Number spoofing: more Metro Bank users say they were robbed of thousands

More Guardian Money readers have come forward to say they too have been scammed by fraudsters who “spoofed” their bank’s phone number. In some cases they have lost more than £40,000.

Two weeks ago Money featured Jane Holden, a Cambridge businesswoman who lost £90,000 after falling for a highly sophisticated fraud. She had taken a call that showed up on her handset as coming from Metro Bank’s 0345 business banking number. Partly as a result of this – and the fact the fraudsters had so many of her banking details – she thought she was talking to the bank. Since the piece appeared, a host of victims have come forward to say “me too”.

Last week, the Guardian featured a NatWest customer who lost £10,000 in similar circumstances. In both cases the bank only refunded the victims following Guardian Money’s intervention.

But now four more victims of the scam, who all bank with Metro, complain they were taken in by the fact that the fraudster appeared to be calling from their bank. The fraudsters refer to the fact that they are calling from the number that appears on the back of the customer’s bank card.

There is nothing to stop a fraudster changing a phone’s caller ID to mimic that of a bank or other government agency. It has been highly lucrative for the gangs, who target banks that still rely on SMS texts to verify the account holder.

Peter Giles is among the Metro Bank customers contacting Money this week. The businessman from Surrey suffered an almost identical fraud as Jane Holden, although in his case he “only” lost £19,900.

Like her, he received a number of calls that showed up as from Metro. When answered, he was told that there was a suspected fraudulent hotel booking on his account. Like her, he checked the number matched Metro’s and went through security as “normal”, only handing over two characters from his passcode.

Giles says they clearly had access to his account and were able to read out legitimate transactions that he had made. “Thinking I was talking to a bank employee, and busy and hassled with my work on a Monday morning, I gave her the codes thinking this was to set up a payment to re-credit the account – not appreciating at the time that one of them was to set up a phone banking app,” he says.

Once they had access to the account, £34,000 was removed, although Metro later refunded some of the money, leaving him with a near £20,000 loss. “It was very professional and sounded exactly as if I had been talking to the bank,” he says.

Simon Jones, from Berkshire, similarly lost £15,000 from his Metro account after falling for the same scam, while Colin Brown had over £3,500 stolen from his Metro account.

In each case Metro claimed that the customers had been “grossly negligent” and therefore it would not refund all their money.

Another Metro Bank business customer who lost £41,000 told us this week that she has been forced to take her case to the Financial Ombudsman.

“The way Metro Bank dealt with me as a customer and victim of fraud, is nothing short of disgusting. I was made to feel like a criminal throughout the whole episode. It is simply unacceptable,” she wrote.

Last August the Financial Ombudsman Service put banks like Metro on notice that blanket refusals to refund in such circumstances will no longer be tolerated.

The chief ombudsman told the banks that it was not fair to automatically call a customer “grossly negligent” simply because they’ve fallen for a scam.

Banking regulations state that the bank must refund any payment that was not “authorised” by the account holder. Account holders whose account has been emptied by a fraudster cannot be said to have “authorised” such payments, therefore should be refunded.

Despite this, Metro Bank is still refusing to refund the latest cases.

“This type of fraud is a serious, industry-wide issue. We have a range of safeguards in place to help defend them against fraud, which we constantly review and update in light of increasingly sophisticated tactics from fraudsters.

“We investigate each claim that is referred to the bank and our decisions are based on the merits of each individual case,” it says.

All names have been changed