A Metro Bank customer lost £26,000 after a fraudster took advantage of compromised card details to scam him twice in what the bank described as a sophisticated social engineering scam.
The man from Bedford, who did not wish to be named, said he was left checking his online banking ‘every five minutes’ after fraudsters accessed his account and stole thousands of pounds.
To make matters worse, the new payees set up to move money out of the account by the scammers remained there for an entire week after the scam until the bank deleted them, while he said Metro Bank initially told him to sit tight and wait for a call from their fraud team.
A Metro Bank customer lost £26,000 after compromised card details were used to scam him twice
He said this gave him serious concern and anxiety, as he believed his account was still compromised.
After being contacted by This is Money, Metro Bank refunded both an initial £6,048 fraudulent card purchase used to set up the scam, and the £20,000 stolen from his account, and apologised for the way they initially handled his case.
The Metro Bank customer, who works in HR, contacted This is Money four days after he fell victim to the scam in mid-July, having read about a similar case we reported on in June 2019.
He was called just before midday on the bank’s number by someone claiming to be from its ‘fraud prevention team’, who said his account was unsafe and compromised following a suspicious transaction of £6,048, made to a hamper company, which they said had appeared on his online banking.
In a bid to access his account, the fraudster took him through some common security questions, including asking him to confirm the month of his birthday, although the man said he never gave away his password.
Metro Bank requires a 12-digit customer number or username, three digits from an eight-digit security number, and a password to log into online banking.
He claims the fraudster ‘asked the right questions’ and ‘knew the bank’s systems inside out’. Coupled with the fact they knew the last seven transactions on his account, ‘I saw no reason why he wasn’t for real’, the man told This is Money.
With the £6,048 card payment pending on his account, he believes the same scammer knew his details already and used the suspicious payment to rope him into a ‘scam on a scam’.
‘They called me to alert me on suspicious activity on my card and used that event to extract more money’, he said, ‘I was convinced that my account was significantly compromised’.
Having provided enough account details to pass through security, the fraudster set up new payees on the customer’s account while they were on the phone to him, validating them using text message codes sent to his phone.
Metro Bank requires these text message codes and characters from a customer’s 16-digit card number to be entered when setting up a new payee, further indicating the customer’s details were compromised.
Some £20,000 was subsequently transferred from his business account to the Metro Bank account of a ‘Cristian Stefan’, while two other payees, ‘Manoj Maddipati’ and ‘S B Nanneti’, were also set up.
At this point, while still on the phone to the fraudster, our reader asked his daughter to call Metro Bank customer services, having seen the new payees now set up on his online banking and realising he had been caught in a scam, asking them to freeze all his outgoing payments.
He then rushed to his local branch in Milton Keynes, where he was told by the manager ‘not to do anything or cancel anything’ until the fraud and prevention team contacted him.
When he first contacted This is Money five days after the fraud occurred, the bank had not yet done so, despite his account being compromised by a fraudster who was able to steal thousands of pounds from it.
The man from Bedford believed his account was significantly compromised when he was tricked by the scammer
On top of that, he found he was unable to delete the fraudulent payees set up on his online banking, which remained on his account for a whole week after the scam until Metro Bank deleted them.
He told This is Money the continued presence of the fraudulently set up payees, one of which had received £20,000 of his money, was giving him ‘serious concern and anxiety’, and that he was checking his online banking ‘every five minutes’ as a result.
And when he tried pushing the issue with Metro Bank himself rather than waiting to be contacted by the fraud team, he was told there were ‘no notes’ on his account, and that they didn’t know what had happened.
After This is Money contacted Metro Bank with details of his case, he was refunded the £20,000 lost in the transfer scam at the end of July.
He was refunded the fraudulent card purchase a few days later, although still knows little about the transaction, beyond the fact it went to a hamper seller.
Metro Bank said in a statement: ‘We understand and appreciate the stress caused by becoming a victim of fraud and are very sorry to hear about this case.
‘Further to our investigation, we’ve offered a full refund to the customer and also apologised that our initial interaction with the customer was not up to the usual standard that we pride ourselves on providing.
‘We take our customers’ security extremely seriously and we have a range of safeguards in place to help defend them against fraud, which we constantly review and update in light of increasingly sophisticated tactics from fraudsters.
‘We also continue to work closely with other stakeholders including banks, network operators and law enforcement agencies to protect customers from these crimes.’
The victim subsequently told This is Money he would be looking to move away from the bank after the scam.
Some links in this article may be affiliate links. If you click on them we may earn a small commission. That helps us fund This Is Money, and keep it free to use. We do not write articles to promote products. We do not allow any commercial relationship to affect our editorial independence.