Back in March, everything was looking good for Nikhil Dudeja. He and his wife Richa were about to buy their first dream home with the £45,500 deposit they had saved up with significant help from their parents, and the purchase was progressing well. While they were away on holiday Nikhil received an email from their solicitor asking for their deposit money to be paid. He went into his Lloyds banking app and transferred the sum over in two payments.

Five months on and their dream of home ownership lies in tatters. Fraudsters had hacked into the estate agent’s email system, and had seen enough to be able to create a fake email from his lawyer, telling him where to send the £45,000.

So rather than sending the money to his solicitor’s account, it instead went into an HSBC business account that had been fraudulently set up in Kilburn, north London.

Since then the 31-year-old, who works in financial services, has been battling to be refunded. New fraud compensation rules that have helped other victims in the same position came into force at the end of May, and would in all likelihood have meant he would have been refunded by his bank. However, Lloyds has refused to refund the couple, on the basis that he didn’t take sufficient care when making the transfer. HSBC has also denied any liability.

The Metropolitan police have investigated a number of suspicious account openings at HSBC’s Kilburn branch. In a letter to Dudeja seen by Guardian Money, the police said they were investigating if the fraud was facilitated by an insider. Dudeja says HSBC should also have spotted that the receiving account was fraudulent as it was opened online with company details that the police said appeared not to exist.

The estate agent dealing with the purchase confirmed that its email system was hacked into. And yet, Dudeja says, all the companies involved have washed their hands of any liability and refuse to help him.

The couple are just the latest people to fall victim to the most sophisticated of scammers who have specifically targeted property buyers. In 2017 Money featured the case of Howard Mollet, a charity worker who lost his £67,000 life savings. Another couple lost £120,000 in similar circumstances.

“This whole experience has been devastating,” Dudeja says. “The email I received came from the exact same address as used by our solicitor. The bank details were provided on a solicitor’s company letterhead along with the signature of the solicitor dealing with our case. I was expecting to make the payment and just did so. It was the perfect scam.”

When the true horror of what had happened emerged, Dudeja visited a Lloyds branch in central London where, he says, staff treated him as if he had committed the crime, rather been the victim of it. “There was no compassion shown by the branch manager but instead they resorted to victim-shaming me and essentially told me the scam was my fault. I asked them how it was possible to put my solicitor’s name into the payment transfer, and the money go to another company’s account?

“This is when they revealed that the name field is not significant, which is why they give a warning on their website. I checked their website and a warning was there, but there was no warning on the mobile app which I used to make these payments. In fact, the app gave a green tick mark on the payee name, giving an impression that the name of the recipient bank account had been checked and approved, so I always thought the name field was checked by Lloyds bank,” he says.

Lloyds has since offered him £350 compensation for the way he was treated by the branch, but refused to refund the £45,500. However, if his Lloyds experience alarmed Dudeja, his dealings with HSBC and in particular the branch in Kilburn left him a state of shock.

It soon emerged that the fraudulent account to which he transferred his money was in the name of a company that did not exist and was registered to a local residential address. Met police originally dropped their inquiry into his case but reopened it after, he was told, it began receiving multiple fraud cases in subsequent days, all related to the HSBC Kilburn branch.

He was also told by police that there was an ongoing investigation with Royal Mail concerning postal staff in the area. “I have asked HSBC how staff at the Kilburn branch allowed all this to happen and they claim they followed industry protocols, and again have denied all liability. I have asked [HSBC]to pass on to my bank the account holder information, which is a right under the terms of the Payments Systems Regulator rules, but Lloyds has flatly refused to give it to me.”

Dudeja says the episode has left him wondering if the UK banking system is only interested in protecting its profits rather than admitting its failures and doing the right thing by customers.

“We were targeted by organised criminals who have exploited significant failures in the banking system to help steal our money,” he says. “A new code has come into force but Lloyds refuses to abide by it in our case. The impact on us as a family has been devastating. My parents in India had spent 20 years saving up to help us buy a home and they are heartbroken, and amazed that this can happen in Britain in 2019.”

A spokesman for Lloyds said it has a great deal of sympathy for Dudeja, but it would not help him.

“As soon as he made us aware of this scam, around 10 days after he had made the payments, we immediately contacted the receiving bank to help recover his money, but no funds remained. Before making any payments by bank transfer, and especially involving significant amounts of money, we would strongly recommend phoning the recipient on a known number to confirm any payment details sent by email.

“We appreciate this has been a very distressing experience for Mr Dudeja and we have apologised for the level of service he received while we investigated his case.”

In a statement, HSBC said: “Where a report of a potentially fraudulent payment or scam is received we take appropriate and timely action.

“Having looked at the specific detail of Mr Dudeja’s case, we have determined that the payment had been withdrawn before we were notified by Mr Dudeja’s bank and we could not reasonably have acted sooner.”

It said it employs a wide range of methods to detect fraud, adding: “We are confident in our account opening procedures. Various checks are performed during the account opening process, and these checks are in line with the industry standard, supported by the Financial Conduct Authority.”