News

I lost £100k to ‘safe account’ scam… Tide admitted failings but will only pay me back half


Jamie* is used to dealing with huge sums of money in his day job running his own business. 

So when he received a call saying his business accounts had been compromised, he moved quickly to ensure his funds were safe.

Instead he lost £100,000 to criminals in a ‘safe account scam’, where fraudsters steal a person’s money by getting them to move it to another bank account that they control.

Jamie* thought he was speaking to a member of Tide's anti-fraud team but lost £100,000

Jamie* thought he was speaking to a member of Tide’s anti-fraud team but lost £100,000

These scams are highly sophisticated and can dupe unsuspecting customers in a myriad of ways, including the cloning of phone numbers.

Jamie, who has asked for his name to be changed, has been left reeling at what he feels is a lack of checks and balances made by his banking provider Tide and how it subsequently dealt with the scam.

Two weeks after the scam, Jamie now only has a portion of the money back. He tells This is Money how the scammers managed to access his cash through this sophisticated fraud and how he feels that Tide left him in the lurch.

The ‘safe account’ scam

At the end of January, Jamie received a call from someone claiming to be working in conjunction with a major bank saying they had identified potentially fraudulent transactions on his account.

After checking the number, he found it to be the genuine Financial Services Compensation Scheme (FSCS) number and continued the conversation.

Believing it to be a legitimate call, Jamie told the scammers he held accounts with five other banks at which point the caller said he would liaise with his counterparts in anti-fraud.

‘I was thinking they must be working together, I found that strangely reassuring,’ he told This is Money.

Scammers clone genuine numbers from institutions to lend an air of legitimacy to their cold calls, which means that even if you take all the necessary precautions you could be duped.

What Jamie didn’t know at the time was that the FSCS does not cold-call customers and banks very rarely act in lockstep when there have been instances of fraud across a number of accounts.

A few minutes later Jamie received text messages from each of his banks with an FSCS reference number below previously legitimate messages from the institutions in question.

From there, the caller told Jamie that because he had numerous accounts with Tide it would make the most sense for it to handle the case and he would soon receive a call from a withheld number as Tide don’t have a direct facing customer service number.

Indeed, Tide – which offers business accounts – is not officially a bank, as it doesn’t have a banking licence with the Financial Conduct Authority, which we explain in more detail below.

Jamie was passed onto another scammer called Theodore who introduced himself as one of Tide’s anti-fraud team who said he would send through a message on the app.

Jamie later realised it was something called a flash message, which is a notification that mimics a normal message and makes it seem as if you’re receiving a message from your bank when it’s in fact from the scammer. 

Crucially the notifications don’t stay in your notifications so they can’t be traced.

A spokesman for the FSCS said: ‘Sadly, it’s all too easy for scammers to use the details of legitimate organisations like FSCS to try and appear genuine to their victims. If we hear that our number is being used fraudulently, we report it to our telecoms provider and Action Fraud immediately.

‘FSCS is a free service, so we would never ask for any money or call someone who hasn’t recently made a claim with us. If you’re ever unsure that contact from FSCS is genuine, we’d encourage you to contact us directly using the information on our website at www.fscs.org.uk.’

I lost £100,000 in a matter of hours

Theodore told Jamie that his Tide account had been compromised and he would need to set up a new account with almost identical names to transfer money into.

He also gave Jamie a URL to type into Google which took him to a webpage that he says was indistinguishable to Tide’s. There, he was directed to type in a code provided by the fraudster and the accounts that had been ‘set up’ appeared.

 The level of sophistication and social engineering behind this has truly scared me

Jamie flagged that the sort codes were different to usual but was told Tide operates on a number of different platforms, which he later found out to be untrue.

At this point the scammer already had a number of Jamie’s details including his mother’s maiden name, previous and current address and recent transactions. All of this meant that Jamie felt confident he was speaking with someone from the anti-fraud team and proceeded.

‘He told me we’d transfer the money over in small increments because if you do it one go, if it gets lost in the account migration process, it can be difficult to trace.’

Jamie transferred £500 at a time and as it was leaving his genuine Tide account, he could see the balance on the spoof website more or less being updated in real time.

Over the course of a few hours, Jamie transferred £106,000 from three of his Tide accounts.

‘During the process the guy couldn’t have been more relaxed. Obviously I’m stressing out but not because he’s making me feel uncomfortable. I just want to transfer and get out because of the elaborate back story.’

‘Every stage without any hesitation, the scammer knew the answer he knew page-by-page what the Tide interface looked like. He knew the inner workings of it and I didn’t register that it could be someone not from Tide.

‘I negotiate with people all day, I can usually smell when something’s off. The level of sophistication and social engineering behind this has truly scared me.’

He also said he felt secure as there was ‘no plausible reason’ any bank with security would allow £500 transactions to a new payee if not being orchestrated by the anti-fraud team.

He says that at no point were there any messages or warnings to indicate that there was fraudulent activity on his account, despite there being hundreds of transactions.

Tide told This is Money it had provided five warnings to Jamie about recipient names not matching the bank details, but he strenuously denies this. Read below for their full response.

Left in the lurch

The next day Jamie realised what had happened and after reporting it to Tide, he said there was ‘no urgency’ from Tide.

At one point, he told Tide that the scammer was planning on calling again and if there was anything he could say or do to help the situation or track the scammer.

At another Jamie had the scammer on loudspeaker while calling Tide on a different phone. He says no assistance was forthcoming.

Nearly two days after the scam, Jamie discovered a report into the scam had only been filed some 40 hours after the scam, giving the criminals a head start and little chance of the funds being tracked.

Jamie* made payments of £500 over a few hours thinking he was moving his money into a safe account

Jamie* made payments of £500 over a few hours thinking he was moving his money into a safe account 

After the scammers drained his Tide account, Jamie still had staff to pay but thankfully he had cash in his savings with another bank to pay his staff, contractors and his mortgage.

‘Thankfully there was money in the background the scammers couldn’t get it. If that wasn’t the case, I would have had 13 people that wouldn’t have been paid. The dominoes would have started falling and feasibly I could have lost everything.’

Ten days on from the scam and Jamie still hadn’t been told anything pertinent – instead told via the app that Tide would aim to resolve it in 35 days.

‘For a week I was screaming into the abyss. It’s your worst nightmare, losing that much money.’

By contrast his local police force had already advised Jamie that one of the accounts had already been traced, while Tide said there was no update.

Almost two weeks after the scam, Jamie was contacted by the complaints resolution manager who said Tide’s response ‘is not going to hinge on deflecting the failings of our own systems, which are self-evident given what’s happened. It’s plain that Tide should have stepped in to do more to protect your funds.’

Tide admits failings but offers half the cash back

Two weeks after scammers took over £100,000 of Jamie’s money, he finally received a response from Tide’s complaints team.

Tide admitted that there had been ‘missed opportunities’ to prevent the incident and that the activity on Jamie’s account that day appear ‘out of character’.

It added: ‘Tide should have identified such a significant volume of transactions to new payees as a pattern indicative of fraud.’

 Under the circumstances, the checks and balances in the system weren’t appropriate. Everything has been so comprehensively spoofed

The team upheld his complaint but with the crucial caveat that there were opportunities for Jamie to have noticed something was amiss.

Jamie therefore received just half of the funds he lost to the scammers, meaning he is £50,000 out of pocket.

Most leading high-street banks are signatories of the Contingent Reimbursment Model (CRM) code, which puts measures in place to detect and prevent authorised push payment (APP) scams.

They also have a duty to reimburse customers who have fallen victim to an APP scam through no fault of their own.

However Tide isn’t a signatory and isn’t a registered bank, rather referring to itself as a ‘business financial platform’. While regulated by the Financial Conduct Authority (FCA), it offers e-money accounts, provided by PPS and business bank accounts, provided by ClearBank.

Tide insisted it was ‘reasonable to expect that our members have some awareness of ‘safe account’ scams given their prevalence, adding that there had been plenty of in-app warnings about a proliferation of scams. 

They added that while the spoofing of phone number and texts were convincing, coordination between banking providers is ‘highly unusual.’

Tide launched in 2016 and offers personal and business accounts but is not a bank

Tide launched in 2016 and offers personal and business accounts but is not a bank

‘It is simply impossible for so many banks to individually recognise that your accounts were compromised… the fraudsters did not appear to have all this information about your banking when initially calling you – and relied on the information that you readily provided them’.

Tide also told Jamie that he should have known the ‘safe accounts’ opened by the scammers were banks well outside of Tide and that their T&Cs clearly state who the providers are.

Even if Jamie was aware of this sophisticated type of scam and social engineering, crucially Tide admitted it should have done more to stop it.

As a result, Tide told Jamie that they both had opportunities to recognise the fraud and stop it and liability should be shared equally. Jamie has received £50,000 of the money back.

Jamie insists that security protocols have always been lax. High street banks have cracked down on new payees and transfers in a bid to combat scams.

Jamie says there has ‘absolutely not’ been the same treatment on Tide: ‘The irony of this is that one of the ways Tide markets to small businesses is in ease, convenience and flexibility. But there needs to be a trade off with security. The ease of transferring money is one of the appeals of Tide.’

Since the scam however Tide has stopped Jamie from transferring money out of his account to an existing payee – himself.

‘This type of fraud has the potential to wipe so many businesses off the map by being a victim of genuine crime. It seems so unfair that your reputation, credit record, ability to complete projects could be jeopardised by it.

‘Under the circumstances, the checks and balances in the system weren’t appropriate. Everything has been so comprehensively spoofed. If they can get me, they can get anybody.’

The next option for Jamie is to take his case to the Financial Ombudsman – and he has decided to do just that. 

Tide’s response in full 

This is Money contacted Tide after it upheld the complaint. We asked whether it was their company policy to take only partial responsibility if they have made people aware of the scams, and how customers can be assured their funds are safe.

A spokesman for Tide said: ‘[He] has been the victim of a scam, and we are sorry about the stress he has suffered as a result of this fraud. 

‘We continuously encourage all of our members to be vigilant and remind them that Tide nor any other financial institution would ever ask them to move their funds into another bank account.

‘We are constantly enhancing our systems to keep up with the complex and evolving tactics used by fraudsters. 

‘Our systems produced multiple warnings informing [him] that he may be the victim of a scam. 

‘[He] ignored these warnings on numerous occasions, and over several hours, and still proceeded to transfer his money from multiple accounts to the fraudsters. 

‘We always caution our members to take notice of these messages and to contact us if they have any doubts.

‘We are a member of Stop Scams UK and have a dedicated 159 fraud phone line for members to contact us if they suspect they are being targeted by scammers. This is available 24/7. 

‘We encourage all of our members to contact us as quickly as possible on this number if they suspect they have been, or are at risk of becoming, victims of fraud.

‘He is within his rights to take the issue to the Financial Ombudsman, as we have outlined in our formal response to him.’

Some links in this article may be affiliate links. If you click on them we may earn a small commission. That helps us fund This Is Money, and keep it free to use. We do not write articles to promote products. We do not allow any commercial relationship to affect our editorial independence.



Source link

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button