Email fraud

[Torlundy]

Please can you advise me: I requested bank details of my pension fund a/c from my financial advisor in Brewin Dolphin. This was sent to me by email - this email was hacked the bank details altered and the email address slightly altered and sent on to me, I then transferred £20,000 into what I thought was my pension plan by bank transfer but this never went into my pension but into an anonymous barclays bank a/c. My Bank of Scotland maintain that this was a legitimate transfer so have washed their hands of any responsibility. Brewin Dolphin maintain that their emails are all protected and it must have been my email a/c that was hacked. My email provider says that my email a/c has not been compromised so no one will take responsibility and I am £20,000 the poorer.

[R0b]

Unfortunately there is no obligation for the bank to refund you where you have been scammed. Have you contacted Barclays bank immediately to see if they could put a hold on the account? If yes, have they come back to you with any response?

Reading between the lines, it sounds as if you have requested the bank details by email so it was you that instigated the request for those details. You should not have requested the bank details by email under any circumstances and you should have contacted them direct. Even still you should have verified the information before making the transaction as most email accounts are not encrypted and therefore liable to be intercepted which is what appears to have happened to you.

All I could suggest is that you put in a formal complaint to Bank of Scotland but unless they were negligent and didn't take steps to notify Barclays within a reasonable time or as soon as they possibly could, I don't think that you have legitimate complaint or right to a refund.

[Setmefree3]

Why would you except any bank details by email. As written above, emails can intercepted and leave you wide open to being a victim of fraud. Did you contact Brewin Dolphin to confirm the details in the email were correct before proceeding with any transactions. Have you informed action fraud? So they can trace the originator of the account.

[Amethyst]

When you spoke with Brewin after the fraud had happened, did they confirm that they had indeed received your email and had replied to you with the relevant details ? Did they send you a copy of that email ?

Do you still have the emails?

Action Fraud certainly need telling, as does the banks you transferred from and to.

I'd send a SAR to Brewin asap as well Subject Access Request Letter

[Setmefree3]

“but this never went into my pension but into an anonymous barclays bank a/c”........Anonymous Barclays account?

[Crazy council]

The scammers will more oftern than not target the company thats sending the email, and hack there servers.Dont just acsept there word for it that its wasnt them hacked.

When you give the details to action fraud they will give you some advice.

You need to check your own PC as well, just make sure no ones got acsess,

Prior to the email, have you had any phone calls asking you for details,

How was you in contact with the pension company prior to that. ?

[AnotherLevel]

“but this never went into my pension but into an anonymous barclays bank a/c”........Anonymous Barclays account?

I guess anonymous to the OP, however it will not be anonymous to Barclays. Whether the account was open with genuine documentation remains to be seen, however Barclays have many legal obligations as well as a duty of care with their KYC.

Normally in these cases, the money leaves the UK bank as soon as the transfer is received and it ultimately ends up untraceable overseas.

[Setmefree3]

I guess anonymous to the OP, however it will not be anonymous to Barclays. Whether the account was open with genuine documentation remains to be seen, however Barclays have many legal obligations as well as a duty of care with their KYC.

Normally in these cases, the money leaves the UK bank as soon as the transfer is received and it ultimately ends up untraceable overseas.

Yes, I watched a documentary where people were shipped in from abroad to open as many accounts as they could in a short time frame with the documents they were given. Insane!!! Hope the poster follows all advice on here and gets money back.

[AnotherLevel]

Yes, I watched a documentary where people were shipped in from abroad to open as many accounts as they could in a short time frame with the documents they were given. Insane!!! Hope the poster follows all advice on here and gets money back.

It's really really hard to open a physical bank account these days, unless you are a UK resident. A lot of banks just won't touch you because of the risks with fines due to money laundering etc.

There are, however, a lot of virtual banks like Transferwise/Revolut who have far less stringent rules in place to open an account and you can do everything remotely.

According to here https://www.brewin.co.uk/individuals...estments/faqs/ and Can I add money to my account at any time?, Brewin Dolphin use the bank facilities of HSBC. If the email appeared to come from Brewin Dolphin and the banking details were for Barclays, then serious questions need to be asked.

If a fraudulent transaction has taken place, then pursuing the recipient bank is a course of action as they allowed the fraud to occur - https://www.telegraph.co.uk/personal...ke-bank-court/

[Amethyst]

Most of the frauds for the ebay car scams are Barclays accounts because there were a couple branches which had an interesting attitude to identity checks on account opening. Normally, contacting Barclays gets the account shut down but sadly without an 'inside' contact this is often far too delayed by the processes they make people go through... we used to be able to get scammers accounts shut down within an hour of so of being made aware of the scam...but really relies on immediate action as the accounts are emptied pretty bloody fast after a transfer is made.

Anyway, as well as getting Barclays to track where the funds went, where they were withdrawn ( usually they are transferred to different accounts and then withdrawn at cash machines ) , … I really think the email needs more investigation - what address did you send it to? did they reply direct? where did that email get sent to? and what was the email that sent it on to you with the 'changes' ?
It seems more likely the scammers are intercepting Brewins emails rather than yours, but if you're on something like yahoo, then it could have been intercepted before it got to Brewins and the reply spoofed ( hence saying a SAR is a good idea to know if they received your email and replied )

Have you got all the email headers and tracking details, metadata, IP addresses etc? What email service/provider do you use?

[AnotherLevel]

You can put your email address in here xxxxxxxxxxxxxxxxxxx and it will tell you if there's ever been a publicly known breach of your email. If there has, it is highly recommended you changed your email password to something really secure xxxxxxxxxxxxxxxxxxxxxxxxxxxx

[Amethyst]

AnotherLevel - I'm going to take out the links as I'm not certain that's a good idea - on the first site you are putting in your email address, then following a link to 'create a password' so if those two sites work together you have just told them your email address and what your password is ??? which doesn't seem very wise at all.

I'll look further into it, but for now I've take off the links and wouldn't recommend doing that at all.

I agree you should change your password.

[AnotherLevel]

Amethyst - The HaveIBeenPwned site is a well known site set up by Troy Hunt, a leading web security expert, to help people check if their email address (and other personal data) has been compromised at some point - https://www.telegraph.co.uk/money/cr...cyber-hygiene/

One of the biggest problems, other than a website data breach, is that people often use insecure passwords such as names, places, or general words that hackers can easily guess. The LastPass page (which is an excellent browser Plugin) allows you to generate a random alphanumeric password with symbols etc. to make it much much harder for anyone to guess.

[Amethyst]

Hmmmm, think we'll have to agree to disagree. I think telling a website your email address and letting it generate you a new password ( and then using that password ) is just daft. It would be far better for it to say ' ok looks like your email p'word has been compromised - here's some tips for setting a better password - remember to change it regularly )

[Setmefree3]

AnotherLevel what are the chances of the site you are referring to ever being hacked?