Authorised Push Payment fraud
Authorised Push Payment fraud - convincing you to authorise a bank transfer to scammers. It's a form of social engineering and can be devastating to the victim.
According to Monzo,
Over 35,000 people lost a total of £145 million to it in the first half of 2018.
One of the failings of the UK banking, specifically in bank transfers, is that the originating bank does not validate the beneficiary, which allows this type of fraud to proliferate.
The recce - Into your mind, circle of friends and associates
Criminals gain access to an individual’s or company’s email account, sometimes by phishing or via malware. The criminal will read the emails and take time to learn the business. Another technique is to cold-call, but with enough details to sound convincing.
Many adopt the style and security checks of the institution they're emulating.
Stalking the prey
With this information they’ll wait for an opportune moment, such as in the case of an solicitor’s (lawyer) office dealing with property conveyancing (sale of property), on the day of exchange where monies are transferred for deposits or at completion where legal fees, disbursements and the final amount is transferred.
Other times, the scammer may refer to genuine news articles, that your account is compromised and your money needs to be transferred to a "safe account", to keep it safe.
Claws out - the pounce
The imposter will send the buyer (s) an email with the solicitor’s bank details and there-by diverting the funds to the fraudster’s account. This will typically happen late on a Friday evening, using the weekend as cover so that the buyer will find it difficult to speak to someone in the office of the estate agent (realtor) or solicitor to speak to.
Very often the scammer will convince you to use security devices or codes sent to mobile devices.
The damage
In the worse case, the victim has lost their money and their house. Best case, the scam is spotted and time is lost, perhaps with a financial penalty for not completing. Even the most aware and diligent person may be susceptible to this type of fraud, as it is the type of transaction that they’re expecting and waiting for.
With this information, your account can be emptied in seconds.
Latest developments
The Financial Conduct Authority (FCA) has, as of 31 January 2019, brought into force new rules so that customers who have fallen victim to authorised push payment fraud can now seek redress from the firm which received the funds, as well as from their own firm through which the funds were sent. Payment service providers are now required to handle complaints about alleged authorised push payment fraud.
Confirmation of Payee
To attempt to control this problem the Payment Systems Regulator introduced Confirmation of Payee (CoP), this will allow customers sending payments to check that the name on the beneficiary account matches that of their intended recipient.
Originally the banks had to implement this by July 2019, but this has been delayed to March 2020 where industry groups cited the original deadline as "unachievable" following consultations. A significant weakness in proposed implementation of CoP is that only the larger institutions are compelled to implement this. Although this should cover 90% of transactions within the UK.
Payment Systems Regulators report on APP
A great example of social engineering and how convincing scammers can be (thanks RS for showing me this one).
How the CIA Director's email got compromised
What to do if you think you’ve been scammed
First of all keep calm. If you have used bank transfer, contact your bank and explain the situation to them, obviously you will need to be sure that the person you speak to is genuine.
Report the incident to https://www.actionfraud.police.uk/if you’re based in the UK.
What else can you do?
Way back in 1597, Francis Bacon said
"Knowledge is power"
So be informed, tell your family, friends and neighbours.
I publish a weblog, so do take a look if this sort of thing is of interest.
Personal commentary. Views are the author’s own.