Santander says its fraud flaw is fixed

SANTANDeR has fixed a flaw in its online banking after it was exposed by Money Mail.

As we went to press last night, the bank confirmed it has changed its systems to protect customers following our investigation.

A week ago, we revealed con artists were exploiting a weakness in Santander’s payment systems to raid customers’ accounts without arousing suspicion.

We uncovered dozens of cases where customers had lost their their life savings to crooks who pretended on the phone to work for reputable companies such as BT and even Santander itself.

Some were duped into giving the criminals remote access to their computers. In other cases customer accounts were hacked.

When money is transferred out of a Santander account to a new payee — such as a fraudster — a security code is sent by text to the customer’s mobile phone. The message displays the amount of money due to leave the account. However, fraudsters have also been able to change the sort code and account number of someone their victims have previously paid. That also triggers a text message code to the victim’s mobile phone — but does not display the amount leaving the account. Once they have obtained this code, crooks can transfer out huge amounts of money without the customer being alerted to the payments.

No other bank allows you to change the sort code and account number of an existing payee. Instead, you have to set up a new payee, which is more secure. Santander has removed the option to change these details for existing payees on its online accounts.

A spokesman says: ‘Santander constantly refines its online banking systems to reflect changes in how fraudsters target customers.

‘These enhancements reinforce our position that customers should not share their One Time Passcode with anyone — and that if they do so, Santander cannot accept responsibility for losses.

‘We hope Money Mail’s coverage will help prevent others from falling victim to these scams.’