Dad has been hacked

R200

Mum and Dad's bank account has been hacked. First they heard was coop notifying them they'd locked the account due to suspicious activity.

Looks like their login details are compromised and there is £1700 gone in a few transactions.

I would have gone down tonight, but I want to speak to the fraud dept with dad and that shut at 6. So I'll go down tomorrow and we'll reset all his passwords etc and ring coop.

Anyone been through this? Surely that money is insured if they didn't willingly send it themselves?

They told dad it's unlikely they'll recover it. They can't just ignore it can they?

MorningcoffeeIV

They won't (and haven't) ignored it.  They're just not yet able to determine where the fault lies.

R200

If they are not helpful or you can't think what else to say.  I'd suggest say, I'll have to get in touch with trading standards and the ombudsman and get their advice,  may I take your name please, write it down and say out loud, the time is... and write it down too and ask what number you call to get back to them.

MorningcoffeeIV

Don't do any of that.

Just let them complete their investigation. Then you can go to FoS if not resolved and if you believe you have a case.

Don't go to Trading Standards under any circumstances. They have nothing to do with FoS complaints.

Zanderman

R200 said:

If they are not helpful or you can't think what else to say.  I'd suggest say, I'll have to get in touch with trading standards and the ombudsman and get their advice,  may I take your name please, write it down and say out loud, the time is... and write it down too and ask what number you call to get back to them.

You seem to be advising yourself? You're the OP aren't you?

Abbafan1972

Weird or what? 

eskbanker

R200 said:

Looks like their login details are compromised

[...]

So I'll go down tomorrow and we'll reset all his passwords etc and ring coop.

If the account has been locked then the bank's investigation will be underway, so the ball will be in their court (i.e. no need to ring them unless they've asked for information) - in the mean time it'll be best to concentrate on establishing exactly what happened, in terms of asking your folks about any unusual activity, phone calls, etc, as well as examining any device(s) they use for online banking, to check for malware, keyloggers, etc.  It's unlikely that someone will simply have guessed their login details, so chances are there'll have been some social engineering involved....

R200 said:

Surely that money is insured if they didn't willingly send it themselves?

Not really insured as such, but there are some anti-fraud measures that may result in reimbursement - what type of transactions were involved (e.g. faster payment transfers, debit card purchases, etc)?

R200 said:

If they are not helpful or you can't think what else to say.  I'd suggest say, I'll have to get in touch with trading standards and the ombudsman and get their advice,  may I take your name please, write it down and say out loud, the time is... and write it down too and ask what number you call to get back to them.

If this was your message to your dad, then it probably doesn't pay to try to sound too smart, as it can have the opposite effect.  While it'll be a stressful experience, and they may be urgently needing access to funds, there's no point in trying to rush the bank, they'll need to investigate properly and at their own pace.

R200

Yea I suppose the bank will try to wriggle out of paying but it has to be worth persisting. We keep our money in the bank so that it is secure - if it gets stolen it has to be their fault, not the customer, unless there has been gross negligence. Some companies have a policy of refusing everybody on the first application. My cousin was an insurance assessor and told me his first task was to ring the people and tell them their claim had been disallowed, regardless! He said that weeded out around 30% of people; after that he then would assess the other 70%. My son found out his car insurance company had a policy of refusing all claims until the fourth application, after which they said yes! Persistence is, regrettably, crucial.

MattMattMattUK

R200 said:

Yea I suppose the bank will try to wriggle out of paying but it has to be worth persisting. 

If it is the fault of the bank then they will reimburse your parents, if it is the fault of your parents then the bank will not reimburse them.

R200 said:

We keep our money in the bank so that it is secure - if it gets stolen it has to be their fault, not the customer, unless there has been gross negligence. 

It does not have to be the fault of the bank, indeed in nearly all cases like this it is the fault of the customer.

R200 said:

Some companies have a policy of refusing everybody on the first application. 

Banking is a regulated industry, with clear rules on how things must be done, they do not refuse things on the first application for the sake of it, only when the claim is not valid.

R200 said:

My cousin was an insurance assessor and told me his first task was to ring the people and tell them their claim had been disallowed, regardless! He said that weeded out around 30% of people; after that he then would assess the other 70%. My son found out his car insurance company had a policy of refusing all claims until the fourth application, after which they said yes! 

Sounds very dodgy, in breach of regulations and very close to "a man down the pub said..." type stories, irrelevant.

R200 said:

Persistence is, regrettably, crucial.

Knowing one's rights, responsibilities and what the laws and regulations are is crucial. 

R200

We live in the age of the cyber pandemic that is where the fault lays.

If an obvious breach of security was to blame them the fault could be at the foot of the bank or the customer. But sometimes stolen identity or other such fraud is not down to anyone or anything at fault. 

MattMattMattUK

R200 said:

We live in the age of the cyber pandemic that is where the fault lays.

No we do not, and no it does not.

R200 said:

If an obvious breach of security was to blame them the fault could be at the foot of the bank or the customer. But sometimes stolen identity or other such fraud is not down to anyone or anything at fault. 

The issue with that position is that a "stolen identity" rarely, if ever, results in bank accounts being accessed, what it almost always involves is new accounts/products being opened. Almost all fraud that involves people's bank accounts being emptied is because a fraudster phones up and gets the account owner to transfer the money to the fraudster and the account owner willingly complies, or they happily hand over the codes for 2FA that allow a transaction to go through. There have only been a handful of cases where banks security systems have been directly compromised in a way that allows criminals to directly access accounts. 

From the perspective of criminals, why go through the effort of trying to find a security hole in the banks systems which could take years to find, then take a long time to access individual accounts, likely having the hole closed before anything substantial has been gained. Or just run a bog standard confidence trick operation and get hundreds of people to transfer the money on their behalf. The weak link in security systems is always the meat, criminals go after the weak links, not the strong ones.