A reader was pretty certain she was too savvy and smart to ever be taken in by scam artists – until she was, and lost tens of thousands of euro in a matter of minutes.
Months on from when she fell victim to unseen criminals, the reader – who we will call Jane, although that is not her real name – is still beating herself up over it and the scam haunts her dreams.
She contacted us last week not to recover her money, but in the hope that sharing her story might save others from falling victim to the same type of scam.
As part of her job, Jane is expected to keep up to speed with the latest developments in cybercrime – and she does – but even though she can tell her smishing from her vishing and knows to the nearest million just how much money is lost by Irish consumers to scammers each year (about €300 million), she was ensnared.
READ MORE
And she now believes that if it can happen to her, it can happen to anyone. “I can’t believe that I was taken in, we talk about cybercrime a lot where I work and because of that, I feel even more stupid,” she says.
Jane lives in Ireland but is, she says, in the fortunate position to have a holiday home in a sunnier part of Europe. She did share the location of her holiday home with us but asked us to keep it out of this story as she still feels a burning sense of shame about what happened and is anxious that people in her circle do not know what happened.
We are firmly of the view that Jane’s shame is misplaced – and we would completely disagree with her characterisation of herself as “stupid” – but we have come across this before on many occasions as the nature of cybercrime often leaves the victims blaming themselves in a way that they would never do if the crime unfolded in a different way.
Jane’s story starts in a place of hope and happiness – her place in the sun. The house she knows she is lucky enough to own overseas was in need of some renovations so she set about getting the work done last year.
She did everything you are supposed to do in such circumstances – she got a word-of-mouth recommendation, she sought multiple quotes from multiple providers and had everything that needed to be done as part of the project clearly outlined before the work commenced.
Even before the work started she noticed something unusual. Unlike many contractors in Ireland the man in the sunnier part of Europe did not look for any money upfront or any class of incremental payments. Instead, she explains, it was agreed that she would settle up the full bill once it was done.
It all went to plan – at least until it all went off the rails.
“We were very happy with him and he did a fantastic job, an absolutely stunning job,” she says. “He poured his heart into the work and did things that were above and beyond the job spec. He did that job with love, if you know what I mean.”
So far it all sounds like a dream.
Once the work was completed, the contractor emailed Jane an invoice for the total cost of the job, which was about €30,000.
The invoice landed on her phone just as she was boarding a flight home to Ireland and as she scanned the document she was happy that everything was in order.
“This is when the fun starts,” she says acidly.
“About 10 minutes after I got that email, I got another email from the builder’s email account in which he said he had made a mistake with the Iban [international bank account number]. He asked if I would send the payment to a different Iban number instead.”
This was the only red flag there was to be but Jane missed it.
She missed it because the two mails, separated by a matter of minutes, were identical save for the different Iban number and they came from the email address.
“I just looked at the two mails and honestly thought no more about it as my flight was about to take off,” she continues.
A couple of days later and back home in Ireland she set about settling the account and she did what she always does.
“I mailed the contractor to say I would transfer €100 first just to make sure everything was working as it should. And then I would transfer 10 grand and then another 10 grand and so on.”
He mailed back straight away to say he was happy with that.
This incremental payment step is one many – including Pricewatch – would not take and she did it as much to protect him as to protect herself. The last thing she wanted was to make a mistake in the initial transfer and have to spend days chasing the money through Europe’s banking network.
So Jane sent the initial €100 to the Iban she had been sent and mailed the contractor to say it had been done.
Such is the nature of interbank transfers these days that almost immediately, she got an email from the builder to confirm the €100 had landed so she sent more. And then she sent more until the final bill was settled up.
Jane was delighted to have had the work done and fully paid for and she went about her business in Ireland dreaming of a return visit to her newly refurbished holiday home.
Then the wheels came off her dream.
A week or so later she got a friendly mail from the contractor with some pictures of the finished job as well as a fairly gentle query as to when she would be paying for the work.
Jane was confused. She had already paid him and had received written confirmation that the money had landed in his account.
It had certainly left her account.
“That is when the penny started to drop,” she says. “I phoned him straight away and he said he had not sent the second invoice with the different Iban on it. He had no idea what I was talking about so I sent him copies of the email exchanges that we had had after the second invoice landed, the ones that detailed the payments. But when I rang him again he said he had not received any of the forwarded emails either.”
In a panic, Jane sent the mails confirming that the bill had been completely settled from a different email address and this time they went through to the builder’s email account. Then he phoned her to say that until that moment he had never seen them before. He also flatly denied having responded to any of them and he stressed that no money had hit his account.
He also told her that he had only ever sent her one email with one Iban number and that the follow-up email with a different account number had not come from him – although it certainly appeared to have come from his email address.
It was, Jane knows now, a classic invoice redirection scam. The fact that none of the mails she had sent to the builder from her primary account made it through to him is a clear indication that whoever had taken control of the contractor’s computers and sent her the bogus invoice with an Iban number completely unrelated to the builder’s had also blocked her emails going to the right source.
Jane was unlucky to have fallen victim to this kind of fraud. Invoice redirect scams typically target businesses rather than individuals although as her story proves, no one is safe.
On some levels the scam is very simple and sees a target receive an email sent by a criminal pretending to be one of their existing suppliers. They make contact to say that their bank account details have changed and ask for future payments to be sent to the new account. This “new” account is controlled by the scammer. Then the criminals just wait and at some point – if the scam has been successful – money gets sent to them.
Given the business she is in, Jane was familiar with the scam – and knows that big operators in Ireland, such as Dublin Zoo and the National Treasury Management Agency, have fallen victim to it in the past.
She also knew she needed to act fast but time was not on her side.
“I found all this out at 6pm so could not contact my bank until the following morning. That was the longest and worst night of my life,” Jane says. “I had also made the payments a full week before finding out there was any issue so that was working against me too,” she adds.
“The first thing the next day I called the bank and outlined exactly what had happened and how I had paid the money into the wrong bank account after receiving a bogus invoice. They told me they would do what they could to get the money back but there could be no guarantees.”
Jane also made a detailed statement at her local Garda station and they launched an investigation, which is ongoing. They were similarly gloomy about the prospects of recovering any money or catching those responsible for sending her the bogus invoice.
In the days that followed, her bank was able to retrieve a small fraction of the money – a couple of thousand euro – but more than 80 per cent of what she had paid out was lost.
The next step was to find out exactly what had happened. Jane immediately had her own computer assessed by cybercrime experts and it was given the all clear. She was told it was “100 per cent certain that my contractor’s computer had been compromised.”
She alerted him and he pushed back, saying that he too had checked his computers and they were given a clean bill of health. He questioned why she had not called him when she was about to make the payment rather than relying on email for verification purposes.
“It had never even crossed my mind to do that because all my communications with him up to then were by email and everything worked perfectly,” she says.
Jane then had a choice to make.
She could dig her heels in and insist that the problem was with her contractor’s computers and as such he would have to pick up the tab, or she could pay the contractor a second time.
“I couldn’t live with not paying this man,” she says. “He did such a good job and he had people that he had employed and had already paid and this was a big job for him. Losing the money was very distressing but I would have been just as distressed, if not more distressed, if I didn’t pay him.”
She also had to consider the legal implications of withholding payment and the last thing she wanted or needed was a potentially expensive legal action hanging over her head, something that could have ended up costing a whole lot more than she had already lost. “If this ended up in a court I don’t know if it is 100 per cent his fault or if it is my fault. I paid to an incorrect Iban that he didn’t send me so maybe the fault could be with the two of us,” she says.
Jane’s instinct is probably right on this score.
There is not a huge volume of case law to rely on in Ireland but we were able to find multiple cases in jurisdictions such as the UK and Canada that have ruled in favour of the suppliers of a service and against those who had paid into the wrong accounts after being conned, on the basis that it is the responsibility of the person paying for the service to make sure the money goes to the correct place.
But precedents aside, the bottom line was that she agreed to pay him in full again, not really because she was afraid of the law but because she believed it was the right thing to do.
“The second time I paid I did it in smaller amounts and every time I transferred a sum of money to his account I spoke to him to make sure he had got it. And I made sure to ask him questions about the nature of the job and my house that only he would know the answers to so I could be sure I was talking to the right person. My trust was completely gone at this point and I was second guessing everything.”
[ Irish people among international scammers’ most sought-after targetsOpens in new window ]
One of the things that bugs her now is that even before this happened, she did not really have a lot of faith in online transactions. “I have never really been one for buying stuff online and I was always wary enough about using my cards here, there and everywhere so it’s very upsetting to have been caught out so badly.”
She has been, she says, scarred by the experience and is more suspicious now than she has ever been. “I thought I had done everything right but I still lost all that money. The only thing I could have done differently was to have phoned him while I was transferring the money and I suppose that is what I am going to have to do in the future. The way things have gone is that you really need to keep close personal contact with the people you are paying, just to make sure they are who they say they are. I think I was right to pay the contractor the second time. And you know what? What goes around comes around, and maybe somebody might do me a good turn some day.”
