If you’ve been emailed bank details … be warned
Both of these letters are depressingly similar and should be a warning to everyone who banks online.
I transferred £20,000 into our pension plan, but the money never arrived. I had asked my financial adviser at Brewin Dolphin for the relevant bank details and he sent them by email. It seems it was intercepted and the bank details changed so the transfer went into someone else’s account.
Brewin Dolphin says its email system has not been corrupted. My provider says my email address has not been compromised in the last six months. My bank has tried
I had some building work on my flat. The builder emailed me his bank details, but, before I’d paid, he emailed again to ask if part of the amount could be paid into a different (Lloyds Bank) account. I duly transferred £6,300. However, the request was fraudulent.
The builder’s PC had been hacked, and he noticed I had replied to an email that had not been sent by him. It was then too late to stop the payment, but I immediately alerted my bank (HSBC) and also reported it online to Action Fraud.
The fraudster continued to email me, asking if I was going to make another payment, and this, too, I reported. However, I now seem to have reached a dead end.
Action Fraud says it cannot provide updates within three months of a complaint. Lloyds Bank says it cannot deal direct with me, and HSBC has passed me to its “fraud complex complaints team” (which doesn’t appear to have a phone number or email address and won’t give me a contact name). This tells me that Lloyds won’t provide details of the beneficiary account due to data protection, but that some of my money is still there. To recoup it, it says, is a civil matter I’d have to pursue in the courts.
I cannot understand why HSBC will not act on my behalf, at least to ascertain how much is remaining in the account. JV, Exeter
Both of you are victims of an increasingly prevalent scam whereby criminals hack into personal or business email accounts, intercept any messages concerning pending payments and send an email from the hacked account changing the details in their favour.
The scam cost consumers £145.4m in the first half of this year, according to UK Finance. It’s known as “push-payment fraud” and, unlike credit card or direct debit payments, there is no protection for customers who lose out.
This could change. A code proposed by the Payment Systems Regulator last month might require banks to reimburse victims – provided they were not negligent when making the payment – although the code would be voluntary and it’s not clear who will fund the compensation.
In the meantime, you have both been left in legal and regulatory limbo. In CC’s case, Brewin Dolphin maintains its system was not compromised and therefore the hacker must have targeted your account.
It points out that the Have I Been Pwned website, which checks whether emails have been affected by data breaches, shows your email has been compromised five times.
Moreover, the scam email you received contained a different domain name to Brewin Dolphin’s. Ordinarily, the Financial Ombudsman Service can investigate whether a company has dealt reasonably with such a complaint, but not in your case because email hacking isn’t a regulated activity.
Unless you can stomach the prospect of challenging Brewin Dolphin’s system security through legal action there is, excruciatingly, nothing more you can do. The problem for JV was that the fraud only came to light four days after the payment.
HSBC says it contacted Lloyds immediately and Lloyds says it froze the beneficiary account, but, by then, contrary to what you were told, the money had apparently vanished.
Depressingly, the authorities have been of no help. Action Fraud eventually told you that, due to overload, it would not be investigating and referred you to the police.
The police replied that they, too, could not do anything “because of the high level of fraud reporting and limited police resources to investigate economic crime”.
HSBC referred you to the Ombudsman but the response was the same, and it is yet to investigate.
Precaution, therefore, is the only protection. If details are sent by email, and particularly if they suddenly change, ring the person or company to check they are bona fide. When possible, pay by credit card – or even by cheque, which can, at least, be stopped.
If you need help email Anna Tims at email@example.com or write to Your Problems, The Observer, Kings Place, 90 York Way, London N1 9GU. Include an address and phone number. Submission and publication are subject to our terms and conditions