Michael Johnson* and his business partner had struggled for a month to open a new account with Metro Bank, despite the fact that he was already a customer. So it was a relief to receive a phone call apologising for the delay and promising that the new account could be set up then and there. The caller took him through Metro’s standard security questions and Johnson received authorisation codes texted from Metro to enable the transfer of his payees from his old account to the new. That afternoon he received another call. It was Metro Bank informing him that he had been scammed out of £9,200.
Nearly 85,000 banking customers lost £354m to fraudsters last year after being tricked into revealing bank details. The scam, known as “authorised push-payment fraud”, typically deceives customers into thinking they are communicating with their bank so that they disclose vital security information, or with a legitimate trader to whom they owe money.
Johnson’s case is remarkable because of its sophistication. The caller mirrored Metro Bank’s security protocol, customer service style and terminology, and was already primed with personal information about him and his company.
“At no time did I suspect that I was not talking to someone from Metro Bank despite being alert to the risks because my father had been scammed a few weeks earlier,” he says.
The scam began with a genuine tweet from the bank asking customers to share their experience of its customer service in an online survey.
Johnson’s business partner tweeted back to report the difficulties setting up the new account. The fraudster saw her tweet, Googled her details and called her via her company contact number posing as a Metro Bank customer service operative called “Neil”.
She was told that the call was in response to her tweet, and that the bank wanted to rectify the poor service and get the new business account set up immediately. She was asked for details of the business as part of due-diligence checks required by the banking regulator and she named Johnson as a co-director.
By the time “Neil” had obtained Johnson’s number from the company website, he already knew enough details about the business and its banking facilities to convince Johnson he was genuine.
Alarm bells might have rung if “Neil” had asked for full passwords, but he didn’t. “He told me he’d just got off the phone from my business partner and that the person who had been dealing with the account request had missed the fact that I was already an account holder, which should have made the procedure straightforward,” he says. “He then asked me for two characters from my password and user name and explained that he would need to switch my existing account from ‘personal and business’ to ‘business online’ so that he could set up the account. This is all Metro language.
“He told me I would be receiving some texts – which came from Metro Bank and therefore raised no suspicion – and I would need to give him the codes contained in them so he could transfer the payees to my new business account.”
“Neil” rang off several times in order to “run some checks” and each time he called back he repeated the same security procedure.
“I am assuming he asked for a different two characters from my password each time until he had the whole log in,” says Johnson. “I now know that instead of transferring payees to a new account, he was setting up new payees on my old one and transferring my money to them as soon as I gave him the authorisation codes.”
Metro Bank was alerted when “Neil” called its customer services, masquerading as Johnson, to ask when the money would go through. It then rang Johnson to ask if he was aware of the transactions. “It took six weeks for the bank to investigate and it recovered £2,400, leaving me £6,800 short,” he says. “Because I had essentially given away my password and the codes from the Metro texts, it said I hadn’t been careful enough and would not get a refund.”
The Observer has been contacted by a number of Metro Bank customers who were scammed after fraudsters posing as the bank, alerted them to suspicious activity on their accounts and tricked them into confirming their security details.
In all cases, the fraudsters spoofed Metro Bank’s 0845 customer service number, so customers who saw it on their display screen assumed the call was genuine. Metro Bank refused to fully reimburse them until the Observer intervened.
Whereas customers are entitled to claim a refund from their bank if they are defrauded by credit card or direct debit, there is no legal protection for victims of authorised “push payment fraud”.
Until now, banks have argued they are not liable because these customers authorised the disputed transactions themselves, either by moving money at the fraudster’s behest, or in providing enough information to access to their accounts. However, as branch closures force customers to rely increasingly on remote banking, and technology has made criminal stings increasingly sophisticated, the financial sector has been criticised for leaving customers unprotected.
This month the Financial Services Ombudsman reported a 40% increase over the last year in the number of complaints about how banks handle fraud cases. It says it has awarded record sums of compensation to victims and warns banks that there is a “high bar to meet” before they can refuse a refund. “We know from the complaints we see that banks aren’t always treating victims of fraud fairly. They must do better,” says the chief ombudsman, Caroline Wayman.
This week a new code of practice commits banks to refunding customers who have lost money in authorised “push payment fraud” provided that they were not culpably negligent. However, the code – drawn up by a steering committee of banks and consumer groups – only applies to banks who have agreed to adhere to it and is not retrospective.
So far, seven banks, including Metro, have signed up. Meanwhile, the Payment Systems Regulator has announced that the six biggest banking groups will be required to confirm the name of the payee before completing a bank transfer to help prevent money ending up in the wrong account. Currently, the account names of recipients are not checked against the account number. The new rules come into force next March and smaller banks are expected to follow suit “at the earliest opportunity”.
Metro Bank says that it stopped the fraudulent transfers from Johnson’s account as soon as it became aware of the scam and managed to recover some of the money sent. It agreed to refund Johnson the remaining £6,800 after the Observer intervened.
“We have undertaken a further review of this case as we always want to do the right thing for our customers,” it says, insisting Johnson is the only customer known to have been defrauded as a result of its marketing tweet. “We have a range of safeguards to help defend customers against fraud, which we constantly review and update in light of increasingly sophisticated tactics.”
So far it’s a losing battle. Johnson’s experience shows that even the savviest customer can be caught out.
“I’d hire ‘Neil’ as a customer service agent tomorrow if he wasn’t a crook,” he says “He was excellent all the way through. I trained as a chartered accountant and have 30 years’ business experience and I still fell for it.”
* Name has been changed
Staying out of danger
• If your bank calls, be wary about disclosing sensitive information until you are sure the call is legitimate. If in doubt, hang up, wait five minutes to ensure the line is clear and dial the number on your statement.
• A bank will never ask you for your full password or request that you transfer funds over the phone to safeguard a compromised account.
• If a trader, such as a builder, car dealership or conveyancing solicitor, emails to ask you to pay your bill into a different account, call them to check that the email address belongs to them or is part of a previous thread. Fraudsters can hack into business accounts and send emails that look authentic.
• Beware of emails purporting to be from authorities such as HMRC or TV Licensing and asking for payment or details to refund an overpayment. These may be “phishing” scams and if you click on the link provided your bank account could be compromised.
• Be careful what personal information you share over social media and avoid any posts messages that reveal who you bank with.
• Keep a close eye on your statements and report any concerns immediately. Since January, victims of fraud have been able to complain to the bank that received their stolen money, as well as their own bank.
• If you are dissatisfied with the bank’s response, complain to the Financial Ombudsman Service, which has powers to enforce a refund if it decides you were not unduly negligent.
