Cyber fraud is the most common crime in the UK, costing businesses and individuals £130 billion each year, according to the 2019 The Financial Cost of Fraud Report. It’s growing rapidly and small businesses are too often seen as easy pickings by scammers, lacking both in knowledge and the sophisticated tech that larger firms employ to ward off such attacks.
Such was the impact of a cyber fraud last summer, costing a Manchester business owner over £10,000, it’s taken a year for her to be able to speak about her dreadful experience in the hope of educating others so they can avoid a repeat.
“It’s actually a milestone for me that I can now talk about it all without getting upset,” says Ann Davies, who runs social media marketing agency BizWizUK.
“It’s taken me 12 months to talk about it and I haven’t yet got over it, it has affected my mental health, and now I want others to know about it and learn from my experience.” she tells me.
A year ago, Ann and her bookkeeper fell victim to a scam, nothing particularly elaborate, but something that happens on daily basis in the UK, innumerable times.
Ann’s bookkeeper received an email, purportedly from Ann’s email address. It asked her to make two BACS payments, one of over £8k, and another of over £2k, to the same bank account. Questioning the request, the bookkeeper emailed Ann over the payments, and promptly received another back instructing her to go ahead and pay both invoices.
Unbeknown to the bookkeeper, Ann’s email account had been subject to a phishing email , and was in the control of criminals. Phishing is a type of online scam where criminals send an email that appears to be from a legitimate source and asks you to provide sensitive information. In good faith, the payments were made to a Barclays account.
“I don’t know how it happened, I am told I was the victim of a phishing scam,” explains Ann. “I don’t blame my bookkeeper at all as she was just doing what she thought I was asking her to do, and why wouldn’t she? But it is a lesson to us all that sometimes a phone call is far better than an email in some situations. It’s been a particularly costly lesson for me, and I would advise all businesses to put extra systems and processes in place when it comes to the payment of invoices. It would have made the difference had I been doing it at the time,” she added.
Ann’s tale of woe was, however, only just beginning. What came next was almost as worse as she tried to deal with her own bank, and with Barclays to where the fraudulent account is registered. She also reported it to Action Fraud – the UK police system that deals with victims of online fraud.
“It was a total nightmare that actually made the experience even more stressful, more time consuming and more of a distraction from my day to day running of the business,” she continued. “I was very upset, and was having panic attacks. But the bank staff were just not sufficiently trained in how to deal with me, it was just a process for them.
“In the end my bank was able to recover £1.70. And despite having all the details, Barclay’s could do nothing to get my money back, but offered me £150 as goodwill gesture instead, due to their slow response to the investigation.
“And Action Fraud – where do I start? Just terrible. You never get to speak to a real person; it’s all done online. You fill a form in, and off it goes. They’ve achieved nothing, despite having all the information with bank account numbers, and even hot leads to go at.”
Through her own sleuthing, Ann had managed to track down one of the suspected scammers, who was based in Luton. She even got hold of a mobile phone number, which she even rang and spoke to a man who subsequently blocked her number.
“This was a case where Action Fraud could have got involved in, and probably got a result,” she says. “But the shocking truth is this crime is such an epidemic they just don’t have the resources to go after even the low hanging fruit. It’s senseless.
“Despite it happening on such an industrial scale we rarely get to hear about this type of crime, usually because most businesses don’t want to admit they’ve been a victim. They either feel it reflects badly on them and that others will not want to work with them, or their customers will go elsewhere, so they brush it under the carpet. But not me, I want others to learn from my mistake.”
Ann has since contacted Andy Burnham, Mayor of Greater Manchester and he has asked the Deputy Police Commissioner to look at this case again. Ann will also be interviewed on BBC’s Radio 4 Money Box programme in the autumn to talk about her negative experience with the banks.
FSB members can access advice around cyber security from our cyber helpline. Or for more information visit www.fsb.org.uk