Just been scammed!

[FlyingBuddha]

I feel so stupid and so upset.

I got a phone call tonight from a private number and answered (first mistake) the guy on the other end sounded genuine and told me someone had tried to log into my Klarna account at 8am this morning, he asked if it was me, I said no I don’t remember doing so and started panicking I’d been hacked (oh the irony!) he then said he had sent me through a one time passcode and if I could let him know what it was he could then proceed in freezing my account and changing the details so no one else could enter who wasn’t me.
I said thanks and ended the call.
I did think it was odd, but because no bank details had been exchanged alarm bells didn’t initially ring.

About 5 minutes later I had five notifications in a row on my NatWest account of payments of £50.00 each from Klarna, totally £200, then another from them of £116.

I immediately called NatWest and they blocked and cancelled my card, said they will send me a new one with new pin, they have also said they can refund the money back to me too, but it’ll be in a few working days.
I then called Klarna and they have flagged the purchases (totally £600!) as fraud and I’m to call again for an update in a couple of days.

I am so upset at myself. I haven’t got £600 to lose, we are on a very low income and I’m struggling as it is.
I know it’s my own stupidity , but I am so frustrated. I literally watched the money leave my account every couple of minutes, I was shaking so much I could hardly call the NatWest number.

There are all manner of lists floating around that scammers can buy. Try enough names and numbers on a purchase and you'll get lucky eventually.

They probably didn't know she had a Klarna account, but they will contact so many people that a few will have one.

I get loads of emails concerning 'problems with your Paypal account', which I don't have.

I once received an email saying there is a problem with your American Airlines booking, please click here... I've never flown with them and don't live in the US. I forwarded that one to AA and they sent me a lovely email back thanking them for alerting them to the fraud.

It's really easy sometimes, unrelated websites have data leaks and lists of emails and passwords from websites are sold on the black market. Mumsnet had one a few years ago, where users log in details and passwords were published on a website.

A lot of people still use the same password across every single website they use, so something like a MN password being leaked gives access to everything, and then you have stuff like this, where they make up a story and ask for the one time security passcode and they're on.

A lot of people still use easily guessable passwords too so it doesn't even need to be a data leak, often people their kids name and year of birth, or personal dates like wedding anniversaries etc, so many people also share a lot of the answers to the basic security questions on Facebook memes too, "what memories do you have of your first car?" stiff and then you have folk putting their first car model, colour, year they had it and all sorts of personal stuff that seem harmless but actually also gives scammers a lot of answers to security questions and passwords.

Using public wifi can also be a risk. Theres so many methods people use and even the most vigilant of people can be causing out because scammers change their tactics all the time.

OP if you haven't already I'd suggest changing your password for every single account you have if you use the same email and password combo for anything else.

In future op just take your card off your account after use.
Yes, it’s a pain but it will protect you.
Amazon is the only account that I leave my card attached to, the others I don’t allow details to be kept.
Also always remember that even if the caller was truthful (unlikely) as long as you do nothing your bank will refund you.

I assume the one time code from klarna was probably to change the password and they already had an email address connected with a phone number. With that access you can then request payments and I assume klarna have some functionality to withdraw the money to an account, which they’d just input their details after taking the NatWest transactions.

OP it's so easy and they're so convincing, you're not stupid.
I nearly got done 3 years ago. I had a call of my 'bank' saying there'd been a transaction on my account which didn't look right. They asked me some questions, and of the questions was how much from memory would I expect to be in my account. It was a couple of days before payday so there wasn't much, like £250. Then the lady said they'd cancel my card and send me a new one. At this point I mentioned I'd actually had a new card arrive that morning as mine was expiring the following month so would this one be okay or do they still need to send me a new one. At this point she was a bit vague and then we said goodbye. A little while later I thought it was a bit strange so rang my bank who'd had no record of this call. They did say because I said I'd only got £250 in the account it probably wasn't worth the scammers time, and if I'd had more money they would then have likely asked for card details etc.
It was so believable, the scammer had a Yorkshire accent which is where my bank is based. And I actually had a call like this a few years before which was legit, I'd used my card that morning by my house (West Midlands) yet it had also been used 5 minutes earlier in London at a Pret which made the bank flag it up.
I was so lucky, if the scammer had rang a few days later after payday I'd have been screwed. I see myself as pretty savvy, I can't believe I fell for it.

Sounds like maybe they did a password reset to your phone.
I am sorry OP, its very easy to be wise after the event
I hope Natwest sort it out for you quickly, I had soem fraud on my account last year and while it was sorted quickly its a horrible feeling

Even if they call from a displayed number doesn't mean it's safe, I googled the number whilst I was on the phone to my scammer and it came up as a number for my bank, they were obviously doing that thing were they spoof the number.

If it makes you feel better, my MIL had a similar phone call and very nearly gave the code (after handing over a lot of personal details) to access her banking, and she worked for a bank at the time, in quite a senior position, overseeing a bloody fraud team! She said it just sounded so convincing. It honestly can happen to anybody, please don’t beat yourself up. I’m glad you’ll get the money back from the bank 😊

some accounts I have the long card number saved, but not the expiry date or security number.

When I've reset my password (not Klarna, generally) I've sometimes had to enter a code. It'll say on screen when I've pressed the link, "we've sent a passcode to your email@hotmail.com or my mobile number, depending on what details I've registered with that website.

The email you received would have been the reset password email. It would have said that. The email would have told you exactly what it was, and would have said not to give it to anyone else and to ignore it if you didn’t request it.

I don’t understand how this happens… some scams really we every intricate and well done. But this is someone calling you, and then attempting to change your password and asking you for the email code to do so.

I think what happened (that I can understand) is they somehow got into my Klarna account using my email and password. Then to make a purchase you need the verification code that’s sent to your phone. So they called me using the number registered to that account and managed to pay for the goods - they set up four separate ‘pay in 3’ payments. And then always take the first payment from your card on the first day - so that’s what they did.

I don't use Klarna, but it seems you can remove linked cards at any time.

I don't answer unknown calls either, one can look them up under ''Who called me'' - and 99% of the time they are scams.

https://who-called.co.uk

sorry that happened to you but at least it’s being sorted. For the next few weeks/months be quite cautious with emails/calls as once you’ve been successfully targeted once it generally increases the attempts that will be made against you.
make sure to update all your passwords and don’t reuse passwords across accounts.

I've heard they sell on numbers on the dark web of people who are vulnerable to scams.

However, even a PHD university lecturer got scammed into giving his password - I only knew about it when I received a message supposedly from him saying he'd been mugged in Italy and had had everything stolen, and could I transfer him a ''Soft loan'' of £800 so he could get home.

I'd seen him the day before, and not one mention of going to Italy.

It was a scam to do with Facebook passwords years ago- I told him immediately, and he said 'Damn, I thought it was strange that Facebook wanted me to verify a password'' {10 yrs ago now...No one really uses FB any more like they once did}

Thank you for posting about it OP. It's brave to be honest and there's a chance someone reading this will avoid the same situation.

How could they set up four different payments to four different companies under one transaction? And only need one payment code?

Are you sure it wasn’t the reset password code so they could log onto Klarna and change all your details and use your account?

They totally play on panicking people into doing something immediately

We all need to step back and calm down.
Tell them 'Thank you for informing me I will check my accounts and get back to you'. Then check individual accounts and call whoever necessary with trusted numbers (not ones given to us by phone/e-mail/text)

I'm subscribed to several scambaiters on YouTube - Scammer Payback, Scammer Revolts, Deeveeaar to name a few - and the levels these scumbags will stoop down to is disgusting but it's very satisfying when they get outed.

It's worth people watching them to get an idea of how manipulative and sophisticated they can be.

And if someone calls you "from Natwest" and says you need to move all your money in your account to a new account so keep it safe, hang up and call Natwest from another phone to make sure it was them. It won't be, it's a well known extra scam to call people up who've been scammed pretending to be their bank trying to help fix things.

Poor you OP. At least it's being sorted and you'll be hyper vigilant going forward.

The scammers are so smooth with their patter it's so easy not to be suspicious if what's they're saying sounds plausible. Earlier this week I had a call from "O2" who said they needed to send me a new SIM for my phone as my package had transferred from Virgin to 02 (that last bit was true so i said oh OK). However he then said he needed to send me email instructions about the transfer and asked me to "confirm" my email address. I thought this is odd, they will have those details on my account. He said he did but I needed to "confirm for security purposes". I thought just in time ... no, you called me, you didn't even address me by name, you could be anyone and I terminated the call. I expect they would have asked me to confirm other key info as well had I continued.

I then phoned the real 02 who confirmed it was indeed a scam which a lot of people had fallen for. They made a note of the dodgy number to add to their long list.

My husband fell for one of those scams about a year ago (which is probably why I was more on my guard). He was called by "Virgin" who told him there was fraudulent activity on his account (oh the irony) but they would help him reset his secure password and asked him to confirm home address, email address etc. He felt wary afterwards and phoned Virgin's actual fraud team who told him to keep an eye on his account. The very next day a brand new iPhone was delivered. Actual Virgin said they would send a prepaid tracked delivery box to return it. Whilst waiting for this to arrive a "courier" turned up claiming to be instructed by Virgin to collect the phone. Husband sensibly lied and said it had already been returned direct. Courier not pleased but didn't return!

Virgin also told him that sometimes the scammer will send someone to hover outside your house when the phone is due to be delivered and then stroll up the drive with keys in hand as if he lives there and conveniently bump into the delivery guy and collect the new phone before he rings the bell. The gall is unbelievable!

Also, if it's someone with an Indian accent just put the phone down, particularly if they claim to be called "Stephen Wilson" or some other Anglicised name. As bad as that sounds the vast majority of telephone and online scams originate in India.