Help - bank scam

Silvertabby

masonic wrote: »

The week's Moneybox covers a story of someone else who was defrauded out of £33,000 from two different banks. The banks were able to recover some of the money. Both banks eventually decided to refund all the money and bear some of the loss as a gesture of good will (covered at the start of the programme).

https://www.bbc.co.uk/radio/play/m0001zw3

Listened to that this morning. The lady concerned was a retired teacher - who had been told that her accounts had been 'compromised' and that she should transfer her money to another account for safety.

Did feel so sorry for her - but, come on, how many times have there been stories in the newspapers, on the tv news, and on boards such as these, about these 'transfer' scams?

masonic

Silvertabby wrote: »

Did feel so sorry for her - but, come on, how many times have there been stories in the newspapers, on the tv news, and on boards such as these, about these 'transfer' scams?

Yes, and I hold accounts with most of the banks and have received a notice or communication from pretty much all of them warning me about push payment fraud.

Flobberchops

pritchardtuesnoad wrote: »

The caller then rang the following day at a pre-arranged time and clearly had made some transfers between our accounts already. He had cleared my wife's and my daughter’s account and my overdraft....

It was at this point I realised the OP had left out a large section of the story. So, it was a social engineering scam, with the callers presumably claiming to be from the bank or police, urging the OP to move funds from an "unsafe" account to a "safe" one set up for them?

I don't understand the relevance of the initial "banking app number" but presumably this granted the scammers access to Online Banking where they moved funds between accounts - internal payments often requiring a much lower level of security than setting up a new payee. The wife's and daughter's accounts must have been joint or trustee accounts, is that correct?

The real damage occurred when the OP gave out the card reader code to authorise the payment. To be clear, any secure code generated by a card reader device should be considered as sensitive as a PIN! In the context of online or mobile banking, they grant access to your account.

The good news, if that's not too perverse a way of putting it, is that it will be easy to find the scammer's beneficiary account and by extension the identity of the receiving account holder. The bad news is that this person isn't necessarily one of the scammers; it may be an unwitting third party who, for example, thought they were doing friends a favour by receiving and withdrawing in cash the £15k. Or it could be a dormant account sold to scammers by a since-departed international student. And so on. It gives the police a lead to go on, but there's no telling where and when that lead will turn cold.

Unfortunately this is a scam rather than a fraud, i.e. it involved OP being tricked into doing something voluntarily rather than details being stolen or an account being hacked, so NatWest could rightly say their security measures were sufficient and working as intended. There is precedent for banks paying out-of-pocket to cover customers losses in these situations but that's generally when the victim is very vulnerable - for a "savvy" customer who by their own description knows better than to give away sensitive information, NatWest may not feel so generous. The fact that you're a customer of 40 years is really neither here nor there.

Hope the police catch the scammers and your money is recovered in full, OP.

deadendwaterfall

The 'only just joined and has only one post' siren just sounded: https://www.youtube.com/watch?v=frcehiHU72g

Anyways, to answer the question, unfortunately, I don't think they have a leg to stand on, they stand more of a chance of Jeff Banks writing them a cheque for £1 billion.

masonic

Flobberchops wrote: »

I don't understand the relevance of the initial "banking app number" but presumably this granted the scammers access to Online Banking where they moved funds between accounts - internal payments often requiring a much lower level of security than setting up a new payee. The wife's and daughter's accounts must have been joint or trustee accounts, is that correct?

Correct, payments to existing payees don't normally require use of a card reader or any 2FA. Presumably the "banking app number" was a one-time login code intended to be used to login once on an untrusted device, after which it would expire - preventing the capture of the usual credentials.

This appears to have been used as a tactic to scare the OP and show someone else had account access, but they needed him to set up and authorise the payment used to steal the funds using his card reader.

18cc

I know it's the DM, but...

https://www.dailymail.co.uk/news/article-6583453/Fraud-victims-tricked-handing-life-savings-money-back.html

[Deleted User]

I don’t think we’ll hear back from OP again.

They don’t usually come back when they don’t hear the answers they wanted to get

sully1311

No sympathy sorry. Why would the bank ask you to move funds to a 'safe account' if it's been compromised? If they had any suspicions they would just freeze the account.

How people are still falling for these scams when they are well publicised now in the media is beyond me. A bit of common sense goes a long way sometimes.

tempus_fugit

Silvertabby wrote: »

Listened to that this morning. The lady concerned was a retired teacher - who had been told that her accounts had been 'compromised' and that she should transfer her money to another account for safety.

Did feel so sorry for her - but, come on, how many times have there been stories in the newspapers, on the tv news, and on boards such as these, about these 'transfer' scams?

That's the thing, this type of scam is not new, and have been publicised time and time again. And as dunstonh said the banks have said time and time again not to give out codes (including one-time-passwords for transaction authorisation) to other parties, including the banks themselves as they would never ask for them, at least I know my banks have been telling me this for a number of years. So anyone who does not know these things by now cannot call themselves "savvy" and I'm not sure how many more of these sort of scams have to be publicised before people realise that transferring your money voluntarily to another account that you clearly don't have control of is really not a good idea and is unlikely to be reimbursed by the bank.