A record label manager and her husband have been conned out of £25,000 after becoming the latest people to fall victim to a highly sophisticated email scam.
Their story involves a fraudster who posed as their builder, set up a copycat email address and even managed to mock up an incredibly realistic fake invoice. It shows the lengths criminals will go to, and will send a shiver down the spine of anyone about to have work done on their house or who are thinking about employing a tradesman.
And what will shock some people is Barclays, which operated the account that the fraudster used to accept their money, says it does not report such crimes to the police – on the grounds that “the bank is not the victim”.
Barclays also, apparently, wouldn’t cooperate with the couple’s own bank, Lloyds, when it attempted to get their money back. Yet the onerous ID checks banks must carry out when someone opens an account mean Barclays, presumably, knows a huge amount of detail about the person who stole the cash – their name, address, date of birth, income and employment details etc.
Sarah and David Fisher told Guardian Money that even though this is a “life-changing” amount of money to lose, and clearly a criminal matter, no one seems to be interested in pursuing their case.
Sarah, who lives in north-west London, got in touch with us after reading our 13 February report about a Bristol woman duped into paying £1,500 to someone posing as her carpenter.
She had received an email purporting to be from the carpenter and requesting that the money for the work be transferred to his bank account. It later emerged that his email had been hacked and the bank account into which she had paid the money wasn’t his.
The Fishers have a four-year-old daughter and a 22-month-old son, and are having an extension built, so have been in regular communication with their building company.
On 30 October last year the company’s accounts executive emailed an invoice for the work, in the form of a PDF attachment carrying the company’s logo. It was an invoice they were expecting and was 100% genuine. It gave the total due – £27,829 – plus an account name (the name of the building company), bank account number, sort code and reference number.
Then on 2 November they received what appeared to be a follow-up email from the same employee, written in the same style (“Dear Sarah & David” ...), and featuring all the same logos and formatting, and the same email signature. This stated: “We have changed who we bank with. I forgot to amend the changes on the invoice I sent 30/10. The attached invoice has our new banking details ... I’m sorry for any inconvenience these changes may have caused ...” Just like the 30 October email, this one was signed “Kind regards”. This second invoice is identical in almost every way to the first – only the account number and sort code are different.
The couple paid £25,000 – their account’s daily payment limit – so were surprised when, a few days later, they received an email from the company chasing payment. They told the accounts executive they had paid the bulk of the bill, but she emailed back to say that the second invoice had not come from her. The building company banks with NatWest, but the bank details given on the second invoice were for a Barclays account.
It was then the couple realised they had been scammed, with the most likely explanation being that either the building company, or the couple, unwittingly downloaded malicious software, which enabled the fraudster to intercept their emails. When the Fishers looked back at the emails, they noticed that the one received on 2 November was sent from an email address just one letter different to the genuine one (“development” instead of “developments” in the company name).
“Of course we were shocked and upset – two bright, professional but busy people coming to terms with being conned in such a sophisticated but simple way. But we had an underlying feeling that somehow we would recover our money. Unfortunately, this hasn’t been the case,” says Sarah, a general manager at Universal Music.
“This is a life-changing amount that is partly remortgage money and partly life savings. It’s such a horrific thing to happen, so the more people we can relay our story to, the more people can protect themselves against it happening to them. It happened in a split-second, yet it has changed what the next few years look like for us.”
The couple reported the matter to the police, which in turn referred it to Action Fraud, the UK’s national fraud and internet crime reporting centre. “The reason the police are citing for not pursuing an investigation is that this type of crime is so rife they haven’t got the resources – they say that compared to some of the cases they are dealing with, it’s small scale,” says Sarah.
Lloyds Bank declined to accept any responsibility on the grounds that the transfer was made by the Fishers and it was merely following their instructions. It told them it had been “unable to obtain a return of your funds from Barclays,” adding: “Barclays will not disclose their account opening documentation to us for confidentiality reasons.”
The Fishers then turned their attention to Barclays. “Our own questioning with the banks had traced our money to an account in the north owned by a man called ‘Harry’. It, of course, had been immediately fully withdrawn and closed,” says Sarah.
Eventually the couple received a letter from Barclays saying it had finished its investigation. It said that by the time it was alerted, the couple’s £25,000 had been “utilised” by the account holder, so it was unable to return any of their cash. Its letter added: “We do not report scam claims to the police because the bank is not the victim.”
However, the bank did say it would cooperate with the police as part of a criminal investigation.
The case of the Bristol woman also involved a Barclays account, and Sarah says this seems to suggest “a weakness in their security at some point in the process”. She adds: “If someone stole £25,000 via other means, it would unquestionably be taken more seriously.” Barclays told Money that “appropriate documentation was presented when this account was opened, and we had no way of knowing that the account would be used for fraudulent purposes.
“When opening the account Barclays complied with all regulatory requirements and has robust identity and verification processes. Regrettably, by the time we were made aware of the fraud, no money remained and we were unable to return any funds.”
How to avoid being scammed
• If you receive an email asking you to make a bank transfer and it’s someone you haven’t previously made a payment to, or have paid before but they have changed their bank details, your default position should be suspicion – even if you were expecting the bill/invoice/demand. Phone the person and check they have asked for the money and that these are the correct bank details. If it’s a large sum, send a small amount first – £10, say – then check they have received it before paying the balance.
• There’s a simple way to reduce your risk of being fleeced: don’t bank online. In November 2015, we featured Ross Anderson, Professor of Security Engineering at the University of Cambridge’s Computer Laboratory, who has never banked online because of the risks of fraud.
• Regularly check all bank and card statements for suspicious transactions.
• Check your credit report – you can spot applications and spending that are nothing to do with you.
• Don’t use things such as names of your pets/partner/children as passwords.
• Ignore unsolicited phone calls, texts, emails and letters, particularly if they ask for account details, pins, passwords or personal information.
• Don’t store account names and passwords on your smartphone.
• Register to vote at your current address. If you don’t, fraudsters could use your previous address details to open new credit accounts and run up debts in your name.
