Been scammed, builder had his email hacked - phishing

ljonski

http://www.telegraph.co.uk/personal-banking/current-accounts/new-banking-scam-sees-fraudsters-open-twin-account-next-real/

this article should help you at least get to grips with these type of fruads. Does Martin have much information on these type of scams?

teneighty

Interesting thread this and a terrible situation for OP to be in.

Large multinational companies have had their IT systems hacked and large companies have fallen for this fraud. A local authority near me paid almost £1 million to an identical builders email fraud. So saying the builder should have had more robust IT security and the OP should have known it was a fraudulent scam is rather harsh.

It is a fraud and as such I think the OP should be protected by the banks fraud protection cover. Maybe if the banks were forced to accept their responsibility they would ensure payment details are matched to name, account number and sort code which would wipe out most of this fraud overnight. Also a more robust tracking system so they could trace and recover the money from the fraudster's accounts.

Maybe we should go back to sending a cheque in the post? It has made me think carefully how I receive payments from clients.

mattaus

Head_The_Ball wrote: »

If you had enough concerns to ask an 'expert' to check the email address, why didn't you phone the builder?

Because that only happened afterwards if you read the post

mattaus

teneighty wrote: »

Interesting thread this and a terrible situation for OP to be in.

Large multinational companies have had their IT systems hacked and large companies have fallen for this fraud. A local authority near me paid almost £1 million to an identical builders email fraud. So saying the builder should have had more robust IT security and the OP should have known it was a fraudulent scam is rather harsh.

It is a fraud and as such I think the OP should be protected by the banks fraud protection cover. Maybe if the banks were forced to accept their responsibility they would ensure payment details are matched to name, account number and sort code which would wipe out most of this fraud overnight. Also a more robust tracking system so they could trace and recover the money from the fraudster's accounts.

Maybe we should go back to sending a cheque in the post? It has made me think carefully how I receive payments from clients.

Yeah agree, i have to wait 28 working days to hear from action fraud and the police, must be nearly up the 28 days

saverbuyer

mattaus wrote: »

Checked my home insurance to see if I was covered, I have a pretty good one but they don't cover this sort of thing. The builder also doesn't have insurance even though they initially said they did and for us not to worry

Who's your insurer? You used a builder without insurance using a hotmail account. Sorry OP but I'm impressed you got an agreement for 50/50 from the builders. Something about this doesn't sit right with me.

Aylesbury_Duck

saverbuyer wrote: »

You used a builder without insurance using a hotmail account. Sorry OP but I'm impressed you got an agreement for 50/50 from the builders. Something about this doesn't sit right with me.

Alarm bells ringing here, too. It's not beyond belief that the builder might be getting 150% of his final payment out of this. I wouldn't recommend paying anything more until you hear from the police and the banks.

Carrot007

teneighty wrote: »

Large multinational companies have had their IT systems hacked and large companies have fallen for this fraud. A local authority near me paid almost £1 million to an identical builders email fraud. So saying the builder should have had more robust IT security and the OP should have known it was a fraudulent scam is rather harsh.

No, it is not. Local authorities are an easy target as it is usually someone with no proper training that is responsible for payments. All it shows is LA's entrust people with not enough training.

It's hard for me as I would think I would question anything like this.

However in my view this is 100% the builder's problem unless they can proove otherwise. And even then I doubt it because they used such and easily fraudable method when they could have rung to give the details with caller ID proving who they are.

Any court given reasonable evidence would rule similar. Not saying they would not rule otherwise just that proper expert testimony would be needed.

The builder here is deficiant in two ways:
1. Letting this happen. Crap passwords or overreaching password requirements leading to it being written down. Both just as bad.
2. No insurance. Thier chose if they want to lose out.

Would not be paying them anything.

phoebe1989seb

This happened to people we know last year. A new roof costing in excess of £20k, first payment went through ok to the builder than they received a similar email to the OP requesting the final payment - of over £13k - be sent to their new bank account. This was duly paid whereupon the builder denied receipt.

The builder (who was obviously not involved) pleaded ignorance of any scam and needed the money due to a new addition to his family - our friends felt bad and, despite not having access to the additional funds, borrowed a further £13k+ from a family member to ensure he was paid.

Not sure who they bank with, but they were unable to help.

I do think though that despite our friends' and the OP's obvious naivety in all this, the banks have to take some responsibility.

EachPenny

teneighty wrote: »

It is a fraud and as such I think the OP should be protected by the banks fraud protection cover. Maybe if the banks were forced to accept their responsibility they would ensure payment details are matched to name, account number and sort code which would wipe out most of this fraud overnight. Also a more robust tracking system so they could trace and recover the money from the fraudster's accounts.

The problem with the banks being made entirely responsible is it opens the door for more types of scam. The onus has to be on the person sending the money to ensure the money is going where it is intended.

In that respect, the banks could help by providing some check details back to the person sending the money to help them identify if the bank details are geniune. The banks are working on something like this, although there are concerns that in itself could open up new scam opportunities. E.g. a system where you enter recipient sort code/account number and the bank responds with "Are you sure you want to send the money to Mr 'X'?" would allow scammers to identify the full account holder name from just the account number.

The problem lies with us. We want to be able to make instant transactions of large sums of money. To make the system safer the banks would need to hold and reject far more payments than they currently do. Which would mean customers getting annoyed because payments need to be redone or penalties have been applied for late payment.

Without meaning any criticism to the OP (we all could be in their position) the only way of stopping these scams is for the sender to take far more care when sending a large payment to a new recipient. That might mean being willing to phone the recipient to check details, or sending a test payment, but ultimately it is up to us, because even if the banks take 'responsibility' for fraud then 'we' still end up paying through increased fees and charges and lower credit interest rates.

teneighty wrote: »

Maybe we should go back to sending a cheque in the post? It has made me think carefully how I receive payments from clients.

This is what I was thinking while reading the thread. If small businesses cannot afford to invest in secure payment systems then a cheque in the post has got to be more secure than an online payment.

Unfortunately over on the banking threads there are plenty of people urging banks to scrap the cheque system entirely. Presumably none of them have ever fallen for this kind of scam.

Aylesbury_Duck

phoebe1989seb wrote: »

This happened to people we know last year. A new roof costing in excess of £20k, first payment went through ok to the builder than they received a similar email to the OP requesting the final payment - of over £13k - be sent to their new bank account. This was duly paid whereupon the builder denied receipt.

The builder (who was obviously not involved) pleaded ignorance of any scam and needed the money due to a new addition to his family - our friends felt bad and, despite not having access to the additional funds, borrowed a further £13k+ from a family member to ensure he was paid.

How was it obvious? Out of the many thousands of good tradespeople there are a few rotten eggs. Your example, along with the OP's situation, could both be cases where the builder is the fraudster or is connected to the fraudster. It is clearly quite an effective scam because the immediate assumption of guilt is attached to an anonymous third party.