Emma Spencer was a victim of a sophisticated APP fraud, and lost thousands
A young woman has lost thousands of pounds after falling victim to a sophisticated delivery text scam.
Emma Spencer, 31, fell foul of an Authorised Push Payment (APP) scam after receiving a text at the start of December, supposedly from Royal Mail, claiming a parcel couldn’t be delivered unless she paid £2.
This has become a favourite tactic of fraudsters over the past year, as more people work from home and are ordering parcels to be delivered.
Concerned about the supposedly missed delivery, Emma filled in her bank details to make the £2 payment.
The first sign of trouble came two days later when Emma received a text from her bank, Lloyds, asking for a confirmation code for a £2,300 transaction that had been attempted on Harvey Nichols’ website using her details.
Emma, who is from London, knew she had not made the transaction – and never shopped at Harvey Nichols – so she rightly withheld the code.
Within minutes she received a phone call from someone who identified themselves as a ‘fraud investigator’ from Lloyds, who said he was going to help her protect her account.
He asked her about several transactions and she confirmed whether she had made them or not.
Believing this was genuinely a representative of Lloyds, Emma was persuaded to transfer all of the funds in her ISA and bank account, all of her life savings, to a supposedly ‘safer’ account.
She was told to move her money in amounts of £1,400 from her Lloyds account to her Revolut online banking account, totalling £9,190.
Moving money between several accounts in a short space of time can make it more difficult for banks to track and recover it.
After that, she was told to set up another beneficiary, the scammer, which she did before transferring all of the funds over to them.
To add insult to injury, Emma was also scammed into taking out a £14,000 loan as, when the scammer called, they said someone had attempted to take out a loan in her name.
They pretended to go through an online process with her and she was told Lloyds would be able to cancel it from her end.
It sounds so silly now, but they had ground me down for an hour, plus they had asked me security questions so I assumed they were legit
It wasn’t cancelled, though, and the money went into her Lloyds account straight away.
After this, Emma, who was panicked and worried, called her mother who advised her she thought this was a scam and to stop sending money over and to ring Lloyds straight away.
Emma said: ‘It sounds so silly now when I say it but obviously they had ground me down for an hour, plus they had asked me security questions so I assumed they were legit.’
She phoned Lloyds immediately, only to discover that it was too late and all her money was gone.
With the loan, although she had hold of this money, she presumed the scam artists would have asked her to move all that money to Revolut as well.
Getting the loan cancelled became another source of concern. Emma spoke to seven different people at Lloyds, a number of which told her that she would have to pay the loan off plus interest because she took it out herself.
This was despite the fact she was previously advised by a representative that the bank had applied for the loan to be taken off her account.
A Lloyds and Revolut customer fell victim to a sophisticated Authorised Push Payment scam
After various phone conversations with Lloyds fraud department in which she desperately trying to reclaim the £9,190, Emma was told a scam artist accessed her bank account using Lloyds automated phone banking.
They found out what transactions she had made, which is how they knew what to ask her on the phone, and were then able to move the money from her account to their own.
A large amount of money had also been transferred from her ISA to her current account which almost exactly matched the amount the scammers asked Emma to transfer.
However, her account was not blocked and no one from Lloyds made further contact when she withheld the security code.
When she asked how this could happen, Lloyds said the fraudster probably used the details from the phishing email that she had filled in previously.
She asked why they hadn’t needed a password or code, and Lloyds said this was not needed for automated banking.
This shocked Emma who thought there would be security measures to prevent anyone other than the bank account holder from gaining access to the account.
Lloyds told her it did see the £1,400 payments going from her personal account to her Revolut, but didn’t contact her because both accounts are in her name and it was ‘open banking’.
However, the fraud department told her it was a regular occurrence for scammers to ask victims to move money from personal accounts to their Revolut account and that it happens a lot in scamming cases.
What is an APP scam?
Authorished push payment (APP) scams involve the fraudster tricking their victims into willingly making large bank transfers to them, according to the credit agency Experian.
For example, they may pose as someone from a bank, or another trusted organisation, before claiming the customer has been a victim of fraud and telling them to move money to a different bank account.
Often there is a demand to act quickly, giving the customer less time to think about what they are being asked to do.
To help avoid this type of scam, consumers are urged to question, to the highest level, if anyone asks them to divert a payment or move their savings.
Make sure you phone the bank or firm directly and check on any changes to payment details. Don’t rely on emails as these could be intercepted.
Never rush a payment, as a genuine organisation won’t mind waiting.
Delivery scam texts claiming to be from Royal Mail and other delivery providers have increased recently, as people have become more reliant on online shopping during the pandemic
Lloyds also advised Emma it had been trying to get in touch with her, although she said she had no missed calls or emails.
Emma said: ‘Interestingly, on all the calls I made to the bank, not once have they asked me for letters of my password or memorable information, only my date of birth and address, which the fraudster had.’
Whilst eventually the loan was cancelled, Lloyds said it could not help her recover the £9,190 she sent the fraudsters as she had transferred the money ‘willingly’.
Although Emma accepts she handed over the money, she sys it happened under duress. She believes Lloyds did not act to protect her account despite the fact they saw signs of unusual activity.
Emma said: ‘What is most upsetting is that when I speak to people at Lloyds, I am made to feel like this is all my fault as I physically transferred money and took out the loan.
‘But I believed the fraudster to be a fraud manager from Lloyds, having been asked a number of security questions. He also knew the contents of my account, my recent transactions and that I had an Isa.
‘What confuses me is that both [Lloyds and Revolut] have told me these scams happen, yet seem to do nothing to change the processes that allow them to happen.’
Revolut, too, transferred the whole amount to one of their own customer’s accounts seemingly without any investigation into who the money was going to despite being signed up to a ‘confirmation of payee’ system.
The only interaction Emma received was a text message to confirm a new payee.
Understandably, Emma has been left distraught by the incident, having lost her confidence and her life savings after the incident.
To add to the misery, it seems unlikely she will see any of her money again.
This is Money spoke to both Lloyds and Revolut to find out what security measures were – and weren’t – put in place and how this sort of scam can get through their systems.
Lloyds said it was important to remember that your bank will never contact you to ask you to move your money to another account – but fraudsters can be very convincing
Lloyds response: ‘We repaid the loan but the cash fraud didn’t happen on our watch’
A Lloyds Bank spokesperson said: ‘Helping keep our customers’ money safe is our priority and we have a great deal of sympathy for Ms Spencer as the victim of a scam.
‘Our investigation found that she transferred money from her Lloyds Bank account to her own existing account at Revolut, from where she went on to make payments to an account controlled by fraudsters. No money was transferred to fraudsters from her Lloyds Bank account.
‘It is important to remember that your bank will never contact you to ask you to move your money to another account – this is a tell-tale sign of a fraudster at work.’
Lloyds said its investigation found that Emma provided the fraudster with enough secure information – which should be known only to the customer – to allow them to make a number of internal transfers from her Lloyds Bank savings account to her Lloyds Bank current account via its automated telephone banking service.
It said it is important to note that only a limited range of actions can be carried out on an account via this service.
The fraudster would not have been able to withdraw these funds or transfer money to a new beneficiary, it said.
As these were internal transfers between her own existing accounts within Lloyds Bank, no money was lost.
Customers are urged to never transfer money to an unknown bank account [stock image]
Unfortunately the fraudster convinced Emma that she needed to transfer her money out of her Lloyds Bank accounts, to so-called safe accounts held at other banks, which it says no bank would ever ask a customer to do.
Lloyds said Emma initially transferred the money to her own account at Revolut. As she was transferring these amounts to another account in her own name, these transactions were not flagged as being suspicious.
She then went on to transfer money from her Revolut account directly to the fraudster’s account.
The loan has now been unwound and her credit file updated to reflect this. It confirmed Emma’s current account has a credit balance in addition to an unused overdraft limit, and she continues to use her debit card to make payments.
Lloyds did not answer our question regarding why a customer transferring over £9,000 out in the course of an hour, when her usual outgoings for a month stand at around £2,000, why it was not flagged on its system.
Revolut’s response: ‘We tried to recover money but it was transferred to a third party’
Revolut said that, when it detects or is alerted to fraudulent behaviour, it gathers the necessary information from the customer and initiates its APP Fraud Recovery process.
This, it said, includes assessing any customer testimony and auditing the entire ‘transaction journey’.
It checks of all the warnings of potential fraud that the customer received, as well as contacting external parties that might have been in receipt of fraudulently-obtained funds.
Where apparently fraudulently obtained funds have been transferred to another account, Revolut said it would immediately try to intercept them and prevent any loss to the customer.
But the ability to do so depends on whether the funds have subsequently been transferred out of the external party’s account.
A Revolut spokesperson said: ‘This matter was reported two hours after the customer transferred the funds.
‘We immediately activated our anti-fraud procedures, including immediate contact with the external party to which the funds had subsequently been transferred.
‘All of this was completed within 20 minutes of being reported by the customer.
‘Where apparently fraudulently obtained funds have been transferred to another account we immediately try to intercept any funds and prevent any loss to the customer.
Revolut said when it detects or is alerted to fraudulent behaviour, it gathers the necessary information from the customer and initiate its APP Fraud Recovery process
‘Unfortunately such funds are often transferred to a non-Revolut account immediately so that we may not be able to recover funds. We always make every effort to do so – working with other financial services companies and banks as necessary.
‘Unfortunately, to date the funds have not been recoverable. The ability to recover the funds once they have been transferred externally depends largely on whether the funds have subsequently been transferred out of the external party’s account.’
Revolut is not currently a member of the Contingent Reimbursement Model Code, which sets out consumer protection standards in relation to APP scams and refunds.
How can customers get their money back from scams?
As it stands, Emma is unlikely to see her life savings again despite falling victim to a sophisticated scam.
She assumed should anything like this happen to her, she would be warned by her bank, and feels there were not enough security measures in place.
Unfortunately, she is just one of thousands of people who fall victim to such fraudsters everyday.
Whilst some are fortunate and get their funds back, many will never see their money again as fraudsters quickly remove the funds from their accounts to avoid detection.
If this has happened to you, it is essential to contact your bank immediately to alert them of the fraud. They can then stop any more transactions going through and see if they can scrape back any available funds.
It could also be worth contacting the Financial Ombudsman as they do investigate a variety of scams including APP fraud.
Meanwhile, Action Fraud suggests consumers follow the below tips before sending money to anyone:
Stop: Taking a moment to stop and think before parting with your money or information could keep you safe.
Challenge: Could it be fake? It’s ok to reject, refuse or ignore any requests. Only criminals will try to rush or panic you.
Protect: Contact your bank immediately if you think you’ve fallen for a scam and report it to Action Fraud.