Bank transfer frauds are growing, especially in the UK, and the victims are losing significant amounts of money; we’re talking £50,000 and upwards.
Further, there’s little chance of victims being reimbursed; banks take the line that the fraud wasn’t a result of their systems being breached.
This type of fraud is becoming increasingly common and the amounts of money stolen can be life changing. Some recent examples include:
- A couple sent a £137,500 deposit to a bank account operated by a fraudster. They lost £57,388 which was withdrawn before the scam was detected
- One person lost his £67,000 life savings when buying his first home. Fraudsters hacked into emails sent between him and his conveyancing solicitor
- Another couple lost £25,000 after receiving an invoice for building work after having some work completed
- A couple in Essex, UK sent to money to what they thought was their solicitor’s bank account. Instead it went to an account that was systematically emptied of £20,000 in cash every day for six days.
In some cases people have lost more than £100,000.
How does the fraud work?
The growth in this type of fraud reflects how dependent and everyday online communications have become. Email has been around for years and a long time ago superseded snail mail as a favoured form of communication.
This is how the fraud works:
- A hacker gets hold of email addresses and passwords. They’ve probably bought the email addresses in bulk from a dark web forum. Using brute force techniques they crack the passwords
- Alternatively they may target specific individuals and using a range of social engineering tricks, or sometimes simply scanning social media platforms, identify email addresses
- The emails are then scanned for messages that relate to some form of financial transaction. This could be communicating with a solicitor about a mortgage, a builder for renovation works or an accountant for tax related payments
- The fraudster intercepts the messages and when the timing is appropriate they pose as one of the parties, for example, a solicitor and ask for the payment to be made to bank account. They provide the account details and sort code
- The fraudsters typically say the firm they are impersonating has just changed its banking account, which sounds plausible to the victim
- The victim doesn’t think anything is suspicious about the transaction because they are already engaged in the process and are expecting to make a payment, such as a deposit on a house purchase
What are banks doing?
Not a lot actually. Banks are largely taking a hard line and refusing to reimburse customers for these losses.
They say it’s not their responsibility when customers give their account details, or money, to online scammers. They further argue it would be too costly to cover all the losses and people should be more careful.
Apparently during the first six months of 2017 in the UK more than 19,000 people were targeted, involving a total of more than £100 million.
Banks have some pretty sophisticated fraud detection systems in place but can’t easily detect this type of fraud.
In the UK, the Payment Systems Regulator (PSR), the economic regulator for the UK payment systems industry, has come down on the side of consumers and is pressing for a scheme to be set up that would see customers refunded in certain circumstances.
It’s uncertain, however, when this will come into effect.
What can you do?
Let’s hope no BullGuard blog reader becomes a victim of this type of fraud. One victim armed with the legal system and courts, he went to war with his bank. These are the steps he says victims can take:
- Immediately phone your bank, speak to the fraud team, explain what has happened and demand they immediately contact the fraudster’s bank, that is, the bank you transferred your money to.
- Immediately contact a solicitor or barrister who can accept instructions from you and ask them to immediately make an application to freeze the fraudster’s bank account and any other bank account that the fraudster has with their bank
- This should include a request for a court order that the fraudster’s bank provides the following information:
- all contact details (mobile phone, home phone, email address, residential address)
- all signatories to the fraudster’s bank account
- any other bank account held in the fraudster’s name or any other signatory to this bank account that is held at the bank
- all bank statements for the fraudster’s bank account and any other bank account to which the fraudster or any other signatory has with the bank for a period of 6 months
- the current balance of all bank accounts with the bank that is in the fraudster’s or any other signatories name
- As soon as you receive the receive the court order immediately email it to the fraudster’s banks’ ‘court orders’ team
- As soon as you receive the information from the fraudster’s bank, consider the following points:
- has your money been transferred to any recognisable company you can contact?
- if you can identify a company that has received your money, contact this company, explain what has happened and request they either cancel the transaction made by the fraudster or ask them to hold onto the money as you’re currently using court orders to identify the fraudster
- has the money been transferred to other bank accounts?
- If your money has been transferred out of the fraudster’s bank account and into another bank account, you have the option of returning to court and repeating the process set out above
- Your bank will be under a duty to contact the fraudster’s bankers, who will then freeze the fraudster’s account. If your bank has failed to act within a reasonable period of time after you have notified them of the fraud it is likely that your bank will have breached their duty and will have to compensate you
The wider issue
These types of frauds begin with email accounts being hacked:
- Before making a large payment call the recipient and double check that the payment has been requested
- Make an initial small payment and check if the recipient receives it
- Never post email addresses or other personal information on social media
- Never give our your email address or other personal information over the phone
- Check if your email address appears on https://haveibeenpwned.com/ If it does it means that is has been stolen, most likely from some company’s database
- Consider closing your email account and replacing it
- Use strong passwords on your email account. Click here to find out about password managers
- Consider using BullGuard Premium Protection which safeguards all your identity information, including email addresses, and alerts you if your information appears on the web