I was at home one Saturday afternoon when I got a call (number unknown) from a man who said he worked for Monzo. That’s my bank! The caller knew my name and phone number (obviously), so it all sounded legit. He said I’d been the victim of an attempted fraud and he needed to go through some details with me.
I duly opened my Monzo app and saw a declined transaction for Groupon for £30 that had just come through. Hmmm… that wasn’t me. The caller asked what sort of phone I had. It’s an Android. He told me the transaction had been made on an iPhone from somewhere in Scotland and the iPhone user had accessed my account. Scary… I don’t have an iPhone and I don’t live in Scotland. He set my mind at rest by saying not to worry as Monzo had now locked the iPhone out of my account.
The caller told me the transaction had been attempted on my old card. This rang true. About two months previously, Monzo had flagged up a fraudulent transaction that it had declined. My card was cancelled, I was sent a new one, no money was stolen, and I thought nothing more about it.
The guy sounded polite and professional and said he was calling to protect me from another fraudulent transaction that had been attempted, this time on my new card. He said he just needed me to confirm my card details, of which he already knew the first four digits (5355).
I’d been sucked in at this point. Like an idiot, I told him the rest of my card number and the three-digit CVV number on the back. He also asked me to confirm my balance (about £1,050) and my postcode, and asked if I had an overdraft facility (I don’t). He said he’d send me a text with a code I’d need in a minute.
Wellness and wellbeing holidays: Travel insurance is essential for your peace of mind
Out of the pandemic lockdowns, there’s a greater emphasis on wellbeing and wellness, with
Sponsored by Post Office
Here’s the really clever bit. The scammers had spoofed Monzo’s number and a text immediately showed up in a message thread containing all my other texts from Monzo. It said: “Never shared this code with anyone. We’ll never use it to verify with you over the phone. If you didn’t ask for this, contact us. Your recovery code is 225215.”
The nice man told me I’d now see another transaction initiated by the scammers and I’d need to click ‘approve’ and then enter the code to get it stopped.
A transaction for £1,000 for Roomcard (a hotel gift card scheme) duly popped up – my options were ‘approve’ or ‘decline’.
When suspicion arose
This is when I got slightly suspicious. As my finger nervously hovered over ‘approve’, I could feel my pulse quicken. This didn’t feel right. Why would I need to approve a transaction I didn’t want to go through?
“You need to click approve”, said the caller, “Do it now”.
Suddenly he was rushing me.
And then a message from Monzo popped up. Entitled Monzo Call Status, it said: “We’re not talking to you. If someone is telling you they’re from Monzo, hang up now.”
The penny started to drop, albeit slowly.
I told the caller about the message, but he tried to dismiss it as a technical error that I should ignore.
“Just click approve”.
Suddenly the fact I was about to be scammed for a grand became glaringly obvious. What had I been thinking?
It all started to fall into place. The guy had freaked me out by saying an iPhone user had hacked my account after I confirmed I was on Android. He knew about the previous fraud not because he was calling from Monzo, but because it was the same scammers.
The man knew the first four digits of my debit card as all (I think) Monzo debit cards begin with 5355. He needed my CVV number and postcode to initiate a transaction online. He could work out my card’s expiry date as he knew it was issued after the previous fraud attempt. The questions about my current balance and overdraft “to confirm it’s you”, was so he knew how much I was good for.
I hung up, and immediately declined the Roomcard transaction on my Monzo app. My phone rang almost straight away, but I declined the call. Anxiously, I checked and refreshed my Monzo app multiple times – fortunately all my money was still there – and opened the in-app chat to report the fraud attempt.
When I later spoke to Monzo, the fraud team told me they never call customers out of the blue. If they’re going to call, they will tell you in the in-app chat first. As well as seeing a pop-up call status message, Monzo customers can also check their call status via ‘settings’ then ‘privacy & security’ at any time.
It’s a great security feature, and although I like to think I never would have approved that transaction, the pop-up message from Monzo was a big wake-up call.
As scams get more sophisticated, it’s vital that as well as having proper rules in place for refunds, banks up their defence game, as Monzo has done. It’s not just the financial effect of scams, but the impact on victims’ mental health too.
I was on edge for days after my brush with the fraudsters, eventually confiding in a friend. She confessed she’d lost £700 to a ‘Hi mum’ text scam when her son was overseas. “I should have known my real son wouldn’t have put a kiss on his text message,” she sighed sadly.
The moral of my tale is that none of us are immune to increasingly sophisticated bank scams. Banks and regulators are finally stepping up and doing their bit to protect consumers – but we need to do our bit too, by keeping our wits about us every time we get a call claiming to be from our bank.
