I thought I’d share an attempted defrauding to which I fell victim about a week ago in case others also fall target. The experience left me deeply shaken as I’m usually highly vigilant/tech savvy and have never before fallen for anything of this kind. I also have a couple of concerns I was hoping someone might be able to advise on (see final paragraph).
The process:
On my birthday, I received an SMS that appeared to be from EVRi (the delivery company) claiming an attempted delivery had been missed. So far, so typical. The message was a lot more accurate and convincing than any I’d received before. I (stupidly) clicked the link in the message and was taken to an extremely convincing-looking site, at which point I was told that in order to rearrange a delivery I’d have to pay a 70 pence fee. Ridiculously I fell for this and proceeded to input my Monzo Flex details. Having done this, and immediately realising the stupidity of my actions, I froze my Flex account, ordered a new card, and thought nothing more of it.
Several days later, I received a number of calls from a withheld number. Each time this number dialled, I received two calls, both ringing for roughly the same amount of time – one at 9am, and another at 1pm. I ignored this for two days. On the third day, I answered one of the calls, and was greeted by the professional-sounding voice of a man claiming to be from Monzo’s fraud department.
After introducing himself, he asked if I’d recently been the victim of an attempted defrauding, to which I said I had (referring to the EVRi message). He then informed me that through clicking on the message, I had unintentionally installed malware on my device, through which hackers had access to all and any accounts linked to it (ridiculous from a technical perspective I know, but I was shaken as the reference to the earlier SMS tricked me into putting my confidence into him). Crucially, he told me that under no circumstances should I open the Monzo app, as this would somehow give the hackers access to my accounts, which he claimed to be controlling remotely on my behalf.
In order to further build confidence, he proceded to send me a ‘security message’ from Monzo (as an SMS) which contained a passcode. I did indeed receive this message when he informed me he’d sent it – everything about it seemed genuine, including the fact the sender was named ‘Monzo’. He did not ask me to read out the security code, instead saying that ‘Monzo will never ask for any security information directly down the phone’ (again, obviously ridiculous in retrospect).
He then built a sense of urgency by explaining that someone in another part of the country, using a different device, was trying to access my account. He reassured me by saying that he was blocking attempted transfers in real-time, causing further distress which in turn led me to further submission.
At this point, he explained that hackers had access to all my savings, and that in order to qualify for FCS protection I had to e-mail a screenshot of the EVRi text message to Monzo’s official phishing report e-mail address. To do this, he patiently directed me to the officail Monzo website and informed me to copy the phisihing report e-mail address and send the screenshot to it, with a particular subject line and message (something like ‘I received this message and I did not use my device in Liverpool’).
Throughout all this, he was patient, calm and collected, and sounded exactly like someone I’d expect to talk to at Monzo should a serious issue arise. All this served to not only unnerve me, but to then actively comply with his instructions.
Surprisingly, I got a bounce-back from the official Monzo phishing report e-mail address, saying it couldn’t be delivered to the group. I’m not sure why, or if that is some kind of unrelated problem on Monzo’s end, but the fact I got the bounce-back made me start to question what was going on.
As he attempted to get me to use a different e-mail account to try to resend the e-mail (to the same address) I started Googling, while talking to him, to try and figure out if this was a legitimate call or some kind of hoax. When I saw that the Monzo app will clearly say whether or not a call is legitimately from Monzo, I decided to open the app – and saw that the call was not from Monzo (this is why he had instructed me to not open the app earlier).
I put down the phone and realised that I had come very close to being the victim of what was the most sophisticated defrauding attempt I’ve been on the receiving end of.
Thinking through it, everything about it was calculated: I received the EVRi message on my birthday as there was a higher chance that I might be receiving something in the post (i.e. a gift – this addressed the likelihood that I had probably not ordered anything due to be delivered on that day myself). The scammers had then waited a while before contacting me about it, which added a sense of authenticity. As I had already cancelled my card, I imagine the process I then went through was an attempt to build my confidence in them in order that I would eventually reveal information that would have allowed them to access my money.
I hope the above might be of help to others who might otherwise fall for the same scam, or to those who are working to stop such activity.
Beyond being shaken by the experience I have two main concerns, for which I’d appreciate any advice. The first is to do with just how much of my personal information the scammers seemed to have – including my name, birthday, address, and the fact I was a Monzo customer (some from when I entered my details into the fake EVRi site, granted). On the call I revealed further information, including the names of other banks I have accounts with, my e-mail addresses, and my location. Should this concern me? Are there any actions I should take as a result?
The second is to do with the confirmation code they sent via SMS (to ‘prove’ that they were from Monzo). As I immediately cancelled my Flex account upon falling victim to the EVRi message, how were the scammers able to have Monzo send this message (assuming it was a genuine Monzo message)? Surely if my card had been cancelled, they couldn’t have used it as a trigger. In any case, I have cancelled and re-ordered all other Monzo account cards I own.
Anyway, thanks for reading, and take care!