Philip Currie received an SMS on May 7 about an outstanding bill from his telecom provider, du.

Mr Currie, 49, from Britain, decided to pay the bill through du Quick Pay, as he did every month.

On his phone, he typed du Quick Pay into the Google browser and search results came up. He clicked on what looked like a sponsored ad for the page.

“It looked exactly like the du website, had the same sort of web address [myaccount.du.ae]. Even when you clicked on it, it looked like the mobile version of du [du-môbile.com]. I clicked on the link and it went to a payment page which looked identical to du Quick Pay,” Mr Currie recalls.

“I proceeded and entered my details, just as I have done many times. I’ve been in Dubai for almost six years and I’ve paid my monthly bill this way all the time.”

Despite entering his HSBC credit card details the first time, he did not receive a one-time password. He tried resending it. A pop-up window opened on his phone and he copy pasted the OTP in the website.

As soon as he entered the OTP, he started receiving messages about different payments worth thousands of dirhams each.

“I felt sick to my stomach. In hindsight, I wish I’d gone through my SMS messages and seen what charges were coming through and what the OTP was for, but I didn’t because I thought I was on the du website,” he says.