Fake 'BT' caller fleeces elderly victim of £30k in APP app scam
- Reference: 1632747489
- News link: https://www.theregister.co.uk/2021/09/27/fake_bt_caller_fraud/
- Source link:
The incident happened last Thursday (23 September), prompting West Mercia Police to issue a bulletin warning people to be on their guard against suspicious phone calls.
In this case, the victim was called with the perpetrators pretending to be from BT. They then asked him to download an application onto his mobile.
[1]
Once the app was downloaded, they then convinced the man to log in using his online banking details and thereafter to transfer a sum of money to another account for "safekeeping."
[2]
[3]
In a statement, West Mercia Police said: "We received a report from an elderly victim… that he was telephoned and told by the fake BT staff that there was suspicious activity on his account.
"Once he had downloaded the app, the offenders then took control. They showed him a transaction of £30,000 into his current account and said that he needed to transfer it into a different account for safekeeping," they said.
[4]
The scammers then asked the victim to visit his bank – all the while keeping his phone line open. He was then persuaded to transfer the £30,000 into an unknown account.
"The victim has since found out that the original £30,000 had been transferred from his own savings account into his current account, which he then transferred to the 'safekeeping' account, which was the offender's," said police.
Detective Sergeant John Higgins from Shrewsbury CID [5]described this as a "cruel fraud" that "abuses the trust that vulnerable people have with established and well-known organisations they think they can trust."
[6]
He went on: "I would like to remind everyone that the police, government agencies and well-known companies such as BT will never ask you to transfer funds for them in this manner. They will certainly never ask you to attend your bank and if you or your family receive a call like this, hang up immediately."
[7]Nuisance call-blocking firm fined £170,000 for making almost 200,000 nuisance calls
[8]The black screen of BIOS borkage haunts Space Shuttle Discovery's new home
[9]Brit IT firms wound up by court order after fooling folk into paying for 'support' over fake computer errors
[10]Fridges... in... Spaaaaaaace: Engineers book ride on the Vomit Comet to test astro-refrigerator
Last week, UK Finance – the umbrella group for the banking industry – reported a 71 per cent spike in the number of authorised push payment (APP) fraud for the first six months of 2021 [11][PDF] .
In APP fraud, a customer is tricked into authorising a payment to a third-party account using a variety of underhand methods such as scam phone calls, text messages, and emails.
According to UK Finance, this is the first time the amount of money stolen through APP fraud has overtaken card fraud losses. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YVHqyGBZOmFu@IXDaONsMQAAAAs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVHqyGBZOmFu@IXDaONsMQAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YVHqyGBZOmFu@IXDaONsMQAAAAs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVHqyGBZOmFu@IXDaONsMQAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.westmercia.police.uk/news/west-mercia/news/2021/september/victim-loses-30k-to-fake-bt-caller-fraud/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YVHqyGBZOmFu@IXDaONsMQAAAAs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/08/02/ico_nuisance_call_ycsl/
[8] https://www.theregister.com/2021/07/07/bork/
[9] https://www.theregister.com/2021/06/15/high_court_winds_up_it_scam_companies/
[10] https://www.theregister.com/2021/04/16/fridge_space/
[11] https://www.ukfinance.org.uk/policy-and-guidance/reports-publications/2021-half-year-fraud-report
[12] https://whitepapers.theregister.com/
This has got to be an inside job, someone who knows the inner workings of a particular bank, and what does and doesn’t raise flags. My 72 year old dad has a hobby of restoring old machinery (presses and lathes etc.). Every 3 to 4 months or so he goes into the bank to withdraw £2-3k to take to the auctions. He gets the Spanish Inquisition each time he does, “what will you be spending the money on, are you sure you haven’t received a telephone call asking you to withdraw money, are you really really sure?”. He finds it incredibly frustrating that they don’t give him access to his money, but after I pointed to a couple of stories like this he understands why it’s necessary.
I'd agree that at least a few of these scams are triggered by insider information, as evidenced by my wife paying a monthly care home bill for her mother via online banking, then at around 5pm the same day, getting a phone call from someone purporting to be from the bank saying that the payment hadn't gone through because the payee account details had changed and could she re-do the bank transfer but to a different account number.
Of course, being a council-estate girl made good, she was immediately suspicious and phoned the care home directly to confirm they'd received the original transfer, which they eventually confirmed they had.
I hope she reported it to the police - because it's either someone at the bank or someone at the care home.
> This has got to be an inside job, someone who knows the inner workings of a particular bank
Sadly no. They don't need to know the inner workings of the bank - only the inner workings of the bank's app. And they can study that at their leisure.
Any extra warnings that the bank's app put up were probably suppressed by the scammers own app which they tricked the victim into downloading and running.
One suggestion might be to make the ability to make transfers to non-UK accounts an option that has to be requested - in the same way that an overdraft has to be requested - and that request has to be by phone so the bank staff can ask why it's required. That way even if a scammer gets as far as this one did, the final transfer would fail.
In the UK, I have found there are a few steps one has to take in order to add a new payee to one's account. And the banks now seem to want to know the address of the payee, as well as the basic sort code and account number info.
However, going into one's own bank and making a personal transfer is clearly a different way for the "crims" to carry out scam.
In this case though, it seems strange that the scammers were able to access the victims "savings" account without the victim knowing (in order to transfer funds into the victims current account) and to hoodwink them into thinking that they had an extra £30,000 in the account "so it must be legit" hence they went to the bank to make the transfer to the "crims"...)
How does this work?
I always wonder in such cases how the purpotrator's bank account is set up as it's such a royal pain to find all the paperwork to get one normally as I can never remember who makes my underwear or what my great grandmother's dogs had for tea on a Thursday ... Then there'd be the little case of the direct bank transfer of £30k which surely should be questioned?
Re: How does this work?
Probably wouldn't feel as much of a pita if you knew it was gonna be making you 50k a month (or whatever these scumbags make).
Re: How does this work?
At RuffianXion, it still requires multiple forms of ID, including a photo ID issued by an approved source, to verify you are whom you claim to be. You can't just walk in, inform a teller "Please open me a fresh bank account with no ID check" & expect to get anything beyond laughed at. There has to be a registered Human to whom the account belongs. Follow the money, nab that person, & interrogate them with extreme prejudice until they either cough up the money or the name(s) of the people they sent the money along to. If they pay the money directly then they may "only" get life behind bars. If they refuse to give up the money/name(s) then they will *definitely* spend the rest of their life behind bars while the tax auditors go through every aspect of their lives in an attempt to find the money, reclaim the funds, & return the ill gotten gains to the victims.
TL;DR: Follow the money. Find the bad guys. Strap them down & force them to listen to Vogon poetry until they explode.
Old people have smart mobiles?
Yes. Because banks are closing offices left right and center and there's lots and lots of things that simply cannot be done without using a computer or a smartphone. And many use if also for things like chatting with the grand-kids
Yes, but some of us are no longer smart enough to use them or understand the damn things.
Hm. Considering my mother point-to-point wired Honeywell EDP equipment in the '60s, you can sure as hell bet she has her own smart mobile. And her Devuan box she set up herself.
Do NOT hang up at once
I try and keep these people on the line for as long as possible, and play them along. The longer they are talking to me, the less time they have to actually scam someone for real.
Re: Do NOT hang up at once
Two downvotes for this? Must be scammers!
The other day I got a phone call from someone purporting to be from O2. He asked me to confirm my name, and I wouldn't. I asked him to tell me some phone numbers on my account, and he said he couldn't because I haven't identified myself. In the end, he relented and gave me the last two digits of two of the phones on my account. He had successfully proven himself to me, but honestly I couldn't tell if it was a scam or not at the beginning.
Banks ought to send out large cards with big writing in bold to elderly or vulnerable people with simple advice like "never transfer money at the request of someone else unless you intend them to take that money" or "if you get a phone call from Microsoft or an internet provider, it's always, 100% of the time a scam". This does mean that some genuine calls will be rejected, but it's a small price to pay for avoidance of these scams.
I’ve had the same from Sky - wanting to review my account, AKA sell me more shit. It was probably a genuine call, but when someone rings me up and asks me to confirm my name, address and date of birth the call is getting ended very, very quickly.
My solution
On iOS: Settings > Phone > Silence Unknown Callers
Your phone will only ring for people in your contacts :)
Amazon iPhone 7
A few weeks ago, while I was visiting my father he got a phone call purporting to be from Amazon, saying that his order of an iPhone 7 was on its way. He hung up, eventually. It was, of course a recorded message, so presumably the scammers just cannot be bothered to update it to a more recent model.
(I have to say that if anyone is still ordering an iPhone 7 for £695, it is news to me.)
then transferred to the 'safekeeping' account, which was the offender's
what has always puzzled me in this, already 'classic' story, the loose end, i.e. how the offender(s) opened the bank account, in this day and age, where you're supposed to present a passport, or other form of id (or am I naive that you can upload any doctored passport scan, with any doctored bills, and you get a big, greeen OK - congrats! message from the bank?] and how - presumably - how they managed to withdraw 30K, presumably very fast and disappear. Where is the supposed 'robust' banking security systems that are supposed to flag suspicious behaviour, e.g. such as a bank account, presumably dormant, suddently receiving a large amount of money, withdraws it (clearly), and leaves a middle finger in mid-air? This part of the 'classic' story never comes up, and we're left with the 'police make [another] urgent appeal for people to be on the lookout', until the same story re-surfaces a couple of days later.
Where were the safeguards in the bank? An elderly gentleman walks in to transfer £30,000 to a new account would they not be suspicious? Would they not ask who and why and what for?