New Times,
New Thinking.

  1. Business
29 July 2013updated 22 Oct 2020 3:55pm

Why I willingly handed over my credit card and PIN to a fraudster

If scammers disguised themselves as your bank's fraud protection team, would you fall for it? Andy Welch did.

By Andy Welch

“Hello Mr Welch. Visa Card Services here.” That was the line with which my nightmare started one Sunday morning, hungover, sitting on the sofa trying to piece together the night before. The landline rang. I was surprised because I’d only given the number to about three people.

The person on the other end of the phone – Mark – told me there had been a number of fraudulent transactions on my bank account since midnight, adding up to about £1,100. I’d never heard of Visa Card Services before, but then I’d never had money stolen like this before. Maybe this is what happens?

He then confirmed the last genuine withdrawal I’d made – at the Barclays opposite Highbury & Islington station – gave me a reference number and told me to ring the number on the back of my bank card.

I did just that, quoted the reference number and spoke to someone who knew all about the supposed fraud. These cunning tricksters had apparently cloned my card at the ATM I’d used and then treated themselves to a few things in the Apple Store on Regent Street. Something didn’t ring true about the whole thing – why would someone with a stolen bank card only spend £400 in the Apple Store, for starters? But I watch enough bullshit consumer TV, the kind of thing presented by that estuary gargoyle Dominic Littlewood, to know that these things happen.

The person now helping me, Rajesh Khan in HSBC’s card protection department, had all my details; full name, date of birth and, crucially, my address. That was the clincher for me, and when he said a courier was on the way to collect my bank card for further examination, I didn’t need to tell him where I lived. I initially flinched at the idea, but when he explained it was needed to properly analyse the chip, it seemed to make sense. After all, I’d called the bank myself, this was no cold call, and he had all my details already. That’s probably the same reason I typed my PIN number into the keypad of my phone.

Select and enter your email address Your weekly guide to the best writing on ideas, politics, books and culture every Saturday. The best way to sign up for The Saturday Read is via saturdayread.substack.com The New Statesman's quick and essential guide to the news and politics of the day. The best way to sign up for Morning Call is via morningcall.substack.com
Visit our privacy Policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications.
THANK YOU

“It’s OK, Mr Welch, we can’t see it, but we need to perform a PIN block.” “I’ve never heard of that,” I said, “but fair enough.” I packaged the card up as requested – wrapped up snugly in kitchen roll, packed into an envelope so it didn’t look like a bank card – and waited for the courier to arrive. Rajesh called back twice, once to say the car was five minutes away, and again to say it was outside, quoting the car’s number plate and describing the driver.

My mate Rajesh called again later that afternoon to say they’d received the card and that I’d have my money back in a few days. “Great,” I thought. I recall saying to one of my housemates how difficult it was to like banks, what with them ruining the world and everything, but you couldn’t argue with efficiency like this. So sucked in to the efficiency, I went through exactly the same process the following day with my credit card. The same fraudsters had somehow hacked into my online account, got my credit card details and maxed it out. Good old Rajesh told me this time there was a shred of hope the criminals would be arrested as they’d made the mistake of buying Eurostar tickets to Paris on a specific train. The police would be waiting for them at St Pancras. Amazing news!

A few days went by and Rajesh stopped calling. Worried – by this point I was, to my estimations, about £4,000 out of pocket – I called the bank, this time from my mobile. After explaining the situation to two or three people, my nightmare stepped up a notch with the most chilling phrase of all. “But Mr Welch, your cards haven’t been reported stolen.”

I’ve never been speechless before. I’ve never been able to feel the colour drain from my face either, but I was and I could. It ran from me like water down an open drain, replaced by all-consuming feelings of stupidity, anger and fear. Quite the cocktail. Realisations kept hitting me as I relayed the conversations, over and over and over. Why had I given my card to a stranger? Why had I typed my PIN into the phone? How did they know my mother’s maiden name? How did they have my address? And, most of all, why in the name of all things holy hadn’t I checked my balance to see for myself what the damage was before I even called the bank that Sunday morning?

Well, to answer the last question first, I suppose I didn’t want to see what was happening. When I did check, things were far worse than I’d expected, and my rent had bounced to cap it all off nicely. The Apple Store story was all a lie – they’d in fact spent thousands in clothes shops, some really shitty clothes shops, and best of all, treated themselves to a Dixie Fried Chicken each evening. Forget the fraud – what kind of savage spends £95 over three days in a Kentish Town takeaway?

The rest of it comes down to good faith. Once you call the number on the back of a bank card and go through security stages, you enter into a world of trust, where you’re no longer the boss and the person on the other end takes over. “My National Insurance number? Sure, stranger I’ve never spoken to before, here you go…” By now, I was really panicking. Most of the money, I must add, was credit or overdraft. What if I didn’t get a refund? That was a possibility, according to the security expert at the bank. It would take me years to pay off debt like this.

I called the police, who put me on to their dedicated fraud line. After explaining my idiocy once again – it’s pretty humbling, repeatedly telling people you’re the type of person that gives both your bank card and PIN to the first person that asks for them – they went through the likely series of events that led to this theft. By now the total was about £5,500, and even though, unofficially, the police told me the banks always refund the first-time defrauded, I was a bit of a wreck. It all started, said the police, on the Saturday night where one of this gang will have watched me take money from the cash point. That’s details of my last transaction taken care of. Sinister enough, the thought of being spied on while you’re trying to enjoy yourself at a Norton Records garage night at the Buffalo Bar, but not the worst of it. The police then believe I was followed home, which is how they got my address. It could be worse, they could’ve just stabbed me, so every cloud and all that, but followed home? Christ.

As for the call, well, credit where it’s due, it’s pretty clever. If you call a landline, it’s up to you to end the call. If the other person, the person who receives the call, puts down the receiver, it doesn’t hang up the call, meaning that when I went to find my bank card, the fraudster was still on the other end, waiting for me to pick up the phone and call ‘the bank’. As I did this, he first played a dial tone down the line, and then a ring tone, making me think it was a normal call. He will have been sitting next to the first person that called me, no doubt laughing their heads off at how stupid I’d been. Well, Mark and Rajesh, I hope you’re happy with your lives. To Hades with you.

I was right to praise the bank’s efficiency, though. They got me all my money back within 10 days, although I did have to get new bank accounts and cards. It was a pretty lean spell, and by the time I got my money back, I’d spent my last 60p on a tin of beans. My family and friends offered money, but two things; I didn’t have a bank account for them to pay money into, and with cash, well, there was a chance I had the sharp end of six grand to pay back, I didn’t need to owe out another £50 on top of that. The feeling of total financial ruin, of utter helplessness, isn’t one I’ll forget in a hurry. If I momentarily forgot what was happening, I’d remember and then start panicking all over again.

Setting up all new direct debits was an unholy pain in the arse and, five months on, problems are still arising and my credit rating has taken a serious knock, while getting the various bank departments to talk to one another and not try to charge me a few hundred quid in overdraft charges was no picnic either. I’ve since had to sign up to a number of other bank schemes and government services to add further layers of protection. I get a monthly statement of credit checks in my name, for example, so I know if these people are using the information they have on me again. It took a few weeks to stop worrying about the same people coming back to my house, too, although spending hours online researching the link between bank fraud and violent crime – virtually non-existent, it would seem – helped with that. If I’m wrong about that, I don’t want to know otherwise.

Out of everything, accepting that it had happened probably took the longest. I’m still coming to terms with it now, I think, but being a bit more suspicious isn’t a bad thing. Being paranoid, well, hopefully that’ll just wear off in time. I like to think I’m a tech savvy, culturally aware person. I read about internet security, I know about phishing and all that seemingly tedious shit we’re told about every five minutes, yet the knowledge left me when it counted and I handed over all my money like some wet-behind-the-ears yokel buying magic beans at a county fair. I’m surprised I didn’t offer to help them spend the cash as well, get the job done properly, like.

Bank fraud is a bigger problem than I had ever realised. Experts suggest one in four of us will be directly affected by bank fraud at one point or another, while millions and millions of pounds is pumped into funding departments such as the ones that sorted out my problem and insurance it took to cover the money stolen. That’s our money, paid in extortionate overdraft arrangement fees in order to finance the whole industry.

Financial fraud is often deemed a victimless crime because, ultimately, it’s only huge companies footing the bill, not individuals. Having suffered myself, the stress, upset and countless hours spent sorting it out tell me it’s anything but.

Content from our partners
The Circular Economy: Green growth, jobs and resilience
Water security: is it a government priority?
Defend, deter, protect: the critical capabilities we rely on