Gift Card Scam

monkeyvanish

Hi, sorry if this has been posted before, a quick search didn't turn anything up and I didn't want to lose time in case we need to act quickly.

My wife fell victim to a gift card scam on Tuesday - she is the clerk of the local parish council and received an e-mail that purported to be from the council chair urgently asking for 3 £100 Apple gift cards.

She immediately complied with the request on her own credit card (Mastercard) as the council does not have a purchasing bank card. She sent the codes via e-mail but the lightbulb went off shortly afterwards and she realised she had been scammed. She of course contacted our bank (Santander) immediately to advise of the situation and they reassured her that they would help her resolve the issue.

They have just called her and asked a long list of questions, at the end they told her they would not refund the balance as she didn't speak directly to the scammer. She didn't do this as the e-mail specifically said the person they were impersonating was busy and in meetings (I assume this is common wording).

Are they really able to just wash their hands of this even though we reported immediately? I can't believe that this is the end of it, there must be some way we can take this matter further, has anyone got any ideas or experience with this?

Many thanks in advance

RefluentBeans

Hi welcome to the forum. 

First off - I’m really sorry your partners been scammed. There’s a lot going around at the moment and even the best of us can get scammed - just dropping the ball for the moment can cause it, so please don’t feel bad. 

You say that she used her credit card - I doubt that a chargeback would be valid. But I’m not sure about S75. My gut tells me that it probably wouldn’t be, as she made the decision to buy it herself (her card wasn’t stolen etc). So it wasn’t an unauthorised transaction per se. 

I think banks tend to refund some amount of money as a gesture of Goodwill rather than legal obligation and so probably have s set of guidelines. But happy to be corrected if that the case. 

I think she potentially could ask the council to offer some money back, especially if it was a result of a compromised email account, but other than that I don’t think there’s much you can do to claim the money back, annoyingly.

I would advise her to talk to her colleagues about it (and you at work too) to try and build more rigid protocols for these requests. Unfortunately it’s a more common occurrence. And like I said, anyone can fall for these scams; so we need to be more open and talk about them so we can recognise them. 

tightauldgit

monkeyvanish said:

Hi, sorry if this has been posted before, a quick search didn't turn anything up and I didn't want to lose time in case we need to act quickly.

My wife fell victim to a gift card scam on Tuesday - she is the clerk of the local parish council and received an e-mail that purported to be from the council chair urgently asking for 3 £100 Apple gift cards.

She immediately complied with the request on her own credit card (Mastercard) as the council does not have a purchasing bank card. She sent the codes via e-mail but the lightbulb went off shortly afterwards and she realised she had been scammed. She of course contacted our bank (Santander) immediately to advise of the situation and they reassured her that they would help her resolve the issue.

They have just called her and asked a long list of questions, at the end they told her they would not refund the balance as she didn't speak directly to the scammer. She didn't do this as the e-mail specifically said the person they were impersonating was busy and in meetings (I assume this is common wording).

Are they really able to just wash their hands of this even though we reported immediately? I can't believe that this is the end of it, there must be some way we can take this matter further, has anyone got any ideas or experience with this?

Many thanks in advance

Since the bank wasn't at fault and your wife made the transaction knowingly then I think it's pretty much up to the bank to decide what they are willing or not willing to do. I don't think there's any legal obligation in cases like this to refund anything. 

I think it's just an expensive lesson learned, although certainly worthwhile pushing on the bank to see if they will offer something to keep you sweet.  

user1977

I can't see the bank is any more liable here than they would be if she had withdrawn a wad of cash from an ATM and handed it to the fraudster.

lincroft1710

Unless it's a regular request (which does seem unusual) why would the chairman of a parish council want 3 x £100 Apple Gift Cards.

HillStreetBlues

I would get your wife to change her e-mail addy, as that address will go on a list to target again.

Alderbank

monkeyvanish said:

Are they really able to just wash their hands of this even though we reported immediately? I can't believe that this is the end of it, there must be some way we can take this matter further, has anyone got any ideas or experience with this?

I too am sorry this has happened to you. However I can't see that the bank has any liability. Your wife didn't pay money from her account to a scammer, she made a legitimate purchase. She afterwards gave the codes to a scammer but the bank did not know (and they are not entitled to know) what she subsequently did with her purchases after she bought them.

She might be able to take the matter further by contacting Apple Support.
The Apple Gift Card website says If you have additional questions, or if you’ve been the victim of a scam involving Apple Gift Cards, App Store & iTunes Gift Cards or Apple Store Gift Cards, you can contact Apple Support online.

This is Apple's Support online site for Apple Gift Card scams: https://getsupport.apple.com/solutions

This does seem to be a growing problem. The Apple Gift Card site, where you purchase gift cards, is covered with warnings about scams, such as:
'Never provide the numbers on the back of a Gift Card to someone you do not know. Once those numbers have been provided to the scammers, the funds on the card will probably be spent before you are able to contact Apple or law enforcement.

Beware of gift card scams. Do not share your code.'

Abbafan1972

Sorry that your wife has gone through this, but surely it would have been prudent to give the chair person a quick call to check they had requested the cards? (Not using a phone number on the email, but maybe asking a colleague for it, or Googling?). 

the_lunatic_is_in_my_head

lincroft1710 said:

Unless it's a regular request (which does seem unusual) why would the chairman of a parish council want 3 x £100 Apple Gift Cards.

Why would anyone? 

These scams either hack an account or put pressure on the victim so they don't think straight.

Sorry to hear OP If the council had their email hacked there may be some liability there.

Apple say to contact their support

https://support.apple.com/en-gb/gift-card-scams#:~:text=Immediately report potential scams to,Trading Standards, etc.).

I would assume the cards are cashed and the money gone but perhaps worth a chat with them. 

user1977

the_lunatic_is_in_my_head said:

lincroft1710 said:

Unless it's a regular request (which does seem unusual) why would the chairman of a parish council want 3 x £100 Apple Gift Cards.

If the council had their email hacked there may be some liability there.

Do parish councillors even typically use a "corporate" email address? I would guess they're quite likely to conduct business using their personal addresses, which would make it even less obvious whether it's a fake one, unless the recipient takes the trouble to check.

RefluentBeans

user1977 said:

the_lunatic_is_in_my_head said:

lincroft1710 said:

Unless it's a regular request (which does seem unusual) why would the chairman of a parish council want 3 x £100 Apple Gift Cards.

If the council had their email hacked there may be some liability there.

Do parish councillors even typically use a "corporate" email address? I would guess they're quite likely to conduct business using their personal addresses, which would make it even less obvious whether it's a fake one, unless the recipient takes the trouble to check.

I think if they don’t - then this is wake up call that this specific parish council needs. If they have a website, most hosting services offer free/very low cost emails (admittedly, bare bones and not G-Suite or O365). But enough to get by with. And some now have 2FA on email logins. 

Doesn’t solve spoofing attacks and the such, but at least adds an extra layer of security. 

I think this needs attention of all small businesses and entities. Whilst it’s easy to look at something like this as ‘I would never fall for something like that’; all it takes is for you to have a brain fart or feel really sleepy or distracted and it’ll happen. Having steps in place to force someone to take a step back before committing to it is key. 

People need to talk about the scams they’ve experienced and not be shot down with ‘why’d you ever think that was real’. It can happen to anyone. The more we learn the less common these attacks are.