A couple in the process of buying a house fear they could be left homeless over Christmas after being tricked into transferring almost £60,000 to fraudsters posing as their conveyancing solicitor.
Salim and Olesia (they asked us not to disclose their surname) are the latest people to fall victim to a bank transfer scam – one of Britain’s fastest-growing crimes. Olesia, who is six-months pregnant with the couple’s second child, says they are supposed to be completing on 21 December, but are now desperately worried this could be jeopardised if they don’t manage to recover the missing cash.
“I don’t even want to think about the future – we are living a nightmare,” says Olesia. She and her husband have a toddler and live and work in London.
In what is now becoming a depressingly familiar scenario, fraudsters hacked into emails sent between the couple, their solicitor and their mortgage broker. As a result, their £137,500 deposit was sent to a bank account operated by a fraudster. A good chunk of this was later recovered, but the remaining £57,388 was withdrawn before the scam was detected and is still missing.
Guardian Money has featured a number of these cases. They usually involve people who have employed a legitimate solicitor/builder/accountant etc, with whom they are in email correspondence. Typically, the victim receives a request for payment via email, which doesn’t arouse suspicion because they were expecting it. It usually looks authentic and is for the correct amount – but behind the scenes the email account of either the victim or the business has been hacked, and the bank account number and sort code are the crook’s.
Ironically, this case coincided with the news that, in future, some people who are tricked into transferring money may be eligible for compensation. Banks typically refuse to reimburse victims of bank transfer scams, but the Payment Systems Regulator (PSR) is proposing a scheme which would see customers refunded “in certain circumstances”.
It will depend on whether the relevant bank or company had met required standards, and the victim taken enough care in protecting themselves.
However, any such scheme would be too late to help Salim and Olesia. On 14 August, Salim visited a London Barclays branch in order to send a Chaps payment of £137,500 to their solicitor. He was assisted by branch staff. Olesia says the process took some time because of security checks, and adds that Barclays didn’t flag up the fact that the bank account details did not match the solicitor’s account information used to make a previous payment. It wasn’t until 22 August when they contacted their solicitor for an update that they realised they had been scammed. They reported the fraud to Barclays. The following day, Salim visited the Royal Bank of Scotland branch in Levenshulme, Manchester, where the account that received their cash was held, but was told it had been frozen.
'The criminals seem to get away with anything … we have no support from the institutions supposed to help and protect us'
Barclays eventually told the couple that it had “managed to recall £80,111.64” of their cash. As ever in these cases it is difficult, if not impossible, to establish whose email account was “the weak link in the chain”: the couple’s, the solicitor’s or the broker’s.
Salim and Olesia paid for a report from a forensic computer analyst, which stated that emails had been “hijacked” through the use of “reply-to” headers, which would cause an email to appear to come from a legitimate source, but when “reply” was hit it would be sent to a different address. It also said a number of email domains were used to perpetrate the fraud, including one designed to look very similar to that of the solicitor.
The couple say it is now almost three months since the fraud, adding: “The criminals seem to get away with anything, and we have absolutely no support from the institutions technically supposed to help and protect us.” This week they finally heard that the case was being transferred to Manchester police, who would be investigating.
The couple claim apparent errors and delays by their bank may have made their situation worse – the bank rejects this. While the couple reported the scam to Barclays on 22 August, an internal document, seen by Money, states that the following day an “indemnity request” to claim the remaining funds was sent to the wrong bank – Lloyds – instead of RBS. And a letter from RBS states that it did not receive the indemnity request until 4 September, and that when it arrived it was in the “incorrect format,” so a further request was made to Barclays. The bank responded on 13 September with the correct details, “so the remaining funds were sent directly to Barclays”. The latter told Money that on 17 August RBS got in touch saying there was “an issue with the name on their account”, and the remaining funds had been removed from the beneficiary account. On 23 August the indemnity was issued to claim this money.
A spokesman adds: “While this was initially rejected by RBS, and a corrected version sent on 13 September, the delay in the indemnity being issued would not have led to RBS releasing any further funds. The remaining funds recovered of £80,111.64 was as captured by RBS on 17 August – five days prior to being alerted by the customers on 22 August.” He added: “The notes referring to an indemnity being issued to Lloyds is an incorrect statement. Both indemnities were correctly issued to RBS.”
Barclays says it “is doing more than any other bank to inform people how to protect themselves from fraud”, adding: “In this instance some of the funds had been withdrawn over a number of days prior to the suspicious activity being detected by the receiving bank.”
RBS says: “In this instance we were able to recover some, but unfortunately not all, of the funds lost by the time that we were informed of the payment. We encourage everyone to be extremely vigilant when managing payments and always check directly with the intended recipient.”
Source: The Guardian