to wait until Monday for anything to happen. And it will take a week or so for them to think up a weasel excuse for not refunding me the money. In the meantime, my Christmas is ruined.
No one can explain why the SMS messages don't tell you what the code is for. Nor can they explain why there isn't a security check when you send money, or why the fraud case number hasn't arrived by SMS. Maybe that only happens when someone actually looks at the case, by which time it is too late to reverse the transaction, naturally. Their system is designed for fraud to take place.


Update Sunday 10 December: TymeBank doesn't appear to monitor their own Twitter feed for scammers like this:

Update Monday 11 December 2pm: I got a call from the fraud department (010-241-1363), who can't explain why the message with the fraud case number was not sent, but can assure me that I received and read all their OTP messages. They don't have a facility to disable tap-to-pay, but I do: it's called a microwave. Pop it in for 1 second and the tap-to-pay (and the chip-and-pin) will never work again. “I'm sorry about that we do apologise sir” is a phrase they use often and repeatedly, along with “I hear you”, but until they change the way their systems work, it means nothing and they “heard” nothing. Apparently it's easier to refund R769 than to improve the security of the business. It's not the employee's money they are wasting.
They are an internet business that doesn't have any branches, but they don't operate on internet time, only government time. That leaves plenty of time for the crooks to do their dirty business. They have 4 cell phone numbers from this blog, and they have probably seen these numbers before, but they have not found out from FICA/RICA who owns those numbers, or made any arrests. And they don't seem interested in finding out either.
The lady who called asked me to remove this article. Apparently I will still get a refund if I refuse. We will see. The refund will most likely happen within the next 5 working days. I'm not holding my breath.
Update Tuesday 12 December: TymeBank Twitter account hadn't blocked @Hajra32021956, until I suggested it, even though they are supposed to monitor the activity on their own Twitter feed. Hopeless. And they seem to think that if I block @Hajra32021956 the criminal activity will somehow stop. Clueless.

They block their critics warning of their problems, but allowed the scammers to operate for weeks with impunity. Clueless.

Further update 12 December: I received the following email:

From: Fraud Operations Mailbox <FraudOperations@TymeDigital.com>
Sent: Monday, December 11, 2023 3:34 PM
To: Donn Edwards
Subject: Liability letter for GFD- 126181

Good day

Thank you for contacting TYMEBANK.

Your Fraud Dispute with Case number GFD- 126181 has been finalized.

Kindly find attached outcome letter

Regards

Fraud Operations

Phone +27 (0)87 286 8833
Email fraudoperations@tymedigital.com
4th Floor, 30 Jellicoe Avenue, Rosebank 2196

www.tymebank.co.za

TymeBank is an Authorised Financial Services Provider (FSP49140).
Tyme Bank Limited Reg no: 2015/231510/06

To which I replied:

From: Donn Edwards
Sent: Tuesday, December 12, 2023 6:54 PM
To: 'Fraud Operations Mailbox' <FraudOperations@TymeDigital.com>
Subject: RE: Liability letter for GFD- 126181

Dear “Fraud Operations”

At what point is this process do you acknowledge that I was not informed in a timeous manner that my login PIN and password were changed, in the same way that I get a notification when the balance changes?

Please can you supply me with the police case number, or do I need to open one myself?

How many times do you get LEGITIMATE withdrawals where:
1. The login PIN was changed;
2. The login PASSWORD was changed; and
3. All the money in the account was sent to a mobile number not used before on the account,
All within a short period of time, such as 30 minutes?

If not, why does your system not throw up a fraud alert when this happens?

When do you plan to obtain the FICA/RICA details of the following phone numbers used by these fraudsters impersonating the bank?
081-591-8538
064-022-6823
062-858-2151
064-298-8774
081-043-4791

I await your prompt reply, and will be visiting your offices tomorrow.

Best wishes
Donn Edwards

I'm still trying to figure out how to sign the outcome letter which is a read-only PDF format document. I don't think these muppets throught it through, do you? As it turned out, I was unable to visit their offices to deliver the signed letter. But I have scanned it and sent the scanned image containing my signatures.

Update: 14 December 2023: I just received the following email message

In the meantime I have replaced my TymeBank debit card with a Pick 'n Pay Smart Shopper card.

Update: 16 December 2023: According to the outcome letter they sent, my account has been blocked. Perhaps that would explain why they have not refunded the stolen money yet. I'm not holding my breath.
Update Monday 18 December: The refund finally arrived. I have transferred it to my FNB account.

SARS: We steal for Zuma

A few years ago, before Jacob Zuma became President Zuma, Julius Malema headed the ANC Youth League and famously said that the ANCYL would "Kill for Zuma" if necessary. Now have a President Zuma with a "fire pool" at his residential palace in Nkandla, built largely with taxpayer's money and other more dubious sources.
I am one of those taxpayers, and on Wednesday I was subjected to a what I can only describe as theft: an official from the South African Revenue Service took it upon herself to snoop around in my bank account, check the balance, and deduct the money she found there. No warning, no explanation, no due process. On the 9th March my balance was R3,167.75; on 10th March she issued an order to deduct R3,100 from my account. Nice of her to leave me R67 for the rest of the month. Quite generous, really.

In the meantime there were other transactions in the account, so the balance after her little "breaking and entering" stunt was R350 in arrears. Good job I have a R500 overdraft or the transaction would have bounced and I would have been hit with some outrageous bank fees. Of course the FNB doesn't have any security mechanisms in place to warn me that someone from SARS was looking at my balance to see what she could take, but they did tell me once the money was gone. Nice one, FNB. You do a great job of facilitating criminal activity, much like HSBC, another wunch of bankers.

It turns out there is a nasty little program in the SARS computers somewhere that can spit out notices like the one shown above, issued (but not signed) on behalf of the Commissioner. And of course computers never make mistakes, and the information input on the system is flawless in all respects. Never mind that the Tax Administration Act of 2011 never contemplated that such notices would not be issued by a human being, let alone not checked by one before signing it. It is quite specific that it should be an official:

179 (1) A senior SARS official may by notice to a person who holds or owes or will hold or owe any money, including a pension, salary, wage or other remuneration, for or to a taxpayer, require the person to pay the money to SARS in satisfaction of the taxpayer's outstanding tax debt.

This becomes important for the next paragraph, which states

179 (2) A person that is unable to comply with a requirement of the notice, must advise the senior SARS official of the reasons for the inability to comply within the period specified in the notice and the official may withdraw or amend the notice as is appropriate under the circumstances.

As an exercise in pointlessness I called the SARS number 0800 00 7277 and asked for the name of the official who issued my particular notice, and predictably I was told that it was issued by a computer and I should go to my nearest SARS office. That's the standard response by a call centre operator when they don't know what to do and won't put me through to a supervisor.
Not only was the notice not issued correctly, it was not sent to me either. I am told it was posted to me by regular mail during the middle of the Post Office strike, but so far no proof has been provided. Since I was told by the person who took the money, I am somewhat sceptical. Especially when that person claimed to have called me on Wednesday 25th February and left a message. Funny that, because there is no missed call on my phone, and no voicemail either. Not even a message telling me there was voice mail.
A bit of background: this is not the first time the "Collections" department of SARS has supposedly sent me a final demand. This is probably the third one, all relating to the 2003, 2004 and 2005 tax years, for which I should have been awarded amnesty 8 years ago when I applied for it under the relevant legislation. This legislation was designed to "regularize" the affairs of anyone running a small business who was not properly up-to-date with their tax affairs or who had never submitted a tax return.
It really isn't a complicated matter, but somehow during those eight years SARS has managed to:

• Lose the application entirely;
• Fail to notify me when the application had been processed (I found out indirectly by accident);
• Ignore my objection letter to some of their original findings;
• Repeatedly call me for the money even though I kept having to explain that the Amnesty application was in progress;
• Take a year or so to realise that the third objection application form should be signed by me and not by the tax advisor;
• Lose the revised application/objection;
• "Agree" with my objection many months after I sent copies via email;
• In spite of "agreeing" with the objection, they took 7 months in 2014 to decide that the 2003, 2004 and 2005 tax returns were not in business earnings but personal earnings, even though the last paycheck I received was in October 2000;
• Write a letter to me on 15 Sept 2014 informing me of this, but not sending it via email (or post) until after the "Final Demand" of 29 Sept 2014 was already issued. Then they sent it to me via email, once the damage was already done.

During this time the "outstanding debt" of R149,218.48 has generated interest of R142,926.21, and continues to do so at a rate of R805.06 per month.
Update: Why am I writing this? Mainly because I can't sleep. I took sleeping tablets on Wednesday and Thursday nights, but on Friday morning I woke up early and couldn't get back to sleep, and it's now Saturday morning and I am tired of tossing and turning and figuring out how to get SARS to fix my situation the way it should have been done in 2007. So I'm frustrated, gatvol and outraged that some low-level accountant thinks she has the right to go snooping around in my bank accounts and deducting money without my consent.
Update Thursday 12 April: Amnesty department say they can't modify my 2003-2005 tax returns because the computer system won't let them. I guess a manual calculation is beyond them any more.
Update Thursday 14 May: I had a meeting with the Debt Management department at Megawatt Park (now unofficially known as MegaWTF Park) where they casually told me that the "Final Demand" doesn't need to be issued by anyone at all, and it was purely a courtesy that it was issued to me. We'll see about that. They also made a number of other outrageous statements, which will be the subject of several other blog posts.
Update Thursday 11th June: I got a letter from the head of the Amnesty department approving my 2006 Amnesty application, and my account now shows a credit balance of R87,864.58 ;-)

See also: Tax Collectors and Sinners and SARS is making me sick.

WTF? Ducking and Diving from Oxygen8

Is there no end to the web of deception and deceit practised by Morvec, Opera Telecoms, Go Go Mobile and Oxygen8? Morvec are the guys with a domain and email address in the UK, and a box number in Hong Kong. Go Go Mobile have an 0800 number in South Africa but refuse to divulge their address. Trevor Louw, the "MD" of Opera Interactive is also the "Internal Account and Customer Services Manager" of Oxygen8 Communications with telephone number 011-218-5600. Between the three of them is an unhappy mix-up that has resulted in R70 being deducted from my phone account at MTN without my permission or prior knowledge.
On Wednesday Paul Barrat (Morvec) tried to get me to agree to a "full and final settlement" in exchange for a R100 refund. Today I complained to both Morvec and Trevor Louw that the promised refund had not been provided. They gave some feeble excuse about the refund only being sent on Monday. Clearly they are not taking this matter seriously, since it was promised on Thursday. When I pointed out all the ducking and diving going on, I got a heated and indignant reply from Trevor Louw:

With all due respect – we do not go around looking to pinch an odd R28 here and there – the matter of the fact is there are many south Africans out there who are not affected by this simply because they did not engage in any services. The mere fact that we know what model of handset you use proves that there was interaction between your handsets [sic] and the wap sites that Morvec run that is no co-incidence. We have no time changing dates and times – dates and times are recorded by machines that handle the interaction between your handset and the sites that are being visited. I would really like to think that you are a man of reasonable intellect, you have gone to many lengths to get this sorted – WASPA is the ultimate organization that can see us getting fined a lot of money if compliancy was at stake here, and in this light we take this very seriously especially as opera telecom. In the interim we have afforded you a refund; Morvec has a deadline that they were given by WASPA to respond to your complaint I believe they still are within that time period. In due course you will get your response and WASPA can make an informed decision looking at the evidence that is provided to them.

Of course this rant is only partially true, so I have taken the trouble to point out some of the discrepancies:

Had your company had taken my initial complaint seriously and given me the refund I demanded when I called on Friday 10 June, I would not have complained to WASPA. But your company refused the refund, and fobbed me off with a telephone number that doesn’t work. So much for customer service.
Instead, your company continued to bill me, in spite of my email to be added to your Do Not Contact list, and an Unsubscribe request from WASPA. All of these were “processed” by yourselves *before* the deductions of 18, 19 and 21 June.
Your technical information has changed several times:
From Ant Brooks:
According to our system, Morvec removed you from their systems on 2011-06-16 and also indicated that they have blocked your number from any further billing. They also provided us with proof of your subscription, with the following log entry

MSISDN: 27789389XX7 [not my number]
NETWORK: MTN
HANDSET: Samsung SGH-J700
DATE: 2011/05/23 00:01
IP ADDRESS: 41.208.50.193
Do these logs seem to have any validity to you? If not then we'll escalate this matter, since that indicates that you may have been subscribed without your consent.

From Morvec to your customer services:

Please see below opt in information and answers below

MSISDN	27833104XXX
DATE	23/05/2011 00:01
HANDSET	Nokia 5130
IP ADDRESS	41.208.50.193

From Morvec to me:

the below date and time must have got corrupted before they were sent, the actual date and time are as follows
21/05/2011 15:01:06

From you to Doris at MTN:

See response from the SP – I have asked for some screen shots as well, is there any way that you could collate this data with what you may have on your side to see if all makes sense?

Date	Url:	Handset Details	Ip Address	Shortcode
21/05/2011 at 22:01:01	http://mobilewap1.oit.co.za/?c=160	Nokia 5130	41.208.50.193	31979
18/06/2011 at 18:43:35	http://mobilewap1.oit.co.za/?c=206	Nokia 5130	41.208.50.193	42977
19/06/2011 at 14:09:24	http://mobilewap1.oit.co.za/?c=200	Nokia 5130	41.208.50.193	31801
19/06/2011 at 18:27:38	http://mobilewap1.oit.co.za/?c=206	Nokia 5130	41.208.50.193	42977
21/06/2011 at 21:20:42	http://mobilewap1.oit.co.za/?c=206	Nokia 5130	41.208.50.193	42977

This user has entered into 4 campaigns in the last 3 days by clicking on WAP Banners or Text Adverts. We currently use 31801 and have also recently tested on 42977 for a new agency with seperate advertising campaigns so that we have one agency per code which is easier for me to keep track of results from each agency.

So please don’t tell me that you aren’t changing your minds. And where are all the confirmation SMS messages you are required to send? And where all my replies? There aren’t any.

I can confirm that On 18 and 19 June I displayed ads for “The Mob Club” on Cricinfo, but those URLs are c.admob.com, not mobilewap.oit.co.za, and I received an email from The Mob Club assuring me their ad campaign had nothing to do with the short codes mentioned above. Their short codes are 31927 and 31848. The full URL I recorded on my phone is: http://c.admob.com/c1/4/EkwmvDjF8bEkKw-kMaMDS074DFCA384006D60447277526020d4fd670629663d74205e?uurid=1F70C50F7F91EA49EC0CDB2CB703C45&uut=t&e=%28NEE1RkMzNjBENTY2MCw0NjAwNzA2NSww

This is all clearly documented in my blog post

In the interim you have refunded only the first two deductions, and tried to get me to send a “full and final settlement” for the remaining deduction. Presumably that is to avoid another R100,000 fine like you got for WASPA complaint #6868.

In the meantime I have had a meeting with MTN to try and prevent companies like yours from stealing money from my phone. They are being most helpful.

One other point I only noticed while writing this blog post: The last date of 21 June is clearly wrong, because the MTN call centre was able to tell me about the deduction before my lunchtime meeting with the MTN executives, a full 8 hours before I allegedly subscribed.
The initial “subscription” date has changed 4 times
23/05/2011 00:01 on a Samsung phone
23/05/2011 00:01 on a Nokia phone
21/05/2011 15:01:06 on a Nokia phone
21/05/2011 at 22:01:01 on a Nokia Phone
Update 3pm: Amazing how a "refund" payment that could only happen "on Monday" is suddenly sped up when I pointed out they were lying and not treating the matter seriously. I guess they hope this will make me shut up and go away. After all, it has only been two weeks since they ignored my first complaint.
Monday 27th, 4pm: I left a message for Andre Kruger (CEO, Oxygen8 South Africa) at 011-218-5600 to call me. Funny, he hasn't called. The call could have saved him a lot of trouble.
Update Thursday 30th June: Steven Hunt, Director of EMEA, Morvec Limited, writing from his WorkPC at 86.179.131.67 (Bournemouth, UK) sent a long rambling response to my WASPA complaint. I'll have to pick my way through it and respond to WASPA. It contains many inaccuracies and misrepresentations, but I expected nothing less.

How to Steal from MTN Cell Phone Subscribers

How Admob, MTN, Nokia, Opera Telecom, Go Go Mobile and Morvec are stealing money from my phone account.
These telecoms guys have an interesting new definition of the word "permission"; and it violates all ethical norms and codes of conduct. But that never stopped these companies from making a quick buck before.
I have finally figured out how it works, and how they "caught" me before. I remember on the day of the IPL Cricket final going to m.espncricinfo.com, the mobile site for CricInfo, to see what time the match would start. The site was overloaded, and very slow. I vaguely remember clicking on a display ad by mistake. It's an easy enough mistake to make, given how slow the graphics were loading. It was right at the top of the page, and I had scrolled down further already, but the cursor obviously hadn't moved yet. When this advert page appeared, I selected "back" and continued.
It turns out that purely by viewing this page, R14 was deducted from my phone account every 3 days until I noticed. I did not have to click any buttons, or agree to any pricing, or even be aware of what they were selling, if anything. Think of it as the virus of Internet display ads.
Last night I decided to retrace my steps, and see what happened. Using the built-in browser on my Nokia phone, I loaded up m.cricinfo.com and selected the "Live" cricket match. In this case it was England vs Sri Lanka. At the top and bottom of the page is a banner ad (from admob.com) that says: "Fun Mobile Videos Click Here". There is no indication of any cost involved before you click, and once you have clicked on the link the web site gets the MSISDN (subscriber) number from the phone. I have no idea whether the privacy geniuses at Nokia or MTN decided to give away my identity online in this fashion, but there you have it: it gets used for fraud without the phone owner's knowledge or explicit permission.
Later on, you might get a message from the robbing party informing you how to cancel your subscription, but by then the first amount has already been deducted. If the MTN network doesn't deliver the SMS, then that's just too bad. On 21st May I got no such message, so Morvec just kept deducting money until 7th June, by which time all my airtime was exhausted.
Last night I got a message after I clicked on the ad, and sent the "STOP" message immediately, but not soon enough for the MTN call centre to tell me today that another R14 had been deducted from my phone. So much for telling Opera not to subscribe me ever again. I guess they just aren't prepared to listen. According to the Morvec email I got:

Your cell number clicked on one of our banners via the mobile Internet and then accepted the terms and conditions [of] our wap page. Your number is automatically passed to us when you click on our Join button by the Mobile Networks.

Never mind that there is no "Join button" on the ad to click on. The text of the ad reads:

Scroll down & CLICK THE BUTTON RIGHT NOW & join the FUN!!
ENTER HERE
Bringing u great Games, Videos and more & great value, wallpapers and Screensavers cost jusr R10, Videos R25, Mobile Games R28! This is a subscription service charged at a minimum of ONLY R14 every 3 days which you can use to buy EXTRA content EVERY TIME - CLICK NOW ....
If billing is unsuccessful, retries for this billing cycle will be retried at discounted amounts and potentially on different days, by joining the service you are providing your explicit permission for this to happen. Cellmates has requested that your mobile number be made available.
By clicking Enter Here you confirm that you are joining the CellMates Club
For HELP please call 0800982175 or email themobclub@ymail.com - sms STOP to 31927 or 31848 at any time to end
Terms [sic]

What is interesting is that even when you don't click on the graphic and link Opera still steal your money. I suspect this is because the "subscription server" also displays the graphic, and therefore gets the cell number without explicit permission.
Surely the legitimate, legal and ethical way is to actually have a "Join" button that you would have to click on, that would initiate an SMS message to my phone, which would then require me to send the word "JOIN" to their servers? Of course it would! But these guys aren't ethical or honest enough to do that. They deduct first, dodge questions later, knowing that they can rip off a large section of the public without their knowledge. It would also be great if MTN would allow me to block these deductions, but since they get a cut, why should they bother about minor details such as breaking the law?

Update Monday 20th June: This is getting weird. Even though I displayed the above ad 3 times on my phone, and within the hour thereafter had R14 deducted from my phone account, "The Mob Club" (how ironic) sent me the following message:

We understand your frustration, however, the Go Go Mobile service that you have been charged for is in no way associated with our company and service. We suggest that you contact the provider of the service directly on the 0800 number they have provided.
We do buy advertising through Admob so on some occasions you will see adverts for our service and on other occasions adverts for services unrelated to our company, which is clearly what has happened in this instance. Our service is fully compliant with all regulations - before you join the service it clearly states the price, it displays information on how to unsubscribe and it has our full contact details. If you DO NOT click on the 'Enter Here' button to confirm your subscription you will NEVER be charged by our service.
Please remove any reference to our service from this web page since we are not associated with the service you are complaining about. Please confirm when this will be done.

I checked the 31927 short code mentioned by The Mob Club and it is run by: Opera Telecoms. So perhaps Opera should fix up their clearly broken system.

Update Tues 21st June: After The Mob Club (what an unfortunate name) protested their innocence, I displayed their Admob ad again, and checked the balance on my phone. No deduction. Interesting. I am waiting for answers from them and Morvec and of course Opera, but I'm not holding my breath. Perhaps MTN can help. I'm due to meet with them at lunchtime. So far R70 has been deducted from my phone account this month, which is over 70% of my monthly airtime.

I also called "Go Go Mobile" on 0800992230 and the loser on the other end refused to tell me their address over the phone. They claim to be members of WASPA, but aren't listed as such on the WASPA web site. They weren't particularly helpful or forthcoming, although they did promise to investigate. What are they trying to hide?

Update 4pm: I had a 45 minute meeting with 5 helpful executives at the MTN Innovation Centre today. It seems that MTN is planning some tools in future to help customers deal with these annoyances. Many thanks to Bridget Bhengu for arranging things. MTN are investigating my "subscription woes" and will be in touch shortly.

Update 22nd June: Paul Barrat from Morvec phoned me to offer a R100 airtime voucher, but then tried to slip in a "full and final settlement" clause. I'm not that stupid. Just because you put the stolen cookies back in the cookie jar doesn't mean they weren't stolen in the first place.
Update Friday 24th June: That "refund" Paul offered me has still not arrived. And Opera is getting a lot of complaints on HelloPeter too: 233 unhappy customers in the last year. Opera didn't learn from WASPA complaint #6868 where they were fined heavily. I hope they are fined heavily again, because they could go to jail if charged with fraud and theft. Maybe that's why they tried the "full and final settlement" con.

Saturday 25th June: The Mob Club is getting jumpy about their name being associated with this post. Yet they continue to do business with the company that stole my money, and they refuse to proovide me with any details about who they (the Mob Club) are. Why? What are they hiding? Seems like they aren't much different from the rest after all.

We think it would be far better to remove all references to 'The Mob Club' from your blog, not just strike them out, all you have done is visit our service terms and conditions landing page, you have never been subscribed or billed by our service. Frankly we don't like our service named under a headline of 'stealing money'.
Content services use URLs whitelisted by the networks so you may well see many very similar URLs for different services despite the providers behind them having absolutely nothing to do with each other.
We generally have no problem sharing company details at all, but we've never billed you nor have you ever been a member of our services so have no reason to give out this information especially as your original complaint seems to be evolving, again we have absolutely no involvement in it all other than you navigated to one of our services terms and conditions landing pages via banner ads on the mobile Internet and we would rather be left alone and associations no longer made as there is nothing at all contentious relating to us.
So what would be really fair is for you to remove references to us as there is no reason for us to appear on your blog and then we can all move forward.
We hope you manage to resolve your complaint successfully.
Thanks,
Helpdesk.

Well, [un]Helpdesk, I think the best way you can disassociate yourself from the bad apples of the industry is to stop doing business with the likes of scum like Opera Interactive. Then maybe you won't be so embarassed about who you are. But with a name like "The Mob Club" you clearly have no idea.

MTN's Parental Control might block subscription fraud too

Cellphone operators think nothing of playing fast and loose with the accounts of their customers. They allow random businesses to deduct money from these accounts without ever informing the customer or obtaining permission from the customer. It's called fraud; if not downright theft.
Recently Noseweek reported on MTN's efforts to stop a particularly large scale version of this problem, but only because their call centre was overloaded with complaints.

"... MTN call centres and stores had been flooded by thousands of subscribers complaining that they had never requested any content from T Mobile, so the company had decided to undertake an internal audit - which had revealed that the content provider had, in the space of 10 days, sent out debit requests worth more than R500,000."

What puzzles me is why MTN would hand over the money in the first place. Did they guarantee payment up front with no questions asked? Are they that stupid?
Last week my airtime suddenly vanished, and when I called MTN to find out why, I was told of two deductions from my account on 5th and 7th June. I had not authorised anyone to deduct anything. The call centre told me the money had been deducted by "Opera Telecom" and when I called them on 083-916-3089 they said they were unable to provide me with a refund. This is a violation of the WASPA code of conduct.
Today I tried a different approach, which seems to be working. I called Opera's other number, 084-194-2222 and asked for the name of the MD. It turns out his name is Trevor Louw but the company got somewhat alarmed when I asked for his ID number. Why did I need that? I explained that I needed it for the case of fraud I planned to file at the police station. I explained that since they had deducted the money from my account, and had refused to provide a refund, I was now taking the matter further.
They told me that they had done the deduction on behalf of Morvec Ltd, a company whose South African landline number 011-461-3294 is out of service, their postal address is in Hong Kong and their email contact address is in the UK. I told Opera that I wasn't prepared to wait for them to get the refund from Morvec (good luck with that) before they pass it on to me. They could refund me today, since they had made the deduction, and then obtain the refund from Morvec later.

Parental Control

After chatting to the MTN call centre again, I was told there is a "parental control" service that you can access by dialling *101# from an MTN phone. This allows you to block "Adult" content, "Gambling" and "Instant Messaging" services. It only blocks web access to these services. I also find it kind of insulting that they would call it "Parental" control when all I'm trying to do is protect my phone account from MTN's arrogance. Their billing system is the child out of control, not me. It doesn't even add correctly.
Nonetheless it's a start, albeit a pretty feeble one. Vodacom has something similar.

MMS Messages

What really burns me about these services is that they send unsolicited MMS messages to my phone. Since my phone isn't configured for MMS, how do they suppose I signed up for this service? When a MMS message comes to my phone, I get a notification to go to a particular URL to read the message. I just delete the notification. Now MTN's billing system says I "subscribed" via GPRS. That would require me to enter my cell phone number, which I did not do. In fact, I didn't even use GPRS on that day. MTN assumes that their customers are dumb enough to subscribe to these services. Maybe some are, but I'm not one of them. Now I am awaiting a call from Monwabisi Mabude, the account manager who just may be able to sort this out at MTN.
Update 4.30pm: I got to speak to Trevor Louw at Opera Interactive, who vacillated between being smug, officious and helpful. His company does the billing on behalf of scum like Morvec, and Opera's business ethics are such that they do NOT have a Do Not Contact list. Nonetheless he assures me that they are taking my complaint seriously and they are waiting for "proof" from Morvec that I signed up. How do I prove that I didn't sign up, or that I didn't receive anything from them to confirm my subscription?
I have a growing suspicion that they will say that they sent me a message telling me that I should OPT OUT if I don't want to subscribe, which is illegal.

Update Fri 17th: Opera Interactive have sent me a R30 "goodwill" airtime refund, in spite of Morvec's "proof" that I "visited a WAP website" on 23/5/2011 at midnight. Funny, I was asleep at the time. I checked the "Sent Items" on my phone and have send nothing between 16h26 on 21/05 and 9am on 23/05. So the confirmation SMS that Morvec should have sent wasn't sent. And I certainly didn't reply to one. And Opera have confirmed that they have added me to their "Do Not Contact" list. The one they said they don't have.

Update 5.30pm: Morvec has changed the date on which the subscription supposedly happened (how convenient), but still need to explain the following item in the WASPA Code of Conduct:

11.3.1. If a subscription service is initiated by entering a customer's mobile number on a web page or WAP site, then a separate confirmation message must be sent to the customer's mobile handset in order to prove that the number entered matches the customer's mobile handset number.