E mail fraud and bank wire to the wrong account

Hello,
I am a new member and wanted to share a fraud experience I just had. I am working in the exports department of a company in Greece, and someone maliciously intervened with our e mail correspondence with one of our clients in Bahrein, changed our account details on our proforma, so the client sent the bank wire to the wrong person. The account details given were as follows:

SORT CODE: 20-98-57
ACCOUNT NR. 83176991
BANK ADDRES: 41 WOOLWICH NEW ROAD, LONDON

The beneficiary name for the bank wire was ours, so I was wondering how Barclay's bank executed the bank wire with the wrong beneficiary name. I called Barclays Bank and they gave me an address, where my client should send all the documents, namely RBB Litigation and special investigations. Does anyone know if we have a chance of a refund and if the person owning this account can be traced?

Hello DERMITZAKIS

A beneficiary name is sometimes inconsequential in financial transfers.

Barclays Retail and Business Banking (RBB) Litigation and Special Investigations team will be the people who should be able to help you in this matter,

Welcome to Scamwarners DERMITZAKIS.

Are you in the construction/agricultural machinery business ? This has happened frequently in this trade and it often involves bank accounts held in the UK.

I'm not asking you to identify yourself or your business, but you ought to check that scammers haven't set up a website impersonating your own website.

We haven't seen an example quite like this and it would be interesting to know whether or not the buyer was in contact with you before making the payment.

It appears that Barclays are taking the appropriate action and they will involve the police if necessary. That being the case, it's not really my place to attempt to research the matter.

Welcome to Scamwarners DERMITZAKIS.
We haven't seen an example quite like this and it would be interesting to know whether or not the buyer was in contact with you before making the payment.

We are a construction materials producer and the buyer was one of our known customers. We had other transactions in the past. However this time, the hijackers waited for the right moment, when I was about to send the proforma, then they created one e mail address in our name and one e mail address in the name of our client, so I thought I was sending the e mails to the correct address, but in fact I was sending them to the hijacker. He changed whatever information he wanted, and he forwarded my distorted e mails to the client.

It is apparent that Barclays are taking the matter seriously as they are involving what is in essence their fraud department. The fraudster either knows your company or has obtained information from someone who knows your company, but that could also include other clients of yours.

The greater concern is that it could happen again, even if you change your account details. More alarming is the prospect that this could happen to other companies. If fraudsters have uncovered a weakness in the banking system they will exploit it mercilessly. I do not know the details of this fraud and so I can't comment, but it does seem reckless if account details and the beneficiary name aren't compared in some form before crediting the account of a payee. Such a flaw makes money laundering legislation useless and the potential for fraud is vast. If no such comparison takes place, then the procedures for ensuring the quality of accounts opened has to be so high as to be virtually unachievable. The bank can now only rely on the information they hold on the account holder and their standing. If the person has no money or has left the country the prospects aren't good.

When this type of fraud affects companies, systems have to change. If companies go bankrupt because of it systems have to be strengthened. The fraudsters won't stop.

We just found out about another incident. Another of our clients in Japan. They tried to convince them to send the bank wire to a japanese account, our client refused, and then they sent the same bank account in Barclays. Another 25.400 euros were lost.

The e mails were coming from the same e mail server (salesperson.net)
And our client was receiving e mails from the same e mail-server (mail.com)

but it does seem reckless if account details and the beneficiary name aren't compared in some form before crediting the account of a payee. Such a flaw makes money laundering legislation useless and the potential for fraud is vast.
When this type of fraud affects companies, systems have to change. If companies go bankrupt because of it systems have to be strengthened. The fraudsters won't stop.

Exactly. How come Barclays bank accepted to execute the bank wire with the wrong beneficiary name, is to wonder. In Greece banks are more strict on such matters. Something has to be done to the bank system, because many companies will get damaged, if it didn't happen already to many of them, as it happened to us.
And on top of all, we just received a mocking e mail from the hijacker, saying "I am sorry I stole your money"!

I understand your point completely DERMITZAKIS.

I have retired from banking and I have some knowledge of how fraudsters will exploit any financial systems with vulnerabilities. Under European banking rules it is actually possible to make certain payments without a beneficiary name at all. I don't want to specify the details, otherwise i will merely help other scammers to perform the same trick, but clearly the method being used by this scammer is not a secret and it will be proliferated and copied by other scammers.

The matter of most concern is that from the reports made to this forum, one specific UK bank appears to have a particular problem with this issue, and I cannot explain it. It would be expected that the vulnerability would apply equally to all banks and create the same number of complaints, so by simple deduction it appears likely that another factor is involved. It's possible to speculate what that might be but it wouldn't be helpful to discuss it.

I'm not trying to provoke problems but this matter MUST be dealt with, not only for the sake of your company that will be badly affected by these frauds and your clients who are losing money, but for the sake of other companies who are going to be hit with the same scam. When this fraud is affecting companies the matter is becoming a crisis as it will undermine confidence in the payment system and commerce in general.

If the fraud can be performed against your company it can just as easily be performed against a major corporation or a government body. It's not just your employees who know details about your customers. I worked in international trade in my bank and I knew the clients and details of all our customers. It's impossible to keep the information secret if you trade internationally. I expect that your local tax offices have the information too. Telling you to keep this information secret just won't have any effect.

The essence of the vulnerability is in the bank accepting payments with a beneficiary name differing to the IBAN and that's obvious. In fact the matter is made worse because banks won't tell your clients the name of the person the money has been paid to, and this makes it appear that you may be defrauding your customers. For a fraudster the system works perfectly.

We finally received a reply from Barclays Retail and Business Banking (RBB) Litigation and Special Investigations team as follows.

"We are sorry that you 've had to contact us about a transfer made to a Barclays account. We apologise for the delay in responding however we have now completed our investigation and so can provide you with our full response. We take any allegation of fraud very seriously, and where fraud is confirmed or highly suspected on the part of our account holders, the relevant accounts are subject to immediate closure and funds removal.
What this means for you
At the time your funds were received into this account, we had no knowledge or suspicions that this was anything other than a legitimate account. Although we can confirm that the account into which you transfered money has now been closed, no funds were remaining at the time that we were made aware of your situation. For this reason Barclays is unable to return any money to you.
We appreciate that this is not the outcome which you will have wanted. We can confirm that in opening and managing accounts, it complies with all regulatory requirements including in respect of identification and verification. However, we have no way of knowing that an account holder will be using the account for fraudulent purposes. Barclays does regularly review and adapt its processes in order to minimise these risks in the future.
Please accept this as our final findings based on all the inforamtion we have relating to your claim.
What to do now.
(follows advise on how to make online purchases, which has nothing to do with our situation). "

At the end of the letter, they advise us, if we are not happy with the outcome of their response, to contact their complaints team at Customer Response Team, Westwood Park, Coventry, CV4 8JG. And if we are still unhappy, to refer the matter to the Finanacial Ombudsman's Service.

They don't mention anything about that criminal being prosecuted, or take responsibility for the fact that they transfered the money into the account without caring about the beneficiary wrong name.
So there is no legal consequences for this crook. This means he can now go to another bank and open an account and deceive other people and companies?

The situation with regard to the opening of fraudulent bank accounts with UK banks is a scandal DERMITZAKIS and one that the authorities and banks would prefer not to have exposed. I say this with a sense of shame as a UK citizen and a retired banker.

There is no doubt that the attitude to opening accounts changed as I came to retirement and banks made opening new accounts their prime aim without applying proper rigour to the account opening procedures. I know this because I have seen some of the ID's that have been used to open bank accounts and I have viewed discussions by criminals on facebook and they view UK account opening procedures as a joke. They have even produced comic ID's to mock how easily they can produce documents that banks will accept.

If I sould like an old fool talking rubbish - I'm not talking rubbish, even if I'm an old fool.

http://www.telegraph.co.uk/finance/financial-crime/9323243/Bank-account-fraud-reaches-new-heights.html

Bank account fraud reaches new heights

I know from my banking days how devastating a fraud can be to any business, but to a small it one it can cause its closure with the consequent loss of jobs to the local community, and it's a disgrace that banks treat it in such an offhand manner.

It's bad enough when it affects UK citizens but when the situation affects people abroad, who expect something better from us, then our 'dirty little secret' becomes exposed for all to see. My attitude may be old fashioned but perhaps honesty and decency are old-fashioned virtues. Setting aside the morality the slap dash account opening procedures have enabled UK local government authorities to be defrauded of millions of pounds through a fraud variation it would be better I didn't describe, so the cost of this fraud is carried by every UK citizen and it is not satisfactory for banks to respond to it with whimpering helplessness, as if they're just too stupid to deal with the problem.

Even the police acknowledge that this money is going organised crime gangs, most likely involved in drugs, extortion, prostitution, people trafficking and quite possibly terrorism, and banks have a legal obligation to report every single suspicion of financial irregularity.

The most amusing thing is that one UK bank has devised what must be the most insecure mobile payment payment system yet devised, and markets it in the most insultingly patronising manner, that actually makes me feel ill watching it.

It's very sad DERMITZAKIS that the UK banking system has allowed itself to become so degraded that it has been fined more by US regulatory authorities than those in the UK. It appears that UK banks are regulated by the USA, but they deserve to be treated like that if the FCA 'twiddles its fingers' doing nothing.

There are people in the UK who understand your situation DERMITZAKIS.

This is awful, and this is big. And here, on ScamWarners, is the first I can remember learning of it.

http://www.bbc.co.uk/news/uk-politics-15660029

10 November 2011
Councils 'lose £7m in false bank account scam'

http://www.localgovernmentlawyer.co.uk/index.php?option=com_content&view=article&id=14784%3Acouncil-thwarts-multi-million-pound-fraud-attempt&catid=59%3Agovernance-a-risk-articles&Itemid=27

08 July 2013
Conwy County Borough Council has foiled an attempted £2.6m theft after a fraudster attempted to divert funds owed to a contractor to another bank account.

http://www.auditnorth.co.uk/news/fraud-and-security-services-3/the-changing-face-of-supplier-amendment-fraud-26

Since April 2012, 12 attempts have been made against NHS health bodies, targeting over £1.7 million.

The scale of fraud is impossible to underestimate.

I am trying to help a friend who had a similar thing happen to his company based in Turkey, although he was the one who received the fraudulant email and transferred money to a barclays account in the UK in error. The recipient has obviously now closed their account. However, they have sent him another email asking for the rest of the money transfer and now they are using a Lloyds tsb account.

Does anyone know who we should complain to? I contacted the police and they said since the victim is not a UK citizen they could not do anything. I guess we should contact Lloyds, but that won't help us recover the money lost.

What is the likelihood of getting any money back?

My friend is in the same situation right now. Somebody hacked into the merchant's e-mail account and then intervened with the conversation. My friend sent a bank wire of $40,000+ to a Barclays bank account.

The merchant is a registered and legitimate company in the USA. Is it possible to sue or file a complaint against the merchant? For their negligence and lack in security? And then get the products we paid for or at least for them to sort this out?