To think there must be some way of getting this money back?

[HicDraconis]

So so angry right now.

My Dad was telephoned by someone claiming to be from BT reporting a problem with his router. She was very plausible, and persuaded him to download a patch to fix the problem. (Yes, I know. But he's 80, lives on his own, uses his computer and internet daily to maintain some kind of contact with the outside world, would feel lonelier and much more depressed without it so was very concerned when he thought it may be at risk).

He downloaded the "patch" and carried on as normal. At some point he checked his online bank account. After this, someone else logged in to his account using the details and password they'd obviously managed to get from this "patch" and cleaned him out down to the limit of his overdraft - they've stolen well over 4000 pounds, 4000 of which was overdraft.

He's a pensioner and reliant on just his state pension to make ends meet every month.

Apparently the bank says there is no guarantee and very little chance that he will get the money back. Which means that not only does he have nothing, any money he gets in the next few months will have to go into paying off the overdraft.

AIBU to think that his bank have failed in their duty of care by processing a transaction which on the face of it looks highly suspicious? I know when I want to transfer a chunk of money out of my UK bank account, as well as the online bits and bobs I have to put a card into a reader and generate a once-only passcode. In NZ I am sent a text message with an activation code before large online bank transactions are processed. I think that his UK bank has failed to instigate measures to reduce fraud and has processed a transaction that looks like fraud and therefore they are liable to repay him the money (and try and get it back from their own insurers, or the receiving bank).

Does anyone have any advice or suggestion as to how I can help from the other side of the world? Any experience in this sort of thing and getting money back?

[nocoolnamesleft]

"Banking regulations say that a bank can only refuse a refund for an unauthorised transaction if it can prove you authorised the transaction or that you acted fraudulently or were grossly negligent in failing to protect your Pin and password."

www.which.co.uk/money/bank-accounts/guides/how-to-bank-online-safely/tips-to-avoid-phishing-and-identity-theft/

[Verypissedoffwife]

If you're not getting any joy through the bank escalate it through complaints - right up to the ombudsman if needed. From what you've said it's clearly an unauthorised transaction so your Dad should be covered.

[AdjustableWench]

Your dad should speak to the Citizens Advice Bureau, as well as (perhaps obviously) the police.

I hope he manages to get the bank to return it. Your poor dad. These scams are disgusting.

[Atenco]

You and Yours on Radio 4 were talking about this only last week, I think this is the programme www.bbc.co.uk/programmes/b06mfqcb

[Baconyum]

First of all NOT saying its right and absolutely he has been a victim of crime BUT I think bank and ombudsman will say he's not covered due to he was

"grossly negligent in failing to protect your Pin and password."

By falling for this I'm sure very convincing theft by a scammer.

I hope I'm wrong I really do. Meanwhile I hope he's not too shaken up and wish you loads of luck in resolving this.

[HicDraconis]

Thanks all for comments, suggestions and links, am following them all up.

Baconyum I agree that's the risk, but I don't think he was grossly negligent in failing to protect his PIN/password. He didn't give it to anyone, he didn't use it on any computer other than his own, supposedly virus-protected one - he downloaded something which I suspect behaved like a keylogger or remote access program without his knowledge. I don't know that this could be argued to be gross negligence, at least I hope not.

[wannabestressfree]

Nasty bastards preying on the vulnerable. I hope your dad gets it back in full .....

[eternalopt]

I would pursue it. I don't think what you've described would fall into "gross negkigence". He didn't give out his banking details directly - his computer was hacked. The payment services regulations says that he has to take reasonable steps to keep his banking details safe. However, they also say that where you have failed to keep the personalised security features from safe being stolen, your maximum liability is £50 unless he was grossly negligent, so it's far from clear cut, as the regulations anticipate situations where you were negligent or careless, but only liable for £50. Case law doesn't provide much guidance, only to say that the use of the word "grossly" means that it has to be something more than just plain old negligence, so it is a high threshold. I would use the ombudsman.

Also, check his home insurance - some offer assistance with identify theft matters. They don't cover the losses, but they will help with any legal costs of recovering the position.

Might also be worth checking his credit report too to make sure the scammers haven't done anything else untoward with your fathers details.

Really hope your dad gets some redress. Let us know.

[eternalopt]

By coincidence, they are taking about scams like this on bbc breakfast right now. The example they have given is of a woman who was phoned like this by people pretending to be connected to talk talk Internet. She allowed them access to the computer. Also, they told her on the phone that they had put a payment of £5000 (!) in her account and could she send it back to them, so she sent the a payment of £5000 ( ) . They later accessed her account again and took another £5000 using her details. She wasn't able to recover the first payment as she was involved in making it, but she got the second £5000 back from the bank as she wasn't involved in the payment. Second bit sounds similar to your dads situation, so hopeful.

[HicDraconis]

Thank you. Hoping!

[eternalopt]

Name and shame the bank if not

[zipzap]

It's bonkers that they don't flag up transactions like this and yet will sometimes contact you for a small legitimate transaction that has raised suspicion somehow or when you go abroad - you tell them you're going and they still cancel the card 'because it's been used abroad' leaving you stranded. and when you ask how you can stop this from happening again they say you need to tell them. Grrrr

I digress. Yes. The bank should definitely have older pensioners who out of the blue empty their account having never done this before as one of their 'let's double check before we automatically authorise' situations - indeed they should do it for anybody in this situation (assuming you haven't gone to the bank to get an overdraft of £££ to use immediately in which case they can note that in the system.

Good luck getting the money back.

Have you mentioned to the bank about the bt patch? If not - could your dad not mention it or if it comes up just say that it was BT that gave him the patch - as that's what he believed at the time. Would he know that the bt patch was a scam if he didn't have you (or other siblings etc) to tell him?

[Turquoisetamborine]

Get your dad to divert his pension and other income to a different bank account with an entirely different bank.
At least he will then have some income while they sort it out.

[HicDraconis]

Argh. So I managed to get more of the story ...

Seems he was called by someone about the problems he was having with his router. After some persuasion (he put the phone down, they called straight back and insisted he had to talk to them) they got him to type some commands into a terminal prompt. I imagine this allowed some sort of remote access. They then ran a script which showed he was entitled to a £200 refund and asked him to log into his online banking to confirm receipt. He duly did so and noted a receipt of £2200. Much kerfuffle on "BT" end and a request to refund the £2000 to a certain account. The bank called to query it, he assured them it was ok and got a 4 digit authorisation code which he entered - and then his entire account was wiped.

So the bank did query it, and he did authorise it. But far more money was transferred than he authorised. He may not get the £2k back but from reading the stories above he may get the rest.

Still angry. Bastards, preying on an elderly pensioner. Luckily he'd done a decent food shop just before, and the bank are happy to honour his direct debits while it all gets sorted without charging him additional overdraft fees. And just in case, I'm looking at sending $11000 back to the UK (moved over with a rubbish exchange rate and it's gone back the other way, typical).

[Youarentkiddingme]

Oh your poor dad I hate scammers like this and hate it even more that they prey on people by using plausible mistakes.
I really hope you get the money back.and if they transferred 2.2k and he authorised 2k back he should have still been £200 up before they then took the over 4K. So I would have thought all the money they took he didn't authorise would be refunded?

[lifesalongsong]

Have you reported this to Action Fraud? This is such a common scam here at the moment.

I'm actually impressed that the bank called to check with him, from the info in your update post you should name and shame them to highlight how on the ball they were.

People quickly jumped to the conclusion that the bank wasn't doing thier job properly, not your fault that you didn't have the full facts at the start but a gentle warning not to jump to critising the bank.

Hope you can get some of the money back

[HicDraconis]

The scammers actually told him his bank would ring to request confirmation of the transfer. They had the script down pat

Even so I don't think they should have allowed the entire account to be emptied without checking the full amount that was being taken.

[UsedToBeAPaxmanFan]

Is he sure it was really the bank that phoned? It might have been part of the scam. Or have the bank confirmed that they did phone ypur dad?

I really hope he gets his money back. These scammers are low life.

[RitaConnors]

Yes, it might not have been the bank. I had my account hacked three weeks ago and I had three calls allegedly from my bank that weren't. It's very difficult to know whether you are talking to a real bank or not. I didn't know whether I was coming or going.

[enderwoman]

I'm with HSBC. They send me a text requesting a call when there are problems with my card or account.

Many scammers call posing as banks so I'd be dubious whether the bank actually called.

[lifesalongsong]

But how would someone pretending to be from the bank add to the scam? I can't work out how that would fit in.

Once fraudsters have your details they want to empty the account as quickly as possible. Does anyone know why they might pretend to be the bank requesting confirmation?

[BoreOfWhabylon]

I think I'd contact the Radio 4 Moneybox programme to see if they can help. One of the cases they reported on yesterday was v similar, promise of £200 refund etc (although they were purporting to be from TalkTalk not BT).

Contact details are in on the site

[lushaliciousbob]

lifesalong I think (please someone correct me if I'm wrong) that they then pretend to be the bank to make the situation more real? Because these days most people will get a text / call from the bank to confirm a large sum leaving the account.

[cornflowers]

Which bank was it OP?

[Fallout4fan]

If I want to set up a new transfer or payment the bank authorises it with me via a text on my phone or telephone call and if someone tried to change my number to theirs I would get a text or phone call on my old number to check its me doing it. So basically I would know and could call the bank and stop it. I have 2 different bank accounts with different banks and they both do it.