It started with a phone call. Before I knew it I was another victim of identity theft

When scammers phoned to say his bank account had been fraudulently accessed, Andy Welch found himself sucked into a nightmare world of deceit

“Hello Mr Welch. Visa Card Services here.” That was the line with which my nightmare started one Sunday morning, hungover, sitting on the sofa trying to piece together the night before. The landline rang. I was surprised because I’d only given the number to about three people.

The person on the other end of the phone – Mark – told me there had been a number of fraudulent transactions on my bank account since midnight, adding up to about £1,100. I’d never heard of Visa Card Services before, but then I’d never had money stolen like this before. Maybe this is what happens? He then confirmed the last genuine withdrawal I’d made – at the Barclays opposite Highbury & Islington station – gave me a reference number and told me to ring the number on the back of my bank card.

I did just that, quoted the reference number and spoke to someone who knew all about the supposed fraud. These cunning tricksters had apparently cloned my card at the ATM I’d used and then treated themselves to a few things in the Apple Store on Regent Street. Something didn’t ring true about the whole thing – why would someone with a stolen bank card only spend £400 in the Apple Store, for starters? But I watch enough consumer TV to know that these things happen.

The person now helping me, Rajesh Khan in HSBC’s card protection department, had my full name, date of birth and, crucially, my address. He said a courier was on the way to collect my card for further examination. I initially flinched, but when he explained they needed properly to analyse the chip, it seemed to make sense. After all, I’d called the bank myself. That’s probably the same reason I typed my PIN number into the keypad of my phone when he asked.

I packaged the card up as requested – wrapped up in kitchen roll, packed into an envelope so it didn’t look like a bank card – and waited for the courier. Rajesh called back twice, once to say the car was five minutes away, and again to say it was outside, quoting the car’s numberplate and describing the driver.

My mate Rajesh called again later that afternoon to say they’d received the card and that I’d have my money back in a few days. “Great,” I thought. So sucked in to the efficiency, I went through exactly the same process the following day with my credit card. The same fraudsters had somehow hacked into my online account, got my credit card details and maxed it out. Good old Rajesh told me this time there was a shred of hope the criminals would be arrested as they’d made the mistake of buying Eurostar tickets to Paris on a specific train. The police would be waiting for them at St Pancras. Amazing news!

A few days went by and Rajesh stopped calling. By now I was about £4,000 out of pocket so I called the bank, this time from my mobile. After explaining the situation to two or three people, I heard the most chilling phrase of all. “But Mr Welch, your cards haven’t been reported stolen.”

I’ve never been speechless before. I’ve never been able to feel the colour drain from my face either, but I was and I could. Why had I given my card to a stranger? Why had I typed my PIN into the phone? How did they know my mother’s maiden name? How did they have my address? And, most of all, why hadn’t I checked my balance before I even called the bank that Sunday morning?

When I did check, things were far worse than I’d expected – to cap it all off, my rent had bounced. The Apple Store story was all a lie – they’d in fact spent thousands in clothes shops, and best of all treated themselves to a Dixie Fried Chicken each evening, spending £95 over three days. By now, I was really panicking. Most of the money was credit or overdraft. What if I didn’t get a refund? The security expert at the bank said this was a possibility. It would take me years to pay off debt like this.

I called the police, who put me on to their dedicated fraud line. After explaining my idiocy once again – it’s pretty humbling, repeatedly telling people you’re the type of person that gives both your bank card and PIN to the first person that asks for them – they went through the likely series of events that led to this theft. In the end the total was about £5,500. It all started, said the police, on the Saturday night where one of this gang will have watched me take money from the cashpoint. That’s details of my last transaction taken care of. The police then believe I was followed home, which is how they got my address.

As for the call, well, it’s pretty clever. Only the person who calls a landline can cut that call off; if the person who receives the call puts down the receiver, it doesn’t hang up. So when I went to find my bank card, the fraudster was still on the other end, waiting for me to pick up the phone and call “the bank”. As I did this, he first played a dial tone down the line, and then a ring tone. He will have been sitting next to the first person that called me, no doubt laughing their heads off at how stupid I’d been. Well, Mark and Rajesh, I hope you are.

I was right to praise the bank’s efficiency, though. They got me all my money back within 10 days, although I did have to get new bank accounts and cards. It was a pretty lean spell, and by the time I got my money back, I’d spent my last 60p on a tin of beans. My family and friends offered money, but two things; I didn’t have a bank account for them to pay money into, and with cash, well, there was a chance I had the sharp end of six grand to pay back, and I didn’t need to owe out another £50 on top of that. The feeling of total financial ruin, of utter helplessness, isn’t one I’ll forget in a hurry.

Setting up all new direct debits was an unholy pain and, five months on, I’m still having problems. My credit rating has taken a serious knock, while getting the various bank departments to talk to one another and not try to charge me a few hundred quid in overdraft charges was no picnic. I’ve since had to sign up to a number of other bank schemes and government services to protect myself. I get a monthly statement of credit checks in my name, for example, so I know if these people are using the information they have on me again. It took a few weeks to stop worrying about the same people coming back to my house, too, although spending hours online researching the link between bank fraud and violent crime – virtually non-existent, it would seem – helped with that.

Out of everything, accepting that it had happened probably took the longest. I’m still coming to terms with it now, I think, but being a bit more suspicious isn’t a bad thing. Being paranoid, well, hopefully that’ll just wear off in time. I like to think I’m a tech savvy, culturally aware person. I read about internet security, I know about phishing and all that tedious stuff we’re told about every five minutes, yet the knowledge left me when it counted. Financial fraud is often deemed a victimless crime because, ultimately, it’s only huge companies footing the bill, not individuals. Having suffered myself the stress, upset and countless hours spent sorting it out, I know it’s anything but victimless.

Anatomy of identity fraud: How the conmen tricked their victim

1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late on a Saturday night and tail him to his house.

2 On Sunday he gets call from “Mark at Visa Card Services”. Mark confirms his last transaction, tells Mr Welch that since then his card has been cloned and a further £1,100 has been taken from his account and gives him a reference number. He calls the bank number on the back of his card, not realising that the person on the other end of the line has not hung up.

3 Over a series of calls with “Rajesh”, Mr Welch reveals his full name and date of birth. Mr Welch is told a courier is coming to pick up his card.

4 Rajesh calls back to say a car is on its way. Mr Welch is told that his card has been used to for a series of transactions, including at an Apple store. Rajesh says that as there are now two cards in existence, he needs to perform a PIN block. Mr Welch is suspicious and refuses, but is told to enter the number on his keypad – that way it will go into the system but not be seen by call centre staff. He does, and the number tone reveals his PIN.

5 A “courier” comes 90 minutes later and the card is handed over. The fraudsters now have everything they need to take money from Mr Welch’s current account.

6 The next day Rajesh calls back to say that Mr Welch’s credit card has now been cloned. He hands over the PIN in the same way.

7 On Monday evening Rajesh calls back to confirm that thousands had been spent on both the cards, but that Mr Welch would be refunded the full amount by Friday. Rajesh says he will call back the following day.

8 When he hasn’t called by Wednesday Mr Welch telephones his bank and uncovers the full scale of what has happened. He cancels all his cards, and 10 days later is refunded the money on both cards.

9 Mr Welch speaks to the police fraud helpline and is given a series of fraud prevention services to sign up to.

10 Mr Welch still receives a monthly report of credit applications on his account (there have been none) and has to produce photo ID every time he signs up for any credit himself. He believes he will keep these provisions for ever.