Charlotte Purcell, 20, lost £940 of her student loan in a scam so sophisticated that it even deceived staff at her local bank.
Purcell had received a string of emails and calls from Metro Bank – or what appeared to be Metro Bank – and had agreed to transfer her money to a new account number. She headed to the bank just half an hour later, showing the messages to bank staff, and was assured they were genuine.
“They looked at the text messages, confirmed all was OK and said I would receive new cards in the post in the next week,” says Purcell, who is in her final year at Durham University.
But she was in reality the victim of an elaborate scam – yet until the Guardian intervened, Metro refused to refund the stolen money.
The Metro Bank customer is one of thousands to have been defrauded out of sums totalling £207.5m from all banks in the first half of the year. According to figures from the banking body UK Finance, transfer scams have risen 40% since the first half of 2018 while the sums retrieved by banks have fallen by 2%.
Purcell’s ordeal began in April when she received a text from Metro’s customer service number advising her of a suspicious transaction and asking her to call. When she pressed the highlighted number in the message she was put through to an operative who told her that because her information had been compromised her money would be moved to an internal account and her bank cards would be cancelled and reissued.
“I was sceptical but they reassured me by showing me that the number I had called matched the number on the back on the card,” says Purcell. “They also sent me a confirmation text with an authorisation code on the same thread of messages I have previously received from Metro. So I transferred my balance into a new account in my name.”
But she still harboured some doubts, and after speaking to the operatives almost immediately headed to her local Metro branch. It was in the branch that the Metro staff assured her that the text messages were genuine and that her new cards would be sent out shortly.
Three weeks later, while still waiting for her new cards, Purcell rang the bank for an update on the new account. Only at this point was she told by Metro that she had been scammed. She asked if they could find where the money had been transferred to, but was advised that it would take up to 21 days for the beneficiary bank to try to trace her money.
When she called for an update two weeks later she learned that the trace had never been actioned. After that, she said, her requests for updates went unanswered.
Purcell is one of several Metro customers who have contacted the Guardian after falling victim to scammers who “spoof” their bank’s telephone number to make the call look legitimate. One lost £90,000 when she was texted by a number matching Metro’s business centre . In fact, a caller can easily change their phone ID to mimic the number of a bank or official agency and gangs are targeting banks that still rely on SMS texts to verify the account holder. They also mimic a bank’s security procedures to make a call and messages appear authentic. All the affected customers were refused refunds by Metro who accused them of “gross negligence”.
In May, UK Finance introduced a voluntary code requiring banks to refund customers defrauded by transfer scams, known as authorised push payment fraud. The move was in recognition of the increasing sophistication of scams and Metro is one of the banks to have signed up.
But the new protections came a month too late for Purcell, who never received her money back. Metro only compensated her five months later after pressure from the Guardian.
“We investigate each claim that is referred to the bank and our decisions are based on the merits of each individual case,” said a spokesperson. “We’re pleased to be able to refund the customer on this occasion because of the exceptional circumstances that surround the case.” Asked why it had not recognised the exceptional circumstances before press intervention the bank claimed it had reviewed the case again “to understand what happened”.
Customers are being left increasingly vulnerable as online banking safeguards fail to keep pace with criminal tactics. Money that can be transferred in an instant has usually vanished by the time banks try to trace it. In Purcell’s case she alerted Metro staff within half an hour of the fraud but since they too were duped by the scam, then took a month to pursue the funds, her money was unrecoverable. “I know it is ultimately my fault that I fell victim to a fraud,” she says. “But the incompetence with which Metro has handled what for me is a terrible loss and their failure to notice anything was wrong when I first alerted them has caused me a lot of anguish.”