Sylvia Wilson* is crying. The grandmother is recalling the moment earlier this year when she realised scammers had stolen her life savings: more than £300,000. “I went to the estate agents to pick up the keys for my new flat. And it turned out they didn’t know anything about it.”
Instead of paying for her new home, Wilson had been tricked into transferring her money into the wrong account. Her emails had been hacked and messages to and from her solicitor and estate agent had been intercepted and replaced by fake ones telling her that the date of exchange had been brought forward. The emails asked her to transfer the purchase price of the property to a Lloyds bank account in what appeared to be her solicitor’s name – and she did. It was only at the estate agents’ office that it became clear something was wrong.
“I called my solicitor and that moment, when he told me the firm didn’t have a Lloyds account, I felt … just total shock and …” she stops, in tears. “That was my plan for my future. It is all the money I had. I try to be optimistic, to tell myself that no one has died, that it’s only money … that I’m lucky because I can live with my daughter … you try to put a rosy gloss on it, to tell yourself it’s not a big deal, it could be worse. But it is … pretty hellish.” Her voice trembles and she can barely continue. “I was devastated.”
Fraud in the UK payments industry has soared and Guardian Money has featured a number of cases where people have had large sums stolen via sophisticated bank transfer scams such as this – but in terms of the amount lost, this is the worst example we have come across.
When we first spoke to Wilson, she had managed to get back less than £35,000. It was only when we got involved and showed the banks the missed opportunities to stop the fraud that they compensated her.
This type of scam is known as authorised push payment (APP) fraud and includes cases where email accounts – either those of individuals or companies – are hacked in order to trick people into sending money to bank accounts operated by criminals.
Cases involving payments to solicitors are particularly notorious and bank employees trained in fraud prevention had opportunities to warn Wilson about them. However, when she used her current accounts at the Co-operative Bank and HSBC to make the payments, neither bank prevented her from doing so.
The Lloyds bank account she was paying into was not, in fact, held in her solicitor’s name. But none of the banks involved warned her that the name on the account did not match because a new scheme called confirmation of payee – where name checks are carried out before a transfer – had been delayed. It was originally scheduled to be in place in mid-2019 but actually only came into force on 30 June this year – too late to help Wilson and many others.
That day in the estate agents’ office, Wilson – who helped to rehouse homeless people until she had a heart attack and partially retired – was looking forward to starting a new life. She had sold her former home a few months earlier, and was downsizing to a small flat in London to fulfil her dream of living near her grandchildren. Instead, she was made homeless.
The case shows how banks have been failing to honour a promise they made to consumers last year.
In May 2019 all the big high street banks signed up to a voluntary code requiring them to reimburse customers hit by APP scams. Only those who were “grossly negligent” or ignored their bank’s warnings would lose their money, consumers were promised.
Yet when Wilson requested reimbursement, the Co-op Bank refused and HSBC gave her a paltry £3,333. Lloyds returned £30,083 to her HSBC account but then told her this had been done “in error” because of “incorrect handling” of her case. She was, however, allowed to keep the money.
The code requires that banks provide their customers with “risk-based” and “effective” warnings to make sure they understand what steps they can take to alleviate the risk and the possible consequences of going ahead regardless.
In phone calls heard by the Guardian, the Co-op Bank and HSBC questioned Wilson about the payments she was trying to make and discovered they were intended for her solicitor and that she had been sent its bank account details by email. Both banks then failed to warn her that emails providing fake bank details from solicitors are a common scam.
They did ask her whether she had confirmed the bank details with her solicitor verbally but did not explain why they needed to know this or stress how much money was at stake if she answered incorrectly. Confused, Wilson mistakenly answered yes – but in such a vague and unconvincing way that both banks found it necessary to repeat the question.
At no point during the calls did the banks suggest Wilson should take any further action to protect herself before the payment was put through, such as calling her solicitor that day, on a known number, to confirm the details were accurate. Instead of providing her with an effective, scam-specific warning about bank transfers to solicitors, the banks reassured Wilson at the end of the call and released the payments to the scammers.
Wilson feels let down by the banks. “They didn’t follow the spirit of the code at all. It felt like they were just ticking boxes.” But at the same time, she says: “I get waves of feeling it’s my own fault.”
When Guardian Money became involved, the banks continued to refuse to return any of Wilson’s money, although Lloyds did eventually return a further £4,430 from the account the scammer was using. Guardian Money asked HSBC and the Co-op Bank numerous times whether a scam-specific warning about solicitor email interception fraud should have been given to Wilson. Both banks repeatedly failed to give an adequate response to this question but began re-evaluating Wilson’s case behind closed doors.
Eventually, several weeks after we took on Wilson’s cause, she was told by HSBC that the remaining money she had paid the scammers from that account – almost £220,000 – would be returned to her.
The next day, after Guardian Money highlighted HSBC’s decision and pointed out how the Financial Ombudsman had treated similar cases, the Co-op Bank returned the £50,000 that Wilson had sent the scammers from her account.
In total, Wilson has received more than £300,000: every penny she had lost and one of the largest refunds Guardian Money has ever managed to achieve for a reader.
The Co-op Bank said: “Although we had carried out a number of checks including three separate conversations with Ms Wilson to understand why she was making the payment, our view is that during those conversations we could have been more specific about the importance of verifying the payment details of the solicitor verbally, as there is a risk that emails can be compromised.
“If we had been more direct about this, this may have prompted Ms Wilson to verify the details, which might have led to a different outcome in this case. We apologise for any distress that Ms Wilson may have experienced during this time. As a result of this case, we have now reviewed and increased training for colleagues, specifically on the prevention of solicitor email scams.”
HSBC said: “Following a thorough review of Ms Wilson’s case, as a gesture of goodwill we have provided a full refund to her. While we had conversations with Ms Wilson both on the phone and in branch when making the final payment where she said she had verbally confirmed the bank account details with the solicitor, there were opportunities on both occasions for us to ask additional questions or be specific about interception fraud, which may have led to Ms Wilson taking a different course of action and not making those payments.”
Lloyds told us the account that received her money “was opened legitimately and passed our robust identity and verification checks”. It said as soon as it was notified of the fraud it froze the account.
Wilson could not thank Guardian Money enough for taking on her case. “I’ve spent the last few months in limbo, feeling hopeless. Now I can plan for my future in my own home, rather than being dependent on my relatives for the rest of my life. You have given me hope.”
* Not her real name