Attempted Fraud - Can I keep the fraudsters money?

rjpop

Hi

I've recently been victim of an incredibly elaborate attempt to use my bank account to commit fraud. They somehow managed to find a loop hole that allowed them to clone my mobile phone number and then clone my identity, gaining access to my bank account.

To start with they deposited a sum of money in my account and then moved it on. They then took my money.

I acted quickly and the bank put a stop to it straight away. In fact the bank could see them doing it when I was on the phone to them.

The bank admitted I wasn't fault and gave me my money back. They also gave me the money back that the fraudster deposited as they said they had to refund me all money which was illicitly transferred out of my account.

So what do I do with the fraudsters money?

I notified the bank about it and told them, but they still put it back in my account. Can I keep it?

Thanks 

flaneurs_lobster

Almost certainly not, it belongs to someone else even if they are bad people. 

Unless you can get the scammers to sign a statement to the effect that they have gifted you the money, but even then it's probably not theirs to gift.

How did they manage to clone your phone?

k_man

As above, it's not the fraudsters money, it is some other victim's money.
Whether they would ever get it back is a different matter.

wmb194

rjpop said:

Hi

I've recently been victim of an incredibly elaborate attempt to use my bank account to commit fraud. They somehow managed to find a loop hole that allowed them to clone my mobile phone number and then clone my identity, gaining access to my bank account.

To start with they deposited a sum of money in my account and then moved it on. They then took my money.

I acted quickly and the bank put a stop to it straight away. In fact the bank could see them doing it when I was on the phone to them.

The bank admitted I wasn't fault and gave me my money back. They also gave me the money back that the fraudster deposited as they said they had to refund me all money which was illicitly transferred out of my account.

So what do I do with the fraudsters money?

I notified the bank about it and told them, but they still put it back in my account. Can I keep it?

Thanks 

No. Just leave it in the account. In due course it should disappear back to where it belongs.

PRAISETHESUN

They've blocked and reversed all the transactions that sent money out from your account. The banks involved upstream in the money laundering chain will likely be doing the same to everyone else who has been affected. Leave the money where it is as it will be clawed back eventually.

rjpop

Thanks for your response everyone.

I guess I'll just leave "resting in my account" until the bank acts. Although that in itself seems like a strange approach and something I'm not that comfortable with.

FYI... it seems hackers and fraudsters have figured out a vulnerability around requesting PAC codes from mobile phone firms. Really not entirely sure of the mechanics and how the exploitation works, but my mobile phone provider were very apologetic, so that probably tells you something. It's a very sofisticated piece of fraud.

eskbanker

Sounds like https://en.wikipedia.org/wiki/SIM_swap_scam

AmityNeon

rjpop said:

FYI... it seems hackers and fraudsters have figured out a vulnerability around requesting PAC codes from mobile phone firms. Really not entirely sure of the mechanics and how the exploitation works, but my mobile phone provider were very apologetic, so that probably tells you something. It's a very sofisticated piece of fraud.

This is an unintended consequence of the consumer rights push to reduce the hurdles involved in switching networks; it's become far too easy for fraudsters to bypass the victim entirely and just socially engineer their way through unsuspecting, overworked and underpaid agents of mobile phone networks to obtain a PAC, which underlies a critical component of UK banking and wider identity verification overall. It's a serious and systemic flaw which has yet to be acknowledged, let alone addressed, at a regulatory or legislative level.

Even ~15 years ago, my mother had her mobile stolen but my father managed the account and SIM card, and they had recently divorced so he wasn't available to assist. I impersonated my father and bulldozed my way through phone agents, and it only took two attempts in the space of 10 minutes. The second time, they (but a different agent) even informed me that 'someone' had recently tried calling but failed security (or something to that effect). Regardless, I was able to seize control of my mother's mobile number and set up an account with a different network for her to manage independently going forward.

rjpop

Yep, it certainly looks like that's how they achieved what they did. 

The person from phone provider even suggested it could have been an inside job.

Time for a new number and bank account, me thinks. Possibly even switch primary email address.

Miles86

rjpop said:

Thanks for your response everyone.

I guess I'll just leave "resting in my account" until the bank acts. Although that in itself seems like a strange approach and something I'm not that comfortable with.

FYI... it seems hackers and fraudsters have figured out a vulnerability around requesting PAC codes from mobile phone firms. Really not entirely sure of the mechanics and how the exploitation works, but my mobile phone provider were very apologetic, so that probably tells you something. It's a very sofisticated piece of fraud.

You could open an additional savings account with the same bank and out the money in there. Keeps it easier to manage, and any interest earned definitely is yours!