Been scammed, builder had his email hacked - phishing

mattaus

Hi, looking for some advice.

Last month we had some building work done and everything was fine and we received the final invoice, an email after that was about changing the bank details which I thought was odd but it was from the same email chain and the same email address along with the company’s logo so even though I thought it was a bit odd I had no reason to believe it wasn't legit. I replied to the email saying OK send the new bank details through and the next morning the fraudster sent them through and I made payment as an online bank transfer (Halifax), 3 days later the builder messages me asking for final payment so the alarm bells rang, I told them that I had paid and tripled checked the new details and he said what new details so from then on we knew that his business email had been hacked. We both raised this with action fraud and got references and these were passed onto the cybercrime unit in London. The builder said that we don't have to worry as we are a customer and they were upset that this is happened.
I spoke to Halifax fraud team and in an nutshell as I made the transfer there is nothing they can do, they contacted the fraudulent account which is a NatWest account and between them they have shut it down and the money that was transferred was gone (no surprise). Couple weeks later the builder was chasing his money but I was adamant that we had already paid and it was down to them not protecting the customers with the proper security, partly my fault for being gullible. So I thought I better seek legal advice after this so I contacted the Citizens advice and after much debate they basically said that I am liable and he can take me to court as I haven't paid for a service.
I put a complaint in with Halifax and they can't do anything so I have put a complaint in with NatWest for allowing these fraudsters to easily set up accounts. I'm still waiting over a week now and had no response so I will contact the Financial Ombudsman.
We have come to agreement with the builder to meet half way but it really still bugs me that why should I be paying more money and to be honest I can't afford to be paying anymore?
I'm going to fight this all the way to try and get the money back from the banks so I was wondering has this happened to anyone recently as I know it is happening every day to other people.
Am I doing the right thing by meeting half way and if I get the money back I've said that I will pay the other half.
I also think email companies need up their game too, this was a hotmail account that was hacked.

Thanks in advance

spo2

But why should the builder lose out because you fell for a scam? You could have rung him to check that he had sent that email but you didn't. I think he is being more than reasonable meeting you halfway.

It was not his fault that you fell for this scam. I think the right thing to do would be to pay the builder the full amount and then try and claim it back

Grenage

Did the e-mail come from the building, or did it just appear so?

If the former, I can see your point; otherwise, you're culpable.

Aylesbury_Duck

I agree. I think you are fortunate that the builder has offered to meet you halfway because he could very easily dig his heels in and pursue you for full payment. Good practice now is to pay a small amount by transfer, say £1, verify it's been received (by phone) and then send the balance. I've done this twice now and both tradesman were happy to do it. They don't want the fallout your builder is now having to deal with.

Edited to add: I've just re-read your opening line. See below for a further question about the email address.

I know two people who have been similarly duped. One was tricked into paying £4k for a car to a fraudster's account. His bank were able to recover £1200 because the fraudster hadn't completely emptied the account, but the rest was lost. The other was very similar to your situation where someone was conned into paying the final balance, supposedly to a glazing company but actually to a fraudster's account. In his case, the whole amount was lost and he had to pay the glazing company in full.

Aylesbury_Duck

Grenage wrote: »

Did the e-mail come from the building, or did it just appear so?

If the former, I can see your point; otherwise, you're culpable.

This is a good point and having read the opening post again, it could have come from the builder's email account.

OP, did the email definitely come "from the same email chain and the same email address"? The exact same email address?

magn8p

I agree with Aylesbury Duck. However, I also feel for OP - it's highly likely that the email would have been exactly from the builder's business account. This scam is quite prevalent in the conveyance solicitors industry and is referred to as conveyancing scam - https://www.theguardian.com/money/2017/jan/14/lost-67000-conveyancing-scam-friday-afternoon-fraud-legal-sector-email-hacker.

To summarise the modus operandi, the hacker targets an organisation and hacks into an employees account - keeps listening to the ongoing email conversations and when it's time for a payment, he simply sends an email and requests the transfer of funds to a different bank account. Most of the home buyers fall prey at this step as they are eager to exchange the contract before the seller changes his mind.

Just so that you know, once the money is transferred to the fraudster's account, they will distribute the funds in small amounts to multiple fraudster accounts and draw them from cash machines or in some cases even transfer the money abroad! Most of the times the accounts the fraudsters operate are themselves hacked (after phishing the login credentials from over 70s is common trick), so the banks can't do much in time to stop such crimes.

Unfortunately, when paid via bank transfer, there isn't much protection available as the bank assumes you know who the recipient is. The best way to check this fraud is to ring up the recipient when the change of bank details is made and get a confirmation over the phone. Later, transfer £0.50 or so to see if he has actually received it or not and then proceed with full transfer.

Just make sure that the builder is not part of the scam network - if you have known him for a while, it's highly likely that he isn't. So meeting him half way is probably a good solution in the short term.

On the other hand keep fighting your case with Halifax and Natwest and make them pay if they have made any lapses.

All the best.

FreeBear

mattaus wrote: »

I also think email companies need up their game too, this was a hotmail account that was hacked.

Any decent company will have their own domain and email address. A business that uses a hotmail/gmail/aol/etc can not be taken seriously. As for the email account being hacked, that smacks of a weak password...

Never, ever trust emails for important dealings, and always insist on information in writing on headed paper.

mattaus

Aylesbury_Duck wrote: »

This is a good point and having read the opening post again, it could have come from the builder's email account.

OP, did the email definitely come "from the same email chain and the same email address"? The exact same email address?

Yeah everything was the exact same, same email address, same company logo, it was part of the ongoing email conversations as this was how we arranged things, I even had my friend who is an IT expert to check the email address (inspect)

mattaus

magn8p wrote: »

I agree with Aylesbury Duck. However, I also feel for OP - it's highly likely that the email would have been exactly from the builder's business account. This scam is quite prevalent in the conveyance solicitors industry and is referred to as conveyancing scam -

To summarise the modus operandi, the hacker targets an organisation and hacks into an employees account - keeps listening to the ongoing email conversations and when it's time for a payment, he simply sends an email and requests the transfer of funds to a different bank account. Most of the home buyers fall prey at this step as they are eager to exchange the contract before the seller changes his mind.

Just so that you know, once the money is transferred to the fraudster's account, they will distribute the funds in small amounts to multiple fraudster accounts and draw them from cash machines or in some cases even transfer the money abroad! Most of the times the accounts the fraudsters operate are themselves hacked (after phishing the login credentials from over 70s is common trick), so the banks can't do much in time to stop such crimes.

Unfortunately, when paid via bank transfer, there isn't much protection available as the bank assumes you know who the recipient is. The best way to check this fraud is to ring up the recipient when the change of bank details is made and get a confirmation over the phone. Later, transfer £0.50 or so to see if he has actually received it or not and then proceed with full transfer.

Just make sure that the builder is not part of the scam network - if you have known him for a while, it's highly likely that he isn't. So meeting him half way is probably a good solution in the short term.

On the other hand keep fighting your case with Halifax and Natwest and make them pay if they have made any lapses.

All the best.

Thanks for this, I read that article a few weeks ago. We're decent people that's why we suggested to meet half way and I also believe the builder is a genuine and decent person. It a lesson learnt for sure but even though myself and the builder share responsibility I also believe the banks do too.

mattaus

spo2 wrote: »

But why should the builder lose out because you fell for a scam? You could have rung him to check that he had sent that email but you didn't. I think he is being more than reasonable meeting you halfway.

It was not his fault that you fell for this scam. I think the right thing to do would be to pay the builder the full amount and then try and claim it back

In hindsight yes but this isn't any random email or phone call, as mentioned in my original post all part of the same chain and then you really only find out these things when you have become a victim of crime.

I simply don't have the money to pay again, surely you can understand that

martinsurrey

mattaus wrote: »

Yeah everything was the exact same, same email address, same company logo, it was part of the ongoing email conversations as this was how we arranged things, I even had my friend who is an IT expert to check the email address (inspect)

spo2 wrote: »

But why should the builder lose out because you fell for a scam? You could have rung him to check that he had sent that email but you didn't. I think he is being more than reasonable meeting you halfway.

It was not his fault that you fell for this scam. I think the right thing to do would be to pay the builder the full amount and then try and claim it back

The OP didn't fall for a scam, the builder used an IT solution for his business that wasn't robust, that is his responsibility as a trader, if it was a spoof email account, that would be the OP's fault, but the email did originate from the builders email account, just like every other invoice AND the original bank details.

IT security isnt just individuals responsibility!

OP if this went to court it wouldn't take much for you not to have to pay anything again.

(the builders practice of sending invoices and payment details by email alone, along with the fact that the issue was caused by his lack of IT security, point to negligence on his part)