Authorised push payment scams: how my father was targeted by criminals

Many people think they'd be able to spot a scam from a mile off, but I've seen first hand how easy it can be to fall victim.

Nearly 85,000 Brits fell victim to authorised push payment (APP) scams last year, losing a staggering £354.3 million in the process.

That's according to the trade body UK Finance, which warned that the amount lost to these scams had jumped 44% in the second half of 2018.

Clearly, these criminals are catching out more and more of us.

Now, you might think you'd never find yourselves among their ranks, but I've seen first-hand how terrifyingly easy it can be to fall victim after my father came close to losing £18,000.

The 16 scariest email scams (and how to spot them)

What happened?

I vividly remember the call. There I stood bucket of animal feed in one hand, toddler's palm in the other, trying to hear my dad ranting down the phone balanced on my shoulder.

"Dad I've got to go. I'm at the farm with the boys and I need to pay," I exasperated as I hung up.

All I'd managed to grasp was my dad felt he'd been a complete idiot about something, and he'd spent all day on the phone.

The slightly manic phone call should have immediately rung alarm bells with me as my dad, an intelligent and highly educated man, is hardly what I would call stupid.

In retrospect, I wish I had been able to speak to him without two kids, a busy queue and the smell of pig poo to deal with as I might have got a better handle on the situation.

It turns out my dad, an eminent professor in psychology, who has helped police track down criminals, fell afoul of a classic con job and almost lost £18,000 in the process.

No-one it seems, is too smart to be scammed.

Account hacked

Over the following weeks, I began to piece the events together through several emotional phone calls with my parents.

The scam began when fraudsters hacked into my dad's BT email account and sent emails to his contacts saying he was in Turkey and needed money.

He immediately changed his password but a week later after many calls with BT helpdesk, he realised his emails were being automatically forwarded to another address the fraudsters set up.

The forwarding was stopped but then a few days later he received a phone call on his ex-directory home number saying his IP address had been compromised.

The woman on the phone claimed to be acting on behalf of BT and took my 76-year-old dad through a series of ‘checks,’ asking him to corroborate unique numbers on his computer, which he wrongly assumed meant the caller was legitimate.

The woman then passed him onto a man who asked him to download some ‘protective’ software before logging into his bank accounts.

The whole operation took several hours, and at certain points his computer screen went blank, but the man on the phone told him not to panic as this was normal.

‘Too busy and too stressed’

My dad's desperate phone call to me whilst I was down on the farm followed a sleepless night as he realised something was amiss.

Naturally my first reaction on realising the scale of the scam was how could he have been so stupid?

But then I could imagine the scenario. There he sat in his home office, working on a book chapter or journal article or both, desperately trying to meet his latest set of deadlines.

The phone rings and a polite woman presents herself as the answer to his ongoing email problems. He is distracted with work and carries on typing away as he talks to her, only half taking in what she says.

And so it escalates from there as he is too busy, too stressed and too frustrated to pay attention to what is really happening.

Rather than stop and think, he carries on regardless, desperate to get the issue resolved.

As a result, the scammers were able to take £7,500 from his NatWest account and two lots of £3,919 from his Santander account. They also attempted to transfer £2,500 from his Lloyds account, but the bank blocked it and he was able to cancel it.

NatWest repaid all the money the next day although it took six weeks for Santander to do the same because they initially claimed my dad authorised the payment and was therefore responsible.

Push payment fraud ‘widespread’

If the same scam happened after 27 May this year, he would have been reimbursed straight away, preventing him from enduring weeks of distress.

This is due to the implementation of a new code to reimburse victims of APP scams, also known as push payments.

In the majority of cases to date, banks are refusing to return lost funds to customers as they had authorised the payment after being tricked by scammers.

Thankfully, a campaign by consumer groups and an investigation by the Payment Systems Regulator has persuaded the top banks to establish a voluntary code to ensure victims are reimbursed when neither the bank nor customer is to blame.

The biggest online scams and hacks of 2018

Why banks struggle to prevent scams

Although this is a step forward, banks’ ageing IT systems are still often unable to stop these types of scams from happening, even when the account details are not the same between the sending and receiving banks.

This means that people like my dad, who is supposedly a highly intelligent man, are still at risk of financial and psychological damage.

The sophisticated scam he was subjected to has had a personal and long-lasting effect on my family and made us all feel vulnerable. In the first six months following the fraud, my dad took all of his bank accounts offline and was constantly on high alert when he received a phone call or text.

The home phone has been replaced with a complex handset that screens calls and makes unknown callers leave a message before the call is put through.

My dad may not like to admit it, but the scam really knocked his confidence.

It was the final push to make him realise that he couldn't juggle an academic career and freelance work, prompting him to step down from employed university work.

'It can happen to anyone'

As a child growing up, I boasted about my dad, with his regular radio and television appearances as a crime expert. So it was difficult for me, his youngest child, to see him grapple with being a victim of crime and feel like he had been personally violated in some way.

But what I am most proud of is the lack of vanity in his approach to dealing with the aftermath.

He has admitted that given his professional experience he should have known better and he is now on a mission to educate others. He has talked frankly about it to family, friends and strangers, and even given talks about it.

He draws from his experience as a psychologist, who has researched email scams and criminal behaviour, to demonstrate how anyone can be tricked under the right circumstances.

And the experience has made me realise that I too could also be that 'stupid' fraud victim, either now or in the future, so I mustn't get complacent either.

It can happen to anyone, even my dad.