Advice after being scammed

Carrot007 wrote: »

You did that but you did not take the reasonable steps of ringing the builder.

I did that after the fact. No alarm bells rang for me until the builder called to say that the payment had not arrived.

Carrot007 wrote: »

Emailis insecure. The address could have been spoofed. Though someone would have had to know a lot about your works to do it.

It is unlikely emails were intercepted it does not work that way. (unless the builder uses random wifi).

I understand all of this, and going back through my email chain I've realised that there's a crucial thing which gave the whole thing the ring of authenticity, and makes me strongly suggest an inbox hack. The chain of events is this:

1 - Major works finish
2 - Builder sends invoice (third and final, after two earlier ones were paid without issue)
3 - I reply with a snags list
4 - Builder comes and sorts out the snags
5 - I send photos to building control (fireboarding of steel)
6 - Building Control say they need to come and do a final inspection
7 - I email builder with date (Monday) of Building Control's final inspection, and say that once everything is signed off, I'll pay the final bill (this was Thursday of the week before this)
8 - Building Control come and do their inspection on Monday morning, and verbally confirmed that all was fine and would be signed off
9 - I called the builder that same morning to let them know that BC had signed off on everything
10 - The same afternoon (Monday, 14:30), I receive an email from the builder telling me to hold off on payment, saying that they've changed banks and will email me later with details, and to please respond to understand my understanding
11 - I replied straightaway to say that I did, and was waiting on their new account details before paying
12 - I didn't receive anything from the builder until nearly two hours later (16:20), at which point I got an email from them providing their new bank details
13 - I responded straightaway to say that I had paid "to your new bank account"
14 - I got a reply on Tuesday saying "OK"
15 - I got a call on Wednesday morning saying that no payment had come through

Points 10 is what drew me in I think because the builder, though nice, is a little scatty in their thinking and so switching banks at a moment's notice wasn't at all out of character.

Point 12 is what really sold it to me, because that 2 hour gap between "expect a change in bank details" and "here are the new bank details" isn't something I've heard about in a phishing-type scam, even as someone who thinks of themselves as being quite savvy to this kind of thing.

Point 11 is what makes me strongly suspect that the scammer had full access to the builder's inbox rather than this being generic phishing or man-in-the-middle, because I know they receive email to their phone and generally respond while on the job, so for me not to have received a call from them asking what I was talking about suggests to me that the scammer was monitoring for replies and deleting them as quickly as possible as they arrived.

I need to check whether the builder a) has any of my responses to the scam emails still on their Hotmail account, b) any of the scam emails in their outbox, and c) whether they have changed anything at all security-wise as a result of this incident, which I suspect they probably haven't because…

CommitedToChange wrote: »

OP - can you please confirm if the builders told you this had happened to other customers of theirs?

If so then they had a duty to warn you about this scam abd not to accept any emails that said their bank details had changed, and I wouldn't pay them anything.

…yes, they said this without any specific questioning from me, and even told me that a particular customer had lost a particular sum of money to a similar issue in the past. Notwithstanding the breaches of DPA 1998 / GDPR there, I wouldn't be at all surprised if they hadn't changed passwords and/or security questions since that last attack. From searching the web, I know that the email address I've been corresponding with them on has been active as their email address for at least five years, and their other customer was scammed this year.

p00hsticks wrote: »

Unfortunately what you describe is now apparently one of the most common such scams, although most often seen with solicitors handling house purchases.

There are some recent news items on the subject here;

Thanks for the links. Would I be right in thinking that all of those cases involve some kind of direct access to email systems, rather than sniffing and injecting of unsecure emails? In other words, in those particular cases encryption of emails themselves would have been largely irrelevant because the actual email accounts had been hacked?