Bank fraud - Receiving Bank

Zain1982

 Hi All,

To cut a long story short, money was transferred into a fraudsters account by an employer, after the employees bank details were changed via a phishing scam. The employer contacted its own bank and the receiving bank, it took the receiving bank  4 months to come back and say the money was cleared from the account on the same day. The employer also reported this to Action Fraud immediately , however the receiving bank has still not reported this as fraud to the police or plans to do so. What action can be taken against the receiving bank by the employer? 

I read an article in the Telegraph , where David Clarke, a former detective chief superintendent and director of the Fraud Advisory Panel, has taken the unusual step of encouraging victims to take the recipient bank – the one providing the service to the fraudster – to court on the grounds that it “facilitated” the crime.

 Mr Clarke said: “There are so many gaps in the banking systems, and it’s the banks’ innocent customers who pay the price.”

The employer is currently exhausting the complaints process via the banks  and will go to the ombudsman service when the time comes. But would appreciate some advice from any one on this matter. The amount was around £5k so probably be a small claims court if it goes that far.

Thanks

davidmcn

Presumably you'd need evidence that the receiving bank had been negligent in some way - do you have that?
I'm not sure why it makes a difference for the receiving bank to have reported it as fraud, if the crime has already been reported to the police? If the police want to investigate further then they can contact the receiving bank themselves, they don't need to wait to be invited.

Zain1982

davidmcn said:

Presumably you'd need evidence that the receiving bank had been negligent in some way - do you have that?
I'm not sure why it makes a difference for the receiving bank to have reported it as fraud, if the crime has already been reported to the police? If the police want to investigate further then they can contact the receiving bank themselves, they don't need to wait to be invited.

The employer wants to go after the account holder ultimately, however due to obvious reasons the bank cannot provide that to the employer.You would think they would provide that to the police automatically as a crime has been committed, where as they admitted the transaction was fraudulent and froze the account.  It was reported on Action Fraud many months ago and is being updated regularly but no action is being taken by police that we know of. The annoying thing is that the receiving bank could have confirmed the same day the account was cleared and not wait 4 months, wasting valuable time.  
The negligence on the banks part will be if the account was opened with fraudulent documents etc, however we know they wont volunteer that up. So where do we go if the police cannot be bothered to follow up, do we go after the bank as they hold all the info of where the money went as well.

davidmcn

If you want to pursue a civil action then you'll need to obtain the evidence yourselves, the police aren't there to assist you - even if they get information during a criminal investigation they're not going to copy you into it. You might be able to get a court order requiring the bank to disclose relevant information.
Obviously, we're straying away from consumer rights here as the employer isn't a consumer.

Fosterdog

Who fault was it that the bank details were changed? Is it the employers system that was breached or was it the employees system that was breached? If it's the employers then they should be reimbursing the employee and dealing with both the fraud and preventing any future breaches. If it's the employees then there's not really much that can be done to get the money back but they need to re-evaluate their security to prevent any future phishing attacks.

Zain1982

Fosterdog said:

Who fault was it that the bank details were changed? Is it the employers system that was breached or was it the employees system that was breached? If it's the employers then they should be reimbursing the employee and dealing with both the fraud and preventing any future breaches. If it's the employees then there's not really much that can be done to get the money back but they need to re-evaluate their security to prevent any future phishing attacks.

An email came from the employee's email account that was hacked to the employer. The employee reported this after the fact and on the day the payment was made. The employer honoured the payment to the employee. I understand its one of those tricky situation, but you would hope the receiving bank  would be more helpful as their accounts were opened and used in a fraudulent transaction. This post is more to gain more knowledge from this situation and how to get banks to change their culture in matters like this. 

unholyangel

Push payment fraud (aka APP fraud) is rife and I believe one of the biggest types of cybercrime. Solicitors & accountants are often the targets for these types of scam, which is why its important for them to have adequate security measures in place even if they're a small firm. 

They were talking about adding some protection for it but in what form or whether they actually did, I couldn't say for certain. 

born_again

I'm amazed that the receiving bank are even talking to the Employer, as they are not their customer.
It is up to the employers bank to contact the receiving bank, who will then freeze the account. 
A bank does not have to report to the police if they do not want to. 
Odds on a mule account that is emptied as soon as the funds hit it. Opened by a genuine person for a few £.

Manxman_in_exile

Zain1982 said:

...
The negligence on the banks part will be if the account was opened with fraudulent documents etc, however we know they wont volunteer that up. So where do we go if the police cannot be bothered to follow up, do we go after the bank as they hold all the info of where the money went as well.

Whether the account was opened with fraudulent documents or not is unlikely to be relevant in determining if the bank was negligent, if it followed the necessary procedures and checks.  How obvious does a fraudulent document need to be to be rejected?

I wouldn't ask a retired chief superintendent for civil law advice on suing someone - or for any legal advice at all.

Ectophile

Assume that the police will not take any action, unless Action Fraud passes on the case to them.  That won't happen unless Action Fraud sees a pattern of repeated frauds that add up to a much larger sum of money.

Small-scale fraud has effectively been decriminalised in this country.  You can't report it to the police, and the banks won't report it to the police either.  So your only chance is if you can take civil action against somebody.

Zain1982

born_again said:

I'm amazed that the receiving bank are even talking to the Employer, as they are not their customer.
It is up to the employers bank to contact the receiving bank, who will then freeze the account. 
A bank does not have to report to the police if they do not want to. 
Odds on a mule account that is emptied as soon as the funds hit it. Opened by a genuine person for a few £.

That was how it was initially raised, via the employers bank. It took 4 months for the receiving bank to confirm the money was cleared the same day. They could have just confirmed it immediately. The receiving bank also called the employer to confirm if it was fraud, which they did.  I read somewhere that nowadays you can also complain to the receiving bank and they have to respond, which is why the employer complained to them as well.  I can 100% agree that it is definitely a mule account, however in the absence of the bank providing those details to the employer or the police, and the police not being bothered, who do you go after in a civil case? my view the receiving bank as they hold all the information and they have technically facilitated the fraud, I accept without any knowledge.