I was recently a victim of cyber crime. I am a retiree with a large pension pot amassed from personal investments, and a financially savvy person. I am very aware of phishing and telephone fraud schemes and can usually spot them.
However on this occasion I didn’t spot the scam until it was too late. My son is studying in the USA and I am supporting him financially, so he will often ask for a little extra help. We communicate exclusively by WhatsApp.
I recently received a WhatsApp from him saying that he had lost his phone and that he was borrowing a phone from a friend. He said that he was in trouble because he needed to repay a loan and his banking app was on his lost phone.
After many back and forth WhatsApp messages he assured me he would explain everything when he gets his new phone. The ‘borrowed’ phone was a UK number so I didn’t call it as I knew roaming charges could add up.
Action Fraud recently reported that family WhatsApp scams cost victims across the whole banking sector more than £1.5 million between February and June this year.
My son will often use my credit card for purchases with my permission, so on this occasion when he asked for the one-time password I gave it to him. About four hours later my son sent me a WhatsApp from his usual US number and it became apparent that I had been talking to someone who was impersonating him.
This is a very clever scheme because it was a Sunday and as the bank offices were closed it took some time to contact their fraud line. I locked my card online so no further payments were taken. It was also clever because most parents will drop their guard due to a desire to help if their offspring are in trouble.
If it had been anyone else I would have questioned the request. I am hoping that the bank will reimburse me after the case is investigated by their fraud department but I am not confident that I will get the money back because I authorised the transaction believing it to be genuine.
I have read of cases where victims give passwords or security details to a third party and I think, how could they be so stupid. This case shows that anybody can fall victim to these criminals.
If you would like to publish this as a warning to others I would have no objection. I am very embarrassed about it so perhaps it would be advisable to not use my real name. Via email.
Ed Magnus of This is Money replies: This is not the first time we have been contacted by a reader about this dreaded ‘Mum and Dad’ scam.
It is a particularly nasty trick in which fraudsters pose as the victim’s son or daughter, asking for money urgently, typically via WhatsApp.
Our reader joins an ever growing number of victims that have already been deceived by these manipulative fraudsters.
WhatsApp is becoming a hotbed for scammers, according to recent analysis by Lloyds Bank.
Last year it reported that the number of WhatsApp scams had surged more than 20-fold compared to 2020.
On the rise: The number of scams starting on WhatsApp has doubled so far this year, according to the bank, with victims losing £1,610 on average
However, this worrying trend has shown little sign of easing, with twice the number of cases being reported each month so far this year compared to 2021, with victims losing £1,610 on average.
Lloyds noted a shift in how scammers are predominately operating, turning away from impersonating organisations in favour of more emotional connections such as family members.
Action Fraud recently reported that family WhatsApp scams cost victims more than £1.5million between February and June this year.
When we contacted our reader he said he had transferred £950 to the scammers posing as his son, all in one payment.
Although he concedes the amount his son requested should have been a red flag, he said it was not unusual for him to help his son out from time to time.
Loved ones: Lloyds Bank has found that fraudsters are turning away from impersonating organisations in favour of more emotional connections such as family members
He said: ‘My son is having a bit of a bad time out in the US and he’s struggling with the university work.
‘He has asked me for a little extra cash before so I’m quite used to it. But I was a bit shocked with the amount this time. I asked him: “What’s this all about? We need to talk as soon as you can.”’
After a bit of back and forth over WhatsApp the scammer then asked for our reader’s card details.
‘He just said, “Hey Dad, can you remind me of your credit card details?'”
‘I said, “You have them,” to which he replied, “Yes, but they’re on my phone and my phone is broken”. So stupidly I then just sent him a photo of the card.’
When we spoke to our reader he was waiting to hear from his bank, Starling, to find out whether his money would be reimbursed.
However, more than the financial loss, he wanted to stress the mental toll the whole experience had taken on him.
‘Another aspect of the incident is the fact that it has knocked my confidence and trust in people,’ he added.
‘I know it’s wrong but I question everything now. Even in relationships. Every text I receive, whether from someone I know or from the bank, I questioning whether they are they genuine or just out to scam me.’
Was our reader reimbursed?
Unfortunately for our reader, Starling Bank decided it would not reimburse him for the scam, citing the following reasons.
First, the bank said it had no valid chargeback rights to reclaim the funds through Mastercard, as the £950 payment was successful.
Second, it felt there was a lack of due diligence to check the legitimacy of the individual and little consideration for the risk involved.
Finally, Starling said that the transaction was arranged by the individual and then authenticated via their device and app. A warning message was provided but not acknowledged.
A spokesperson for Starling Bank told This is Money: ‘We are really sorry that he and his son had such a bad experience.
‘These scams rely on parents’ willingness to do anything for a child in need, and their belief despite signs to the contrary, that it really is a loved one contacting them.
‘In this case, the customer authorised the payment without checking that the request, which came from an unknown phone number, was actually from their son.
‘Starling prompted the customer with an in-app message, asking them to be sure that the card purchase they were authenticating in the app was legitimate and that they trusted the recipient. The customer acknowledged this warning before continuing.
‘Starling’s customer service and fraud investigation team are available 24/7. In this case, it would not have made a difference that the investigation was made the following morning as the funds were successfully processed via Mastercard to the recipient.
‘We published a blog on precisely this type of scam in August of this year and shared it with our customers on social media, as part of a wider range of security content for our customers.’
The scammer returns
Much to our reader’s disbelief, they were contacted again by the scammer barely a week later.
This time our reader decided to string them along so that he could share with others just how convincing they were.
The scammer will likely have been hoping that our reader would not have yet discovered they had been scammed.
After all, with his son studying in the US it would be a possibility that the son had not yet contacted the father.
The scammer begin with a charm offensive, using emojis to lighten the mood, whilst explaining they had lost their phone and that they were using their friend’s.
Before requesting money, they even ask: ‘What are you doing today any plans?’
They sometimes take time to respond to messages and don’t go straight to requesting money, attempting to lull their victim into fully believing he is messaging his son.
The scammer says they have something to get off their mind, but when pressed for what this is exactly, they say they don’t want to stress their ‘Dad’ so they’ll ask later.
The dad demands that they ask now. So the scammer explains that they need money to pay for the new phone and to ‘pay off various stuff.’ They ask for £2,224.
Fortunately, their victim wasn’t about to fall for the same scam. But the WhatsApp conversation proves just how convincing some scammers can be.
How the WhatsApp scam typically works?
Although it may seem like a very personal and targeted scam, typically fraudsters will send the same initial message to lots of different phone numbers at the same time, in the hope that they get a few replies.
Once someone has responded, they will use the pretence of being a family member, usually a son or daughter, who has lost their phone and got a replacement.
This gives them an excuse for having a different phone number, and means they don’t need to know someone’s name, just ‘Mum’ or ‘Dad’ can be enough.
The story they tell can vary, but most often they will claim that because it is a new phone, they don’t have access to their internet or mobile banking account, and therefore they need urgent help to pay a bill.
Victims will then be tricked into sending money by bank transfer to an account controlled by the fraudster.
It’s worth noting that this type of scam is not limited to WhatsApp, it can also happen via other social media channels and text message.
Liz Ziegler, fraud prevention director at Lloyds Bank, said: ‘Fraudsters will stop at nothing to deceive victims and steal their hard-earned cash.
‘The emergence of the WhatsApp scam over the last year shows just how quickly these ruthless organised crime gangs will adapt their tactics if they think they can make more money doing something different.
‘It’s important that people are aware of the warning signs and how to stay safe. Never trust a message from an unknown number – even if someone tells you they’ve lost their phone, call the original number you have stored to check.’
How can people stay safe?
Providing tips for how to respond when confronted with a potential scam can sometimes seem rather rudimental.
However, scams that target the right person at the right time, providing the perfect narrative, can fool even the most savvy of individuals.
After all, sometimes our emotions blind us from our common sense.
That said, if there are any lessons to take away from our reader’s story, they are as follows.
First, be wary of any messages you receive from numbers which aren’t already stored in your contacts, even if it appears to be from someone you know.
Second, don’t be rushed into anything – first of all contact the person on the number you already have stored in your contacts to check if the story is true.
Third, if you can’t get hold of them, you can verify the identity of the person sending the message by insisting you speak to them before transferring any money.
And finally, remember if it is a genuine family member or friend, they won’t mind you taking these steps to stay safe.
A spokesperson from Starling Bank added: ‘To avoid scams like this, we advise people to set up a “safe” word with their loved ones that only a family member would know, so that in the event a scammer targets them, they can ask for it to determine whether they really are who they say they are.
‘Or they could simply ask a question, such as “What did we have for dinner last time we ate together?”‘
‘People can also call the number to ensure it really is their relative at the end of the unknown number, as well as their actual number to see if their phone really has been lost.
‘If they’re not able to speak, it’s a good idea to reflect on why that is, and try to assess whether their messaging mannerisms seem legitimate.’
