• Fraudsters have found a new way to target young people, with some losing all their funds in the first few weeks of term
• Fraudsters can text customers ‘as the bank’ by disguising the number the text is sent from

 
When Alison Dean received a text from her bank, the Co-operative, asking whether she had just made a £999 purchase – asking her to call the bank if she hadn’t – she did what many of us would have done, and dialled the number in the message.

After all, the text had clearly come from the bank – it was listed on her handset amid previously sent texts that the PhD student knew had come from the Co-op – and she was well used to getting such messages from the bank.

But the text message wasn’t from the Co-op. Somehow, fraudsters had managed to insert the message into the run of authentic texts from the bank. When Dean rang the number, she was duped into handing over her personal details – and the crucial card-reader-generated code. That allowed the crooks to remove £5,400 from her account – and the Co-op says it will not be refunding her.

Business Today: sign up for a morning shot of financial news
Read more

If that sounds bad, how about the case of Ben Bowman, who thought he might have to give up his university place after less than three weeks at Bristol, after being similarly conned? In his case he was rung up by fraudsters who knew all his details and previous transactions – to the extent he was convinced he was talking to his bank, Natwest.

Once they had duped the budding rapper into handing over his personal details, the crooks managed to take his first student loan payment of £1,713 and, incredibly, to successfully apply for a £20,000 loan in his name. Both duped students say they have no idea how the fraudsters got their mobile number, or how they knew that they were customers of those particular banks.

Dean’s case is particularly worrying as it exposes how easy it is for fraudsters to text customers “as the bank” by disguising the number the text is sent from.

It is also a reminder that consumers should not trust any information apparently to them sent by their bank via email or text. Account holders should only call their bank using the phone number on the back of their card, not the number on a text or email. Students seem particularly prone to this scam as they are often financially inexperienced.

The real (top two) and the fake (bottom) texts received by Alison Dean
Dean, who is studying biology, says: “As soon as I got the text I called the number and they answered as the Co-op’s fraud department. I was on the phone to them for 24 minutes. Throughout the call I had no reason to believe I wasn’t talking to Co-op staff. I gave them my card details and used my card reader over the phone. Looking back it seems rather stupid but it was all done so expertly. I genuinely thought I was talking to bank staff who were helping me deal with a fraud.”

She says as soon as she realised that something was wrong she called the Co-op to report what had happened. By that time five transactions had been made from her online banking account. The Co-op cancelled two of them, but three had already gone through. It has since refused to refund her the £5,400 taken and has, she says, just washed its hands of the matter.

Ben Bowman’s case is similar except that he was physically called on his mobile by someone claiming to be from Natwest’s fraud department. The caller proceeded to list his previous transactions, and asked him to confirm the genuine ones. He was then asked if had bought a £140 handbag in Edinburgh.

“The caller knew I had bought a Domino’s pizza two days ago and all my other purchases. I had never been called up by a fraud department but he sounded exactly as I would have expected. All the account details he quoted were right.

I was 1000% convinced that the guy worked for Natwest and was genuine. He said he would send me a text which I should read back to him. I kept thanking him for helping me,” says the politics and international studies student.

At the end of the call he says he was told that Natwest would shut down his online banking facility and that he should delete the mobile app. He just happened to go home for the weekend, where he received a letter from Natwest approving the £20,000 loan the bank had given the “penniless” student. A visit to his local branch exposed the scam – £500 had been taken each day for five days. Staff, he says, spent three minutes analysing the case and then declared he was responsible and would get no refund.

“They were quite happy to send me out of the branch knowing that I had absolutely no money in the world,” he says.

Following the Guardian’s intervention, Natwest has had a change of heart and has refunded Bowman the £2,500 he lost as a “one-off” gesture of goodwill.

“We know how distressing being a victim of fraud can be and would encourage customers to remain vigilant in response to unexpected phone calls from individuals acting as their bank and if requested to provide security details, hang up immediately and phone the bank on a trusted number,” says a Natwest spokesman.

However, the ethical bank, the Co-op, has refused to refund its customer despite Money’s intervention.

A Co-op spokesman said: “She responded to the fraudulent message and disclosed her full security details, which is something we explicitly advise customers not to do. As with all banks, we would never ask customers to disclose full security details, or use our two-factor authentication card reader to perform transactions over the phone. As she was in breach of our terms and conditions and means we are unable to refund her for the losses she incurred.”

Meanwhile, Bowman says his online banking days are probably over. “It will be a pain but this episode says to me that it’s just not worth the risk,” he says. “The way the bank wanted to put it all on me, was just ridiculous and breaks all the safety promises they make when you start banking online.”

How did the fraudsters get their details?

Could the two featured victims both have been caught up in hacking incidents that could have put their personal details in the hands of fraudsters?

Both victims had registered their debit cards with Uber. The company has admitted its customers’ mobile phone, email and other personal details were hacked last year, but claimed no card details were compromised. Many shopping sites have poor online security, and there are probably other hacking incidents of which consumers are not even aware. Any one of these might have led to fraudsters obtaining crucial details about the students.

Fraudsters who know the first few digits of a debit card can usually work out which bank provided the card. If they also have the mobile phone number and customer’s name they are in business, and can immediately target the customers in the ways seen above. These are not mass texts and emailing exercises; individuals are targeted so that the fraudster has someone ready to pick up the call to the “bank”.

The real banks all use clients’ mobile numbers as a way to contact them, but the systems are arguably insecure. It is easy for a fraudster to send texts as if they were the bank. In the past Money has highlighted how easy it is for fraudsters to take over a victim’s mobile phone account entirely. If your phone suddenly stops working and your bank uses your mobile to contact you, be on guard for a possible fraud.

Source The Guardian

Coffee Times News