He wanted my date of birth

just clarification upon step 5 & 6 here.. my understanding is when there is a request to transfer money out, there is still another authentication through SMS OTP right? so its not as straight forward as the money will just be gone once ur bigpay account is compromised..

but then again, the user may have made a mistake by giving out the OTP the first time.. but to give out the second time to an unknown party, probably in a time span of 5-10 min, people may argue the user deserve the scam though

step 6 should be authenticate using SMS OTP eh? especially transfer out to a newly created recipient (and especially to an account not under ur own name)