Mettle business account fraudulent transactions

Shakin_Steve

You can bet there'll be a lot more customers involved than have posted on here. Some that may not even notice such small amounts.

skunkfox

https://forums.moneysavingexpert.com/discussion/comment/81877279#Comment_81877279

I have never made a card payment from this account either physically, online or in an Apple wallet. The only transactions the account has ever been used for are payments in from clients & payments out to my personal account via bank transfer. Not sure how anyone would have my card details?

born_again

Brute force.

Fraudsters get one card that works. They then use people to hammer away at numbers till they find another that works. As card numbers are a certain formula. Your 1st 6 relate to your bank & type of account.

Cheerycupcake

https://forums.moneysavingexpert.com/discussion/comment/81875673#Comment_81875673

I’ve had the exact same transactions at the same time. £7.40 at 1.35 to Shippello, then I blocked the card and had a declined payment of £11.11 at 12.39 for Windsurf. Still awaiting a response from Mettle.

mta999

Very strange fraudulent spending pattern - multiple transactions for the same amount at windsurf...

Tootiefrooty

I had the same thing happen to me yesterday at around 8pm, a payment for £7.40 was taken under the name Aladin Network. I’ve reported it and have frozen the account. They are apparently ‘looking into it’ but I have a whole load of direct debits due to be taken from this account, so hope it’s resolved quickly.

Despite googling several times since yesterday, this forum seems to be the only place online that I can find any mention of this happening to other people.

dsme94

Given the fact that multiple Mettle business accounts are reporting unauthorised transactions at the same time, this indicates someform of systemic compromise rather than individual phishing or brute force.

There are some classic methods being used here which indicate fraudulent behaviour. The transaction amounts and merchants suggest a card-testing attack — small charges to verify a card works before attempting larger ones.

I've done some research into the merchants appearing on our statements:

Shippello is a small freight forwarding/courier service based in Nassau, The Bahamas (founded 2021, 11-50 employees). Their business model involves forwarding packages from a US warehouse to customers in The Bahamas. This is not a service any of us as UK sole traders would typically be using, especially not at 01:35 AM. The fact that multiple unrelated Mettle users have the exact same £7.40 charge to Shippello rules out a legitimate purchase - this is consistent with their payment gateway being used as a card testing endpoint. Fraudsters often route test transactions through small merchants in jurisdictions with lighter payment oversight, and a small Bahamian freight company fits that profile.

Windsurf is an AI-powered code editor (formerly Codeium), operated by Exafunction Inc., with subscriptions charged via Stripe. While in isolation a Windsurf charge could be legitimate for a developer, the £11.11 charge appearing alongside the Shippello charge on the same compromised cards fits the classic pattern of escalating test amounts — small test (£7.40) followed by a slightly larger charge
(£11.11).

The most likely cause is a card data breach where card details from a Mettle BIN range have been leaked or sold online, possibly from a compromised merchant or third-party processor.

What is concerning is that I personally haven't had an update from Mettle after reporting the suspicious activity last night. I have frozen my card, which has prevented the additional transaction from Windsurf — the same amount reported by previous users in this thread.

This has the hallmarks of a card data compromise affecting Mettle's card issuing infrastructure or a third-party processor. The identical small-value test transactions to the same merchant across multiple unrelated customers is the clearest signal. Mettle (owned by NatWest) should be investigating this as a systemic incident, not handling it as individual fraud cases.

I would strongly recommend freezing your card for the time being.

This is all based on the information we have now.

I have submitted a report to https://www.reportfraud.police.uk/

af612

Giving that this issue seems to be directly related to Mettle customers, and as the transaction information is the same for the other reported cases, tells me that this is an internal data breach on the Mettle banks system. As well as the Windsurf transaction, I also had a transaction leave my account by Aladin Network for £7.40 earlier today. I would be interested to know how many others have been affected by this fraud. I think it may be within the best interest to close the business account and move to another bank, this to me is a very serious data breach and needs to be investigated.

RacingDriver

https://forums.moneysavingexpert.com/discussion/comment/81877533#Comment_81877533

One review with similar issues on Trustpilot

"I was really happy with mettle until last night when I saw 37 withdrawals within 36 hrs from 4 different unrecognised companies. 30 of them were from the same one for the same account for the same account. As it’s outside their working hours and the weekend there’s no one to call or contact via online chat!. I froze the card and asked for a replacement card but I don’t feel reassured as someone is still attempting to withdraw money. The bank should have a system to stop this , reassure me and have a 24/7 fraud line. I’m going to find a bank that has this facility. Terrible that this can happen not only with a bank but a business back! I read that there are others that have complained about the same thing."

af612

For people trying to contact Mettle directly, I found it fairly easy, to be honest it was the quickest I've been attended to from any firm, I called up the phone number on their website, pressed 1 and it rang through to someone straight away and I explained to the person on the phone what had happened, they seemed to be aware of the suspicious transactions.