Scam with a happy outcome

[atomant48]

Wanted to post this to share the experience and hopefully stop someone else from being hit. Fortunately for me it worked out ok but I understand that is very, very unusual.

So background is I am having some building work at home done - total cost not important but enough to require several large payments on a regular basis. Ive already made 7 or so payments to the builder and all through online banking with no issues. He emails an invoice, I make the payment, he drops an email or text to say got it thanks.

Last invoice came through quite late at night - nothing unusual - and all looked ok and I intended to make payment the following day. Next morning I had another email - explaining he had had to change to another bank account because of ... (details not important but it made perfect sense and mentioned some other stuff we had been emailing about). So later that night I made payment to the new account.....

You can probably guess the rest and several very stressful hours, heated phone calls and contingency plans later, the bank rang with some very relieving news that I had all the money back.

Afterwards was very interesting. Apparently this is called an “invoice scam” and is very common, particularly in building contracts. About half the guys I worked with had heard of it, and 2 of them had been done by it (both lost several thousands). As for the builder, again, half of his mates had experienced it and some had lost significant sums over it.

I obviously felt like an idiot (I consider myself pretty savvy usually), but I work in an industry where we talk openly about mistakes to try to learn from them.

So watch out! A simple strategy seems to be to pay a small amount into any “new”account and then put the rest through once it has been confirmed.

By the way once the bank had recovered the money and had all the details of the “other account holders” I asked for the address associated with the account they politeLy declined to give it to me ....

 

[Kayos]

I’ve had calls from banks a few times when customers have tried to transfer payments, asking me to confirm bank details

 

[Burdekin]

Scary. Glad you didn’t lose out.

 

[MattH]

This can only happen because the builder has had their email account hacked.

Coupled with the fact that the banks ask for a name on a bank transfer but don’t use that name to secure the transfer.
I think it’s very bad that they ask for the name but don’t use it as it lulls people into a false sense of security.

FYI the government is putting pressure on the banks to secure these transfers properly and take some responsibility.

 

[roofman]

This is very worrying as 80% of my invoicing and payments to my company are BACS these days...so they want us to stop using cash but cant get the security sorted at the same time for internet banking,Hmmmm maybe a re-think needed here.

 

[eLuSiVeMiTe]

Umm. Its not the banks fault.
They made payment as requested by the payee.

Any change in payment details like that
Is suspicious and worth a phonecall to the builder to confirm.

 

[roofman]

Umm. Its not the banks fault.
They made payment as requested by the payee.

Any change in payment details like that
Is suspicious and worth a phonecall to the builder to confirm.

yea your right thinking about it...The OP might have in-sercure email or a spying or key logging virus

 

[MattH]

Umm. Its not the banks fault.
They made payment as requested by the payee.

Any change in payment details like that
Is suspicious and worth a phonecall to the builder to confirm.

That's how the banks justify not repaying the money, "it's a legitimate transfer sir".

But, they are the ones that do not use the account name to secure the transaction. If they did Mr Singh from Timbuktu would not be able to accept a transfer for Mr Smith the builder into his account.

 

[slimjim]

Wanted to post this to share the experience and hopefully stop someone else from being hit. Fortunately for me it worked out ok but I understand that is very, very unusual.

So background is I am having some building work at home done - total cost not important but enough to require several large payments on a regular basis. Ive already made 7 or so payments to the builder and all through online banking with no issues. He emails an invoice, I make the payment, he drops an email or text to say got it thanks.

Last invoice came through quite late at night - nothing unusual - and all looked ok and I intended to make payment the following day. Next morning I had another email - explaining he had had to change to another bank account because of ... (details not important but it made perfect sense and mentioned some other stuff we had been emailing about). So later that night I made payment to the new account.....

You can probably guess the rest and several very stressful hours, heated phone calls and contingency plans later, the bank rang with some very relieving news that I had all the money back.

Afterwards was very interesting. Apparently this is called an “invoice scam” and is very common, particularly in building contracts. About half the guys I worked with had heard of it, and 2 of them had been done by it (both lost several thousands). As for the builder, again, half of his mates had experienced it and some had lost significant sums over it.

I obviously felt like an idiot (I consider myself pretty savvy usually), but I work in an industry where we talk openly about mistakes to try to learn from them.

So watch out! A simple strategy seems to be to pay a small amount into any “new”account and then put the rest through once it has been confirmed.

By the way once the bank had recovered the money and had all the details of the “other account holders” I asked for the address associated with the account they politeLy declined to give it to me ....

Your not an idiot, because you will learn from it, and it’s ealily done, by anyone, and that’s what they want,

It goes without saying that you need to physically or verbally confirm a change of payment, not just rely on an email.

 

[R-D-R]

Very common attack vector we also refer to them as BEC Business Email Compromises where a business has their emails compromised and the fraudsters then serve fake invoices with notification of change of bank details to customers. Literally millions and millions are being lost through this :-( Its not technically compromising the Banks technology as at the end of the day its a Scam with the root cause of the compromise being email. Really pleased to see you got your money back, I would ask all to be vigilant on anything like this and if a request is received just take 5 and think about it and if possible check through another channel such as a telephone call. Equally if you are a business make sure you consider the security of your emails, I'd also recommend that on email invoices add a statement saying you will never update bank details via email.

https://takefive-stopfraud.org.uk

 

[axomoxia]

Very common attack vector we also refer to them as BEC Business Email Compromises where a business has their emails compromised and the fraudsters then serve fake invoices with notification of change of bank details to customers. Literally millions and millions are being lost through this :-( Its not technically compromising the Banks technology as at the end of the day its a Scam with the root cause of the compromise being email. Really pleased to see you got your money back, I would ask all to be vigilant on anything like this and if a request is received just take 5 and think about it and if possible check through another channel such as a telephone call. Equally if you are a business make sure you consider the security of your emails, I'd also recommend that on email invoices add a statement saying you will never update bank details via email.

https://takefive-stopfraud.org.uk

We've just implented this with our works email for this very reason. It turns out in an awful lot of companies that fall for this, the staff who made the payment felt it would be "more than my jobs worth" to question any email the boss sent.

 

[garethp]

At work we never change bank details unless the change is in writing (letter, email or fax) and verified verbaly by a trusted contact.

It's a common scam in the world of conveyancing and is tried mainly on Fridays when most sales go through and people are rushing and not thinking. It gets a bit awkward when the hundreds of thousands or millions goes to the wrong bank account.....

 

[Revs1972]

Sounds like you were lucky ( or unlucky depending on how you see things )

I think a lot of the time these scams rely on people not wanting to talk to each other more and doing everything online.
Good on you for posting it though, if it stops it happening to someone else then it's been a worthwhile thread.

 

[marlinspike]

As Gareth says, this is a common scam with house buying. Solicitor gets hacked, buyers get an email asking for a deposit or money, they unwittingly transfer it to scammers bank account. Huge amounts involved, but easy to be duped.

https://www.google.co.uk/amp/s/amp....day-afternoon-fraud-legal-sector-email-hacker

 

[atomant48]

That’s a good link and pretty much exactly my story. A simple but effective barrier would be for the banks to need the account name and numbers to match as mentioned by MattH.

 

[addjunkie]

A lot to be said for the old ways...cash, snail mail, cheques etc...

 

[rcx132]

Coupled with the fact that the banks ask for a name on a bank transfer but don’t use that name to secure the transfer.
I think it’s very bad that they ask for the name but don’t use it as it lulls people into a false sense of security.

That's the annoying bit, if the banks bothered checking the name matches then none of this would happen. You'd think that if you lost money this way you can sue the bank because they've failed in their duty of care. But the caveat is in the legal definition of the word "reasonable". Reasonable doesn't mean "to follow logical reason", it means "what do most people do". So because none of the other banks check the name matches, it's reasonable for your bank not to bother either, and thus there's no breach in duty of care.

But the main issue is that the builder had their email hacked, probably because they've used a weak password or something.

 

[Farside]

It gets a bit awkward when the hundreds of thousands or millions goes to the wrong bank account.....

Sometimes, the bank just cocks it up.
At one point, for many glorious hours, I had an unexpected 'bonus' of something close to a hundred K in my account, deposited there by a property company in Dublin.
I knew it was in error, and it would be found and whipped back, so I didn't touch it, called the branch and they were happy I was honest about it. That stood me in good stead with them later, as it turned out.
It felt great, having the money though.

 

[Dieselman 63]

Sometimes, the bank just cocks it up.
At one point, for many glorious hours, I had an unexpected 'bonus' of something close to a hundred K in my account, deposited there by a property company in Dublin.
I knew it was in error, and it would be found and whipped back, so I didn't touch it, called the branch and they were happy I was honest about it. That stood me in good stead with them later, as it turned out.
It felt great, having the money though.

Yeah it’s a great idea not to spend that windfall... its happened here a few times here, one I recall where a guy bought 5 used Holden Commodores and then had to give them back... ‘but they’re mine’ etc etc

 

[armalites]

When I’ve bought cars and paid by bank transfer I always send £1 with a reference and get them to confirm before I send the rest