'I lost £95,000 in a bank scam after my solicitor's email was hacked'

Sally Flood managed to claw two-thirds back, but says lenders should do more to protect customers

A Manchester woman lost £95,000 she inherited from her father in a sophisticated bank transfer scam. After a year-long battle she has managed to retrieve two-thirds of the cash.

Sally Flood enlisted the help of a law firm specialising in cybercrime and data breaches, and while she is pleased to have recovered a good chunk of what she had lost after “the year from hell”, she is furious about being left £35,000 out of pocket.

While her conveyancing solicitor’s email had apparently been hacked, she believes Lloyds Bank has questions to answer after the cash was paid into two of its accounts and then quickly withdrawn. “What I’d like from them is the rest of the money I’ve lost – I’m sure they wouldn’t miss it half as much as I’m missing it. I’m £35,000 down, and I’m sure that’s a drop in the ocean for them, but for me that’s a massive amount of money – it’s life-changing,” the 53-year-old says.

Spool back to a few days before Christmas 2018, and Flood had been looking forward to completing the purchase of an investment property for her children using money recently left to her in her father’s will. At the time, she was in regular touch with her conveyancing solicitor via email and telephone.

When she received an email purporting to be from her solicitor asking for a transfer of funds, she sent the first instalment – £50,000 – and then emailed a member of staff at the firm’s office to check the money had been received. She received a reply confirming receipt, and the following day, as requested, she paid the balance of £45,750. This was deposited into another Lloyds account after she was told the bank details had been revised because of an ongoing audit.

Flood, who works in a Stockport secondary school, says her heart sank when her bank (not Lloyds) later rang to say that Lloyds had noticed a discrepancy in the payee name. “I phoned my solicitor immediately, only to have them confirm their system had been hacked. The first email asking for the funds transfer looked very authentic. When I received a second email in response to mine, confirming receipt of the first transfer from my solicitor, I felt reassured and made a further payment.

“The fraudsters banked with Lloyds and, while the bank was able to refund an unspent £4,000 from their account, I have been advised they are unable to retrieve the remaining £35,000,” she says.

Fraud in the UK payments industry has soared. This type of scam is known as “authorised push payment” fraud and includes cases where email accounts – either those of individuals or the companies or tradespeople they have employed – are hacked in order to trick consumers into sending large sums to criminal accounts. Guardian Money has featured a number of these cases, and more than £1m a day is being lost to such scams.

Flood says a total of £95,750 was paid into the two Lloyds accounts and, shortly after, £91,280 was withdrawn. In February last year, £4,470 was recovered and returned. In a letter to her MP, Lloyds said “regrettably, as no further funds remain in the receiving accounts, we are unable to recover any more of the money transferred by Ms Flood”.

The bank added that “due to data protection, we are unable to disclose any information relating to the accounts”, but before that it had no knowledge of fraudulent activity, or concerns about the way the accounts were opened or managed.

Lloyds Bank branch
Lloyds says both fraudulent accounts passed all the relevant identity and verification checks. Photograph: Will Oliver/EPA

Flood decided to enlist the help of Hayes Connor Solicitors, which specialises in data protection breaches and other cyber offences. Kingsley Hayes, the firm’s managing director, says: “The emails sent to my client were very authentic, containing details of the property being purchased and the desired date of completion, so Ms Flood had no reason to question it or anticipate that it may have been fake. They had hacked her solicitor’s email system.”

He says the firm investigated the crime and retrieved £57,000 from Flood’s conveyancing solicitor, as it was responsible for the lack of robust security measures on its system. “Unfortunately, as the incident took place before new consumer protection rights were introduced at the end of May 2019 via the new voluntary code of conduct, it will be difficult to retrieve the remaining stolen monies,” Hayes says.

This code requires banks to reimburse affected customers who meet the criteria. Meanwhile, from the end of March this year, name checks will be carried out when UK bank customers send money to other people as part of a regime known as “confirmation of payee”.

Flood says: “There are some outstanding questions that we would like answered by Lloyds … If they can prove they have done everything right, I’d walk away, but I don’t think they have.”

She suggests accounts receiving large sums of money being transferred to a different payee name, which was then withdrawn within a very short period, “should perhaps have caused some checks to be made by Lloyds”.

Flood advises others to be vigilant when transferring large sums: “This has been a lengthy and very painful fight … Our lives have been on hold since this happened. I blame myself and feel anxious and upset. It’s a lot of money to lose, and it’s even more upsetting because it was money left to us by my dad that was supposed to be for my children’s future.”

A Lloyds spokesperson told Money: “We have a great deal of sympathy for Ms Flood as the victim of a scam. We use sophisticated, multilayered procedures to prevent fraudulent account applications. In this case, both accounts passed all the relevant identity and verification checks. Once notified of the fraud we acted immediately to freeze the accounts, which allowed us to return the remaining funds to Ms Flood. We will continue to cooperate fully with the police with their investigation.”


Rupert Jones

The GuardianTramp

Related Content

Article image
‘I lost £240,000’: UK fraud victims share their stories
Scammers stole more than £1.2bn from UK consumers in 2022. We speak to victims of fraud – and give tips to avoid being duped

Anna Tims and Rupert Jones

07, Oct, 2023 @6:00 AM

Article image
Haunted by shame: victims of bank transfer scams tell of lasting trauma
Fraud can have devastating consequences on victims, and not only financially

Anna Tims

17, Apr, 2021 @8:00 AM

Article image
Lloyds customer loses £5,200 in email scam – but can't get refund
Business account holder prepares to sue bank after paying real bill into bogus account

Miles Brignall

01, Dec, 2018 @7:00 AM

Article image
What to do when you think you have been scammed
Speed is of the essence, so here are some steps to follow if you suspect fraud

Sarah Marsh

09, Oct, 2023 @6:00 AM

Article image
Banks' online security is failing customers, says Which?
The consumer group says five of the UK’s biggest banks and building societies consistently scored poorly in its security test, including Lloyds and Santander

Miles Brignall

20, Oct, 2016 @9:30 AM

Article image
Lloyds bank accounts targeted in huge cybercrime attack
Banking group says none of its 20m accounts were hacked or compromised after fending off two-day denial of service attack

Patrick Collinson

23, Jan, 2017 @12:20 PM

Article image
So you think you’re safe doing internet banking?
Britain’s leading expert on cyber security refuses to bank online. We ask if you should follow suit

Miles Brignall

21, Nov, 2015 @6:59 AM

Article image
‘We lost £120,000 in an email scam but the banks won’t help get it back’
In another example of a growing menace, the Scotts thought they were sending money to their solicitor’s bank account. Little did they know it went to a fraudster

Miles Brignall

21, Oct, 2017 @6:00 AM

Article image
‘I thought I’d bought my first home, but I lost £67,000 in a conveyancing scam’
Howard Mollett is the victim of ‘Friday afternoon fraud’, an email scam that is the No 1 cybercrime in the legal sector

Rupert Jones

14, Jan, 2017 @7:00 AM

Article image
TalkTalk scam victims say it’s time for answers
As another customer explains how he was conned out of £6,300 after the firm’s security breach, the ICO is seemingly stalling while a class action moves closer

Miles Brignall

18, Feb, 2017 @6:59 AM