‘I unwittingly helped criminals drain my bank account in Royal Mail scam’

Tech-savvy Emmeline Hartley never thought she would fall victim to a scam – and then she lost all her life savings over one phone call

(Getty Images)

On Saturday I was walking home when I received a text claiming to be from the Royal Mail, saying that I needed to pay a £2.99 additional fee for a package to be delivered. It was my birthday the following day and I knew a few packages would be on their way. I’ve previously had to pay additional fees for packages so this didn’t seem out of the ordinary.

My phone had two per cent battery and I was walking so I was trying to resolve it quickly. The web page looked legitimate; I did some clicking around and asked myself a few questions about why I needed to give over certain details like my date of birth and bank account number. I did nearly close the website as this point but then reasoned my fear away - surely would-be scammers can only use this information to pay money into my account rather than take it out? So I submitted the form.

The next day - my birthday - I received a phone call from “Barclays”. The man on the other end of the line explained that someone had tried to set up direct debits in my account to Vodafone and Curries/PC World. He also said a transaction of over £300 had also been attempted to Argos. I simply thought my initial suspicions about the Royal Mail text had been proven correct and I was glad he was now offering to help.

He took me through security, asking my date of birth, address, the balance in my account. He said he’d cancelled my cards and issued me new ones, and that they’d take three to five days to arrive. I was so thankful, shaky and close to tears. I told him what a devastating blow it would be if the scammers had taken my money as I only had £501 in my personal account which was what I had to live on until the end of April.

The rest of my funds (£569), for a film I’ve produced, were in my separate business account and need to be paid out to people who worked on the project. I also explained that I was a postgraduate student having to fork out for my tuition fees, that I’d lost all my income in the pandemic, and that I’d been excluded from government support due to being newly self-employed. He listened to it all.

In fact he seemed very kind and understanding and said he might be able to put my account under a scheme for extra protection. He explained that because I’d also given away my sort code and account number, along with address and other details, it put my online banking at risk, meaning scammers could access all my Barclays accounts including my business account and ISA. He therefore needed to generate a new sort code and account number for my account.

In order to supposedly do this he got me to transfer the balance from my current account (£501) and ISA (£1.18) into my business account (£569) so it was all together. He then instructed me to transfer the funds over to a new account in two installments. Alarm bells rang.

I was so thankful, shaky and close to tears. I told him what a devastating blow it would be if the scammers had taken my money

I stopped: “Wait, how do I know you’re not from Barclays?”. He replied: “That’s a great question - well done for taking security seriously. You can check the number I’m calling you from on the Barclays website.” So I did and it pulled up the official Barclays Fraud line number. I said: “Okay, but tell me something about me or my banking that I’ve not already told you or submitted in that royal mail form,” and he did relay a couple more details (that I cannot disclose here for security reasons). I now think I’d already told him these earlier in the chat but am not sure. Either way it was enough - despite my growing unease - to convince me to continue.

He then proceeded to take me through the steps, asking me to click the “family and friends” option in the “reasons for payment” section. I asked why I was using that option (I now know it was so it didn’t flag a notification on the system warning me of scams) and he said “because you’re transferring it to someone you know - to you”. I laughed. A pop up said “make sure you’re only transferring money to someone you know”. I clicked onwards.

Then it came to entering the account number and sort code for the transfer. I expressed (again) that it didn’t feel right but he reassured me saying I was using my name in the “cardholder name” field and that if it wasn’t a match to the destination account (supposedly my newly created account), it would flag up. There was no notification of a mismatch, instead I got a note saying the account wasn’t verified, to which he replied: “Well yes, you need to verify it when you get the details from us in the post”. So I hit send and transferred my money. All my accounts hit empty. That was it.

(Getty Images/iStockphoto)

He then asked me to transfer my overdraft. This was when the penny dropped that something was seriously wrong - I don’t have an overdraft. He said his system was telling him otherwise. I accused him of lying and I started crying, and he apologised and said “no I meant your current account, not the business account - sorry!”. I replied: “This isn’t how overdrafts work!” He came out with some spiel but I was so desperate for it to be okay that I tried doing what he told me. It bounced again, I realised there was no way back. I have no other savings, it was all gone.

He stayed on the phone trying to calm me down, reassuring me, asking me to take deep breaths. Then I think something suddenly clicked and he realised he couldn’t get anything else out of me so he hung up.

I want to say that I’m not an idiot. I’m usually very scam savvy and have advised others numerous times on scams. But this was different. I’ve since seen it referred to as “social engineering” where the situation is set up so you act on emotional instincts because you feel vulnerable, rather than thinking rationally. But both times - with the first text and then with the subsequent phone call - I had let my guard down; I was distracted, rushed off my feet then embarrassed and upset. I sought protection when I thought I’d been scammed by the text, and the caller offered it.

After he hung up, I completely broke down. I screamed and screamed. I couldn’t breathe and I lost all control of my whole body. I was so angry at myself and I just kept seeing my empty balance flash up in my mind. This past couple of years have been hell for me financially. That’s the most money I’ve had at any one moment for a long, long time and was supposed to last me several weeks. The rest of the money in my business account wasn’t mine to keep and needed to be paid out, which is now an added debt.

After he hung up, I completely broke down. I screamed and screamed and screamed

I rang Barclays and sobbed on the phone for three hours. The scam caller had “spoofed” the Barclays number, which means he masked his own with it so it looked like the bank was calling me. Barclays have since explained to me that all customer service lines are inbound only, meaning Barclays will never phone from them.

Since the incident, I’ve been really anxious. I don’t know if my security will ever be solid now, as all my details are out there. My mind has been racing. I only slept for two hours last night but I am wired. People say they need to warn the elderly and non-tech-savvy people about these scams, but actually I think it can hit anyone. I am switched on and intelligent. I never thought this could happen to me.

Barclays have since told me I will be reimbursed and were very receptive to my feedback on how to improve security. I am relieved of course, but I have since heard of so many other people being scammed in this way, and many have had no news of reimbursement from their banks. This is a huge problem - these people aren’t just after a chunk of your money, they fleece the lot. How can anyone be expected to go for months with £0 in their account?

***

A Royal Mail spokesperson told The Independent it will only send text notifications where it has been requested to do so on trackable products and the only time they ask customers to make a payment by email or by SMS “is in instances where a customs fee is due”. In such cases, the Royal Mail would also leave a grey card at your delivery address telling you. This would apply either to international shipments or a surcharge for an underpaid item. 

The spokesperson said: “Royal Mail works hard to prevent and detect fraud. We work with UK law enforcement agencies, Trading Standards and other organisations to share information and support robust proactive action against scams. Customers looking for advice on how to spot a fake notification should visit here.”

A spokesperson for Barclays says: “No genuine bank would message you to transfer money to a ‘safe account’ – we advise any customers to ignore anyone who asks to do this, whether it’s by phone, email or any other method. Fraudsters try to appear as legitimate as possible, so it’s important to be vigilant and stay alert to anything suspicious.”

Barclays is also part of the ‘Do Not Originate’ scheme - which aims to protect some of the most commonly ‘spoofed’ numbers, such as the Barclays helpline from being used in a scam by making it inbound only and never for outbound calls.