4

I'm hoping somebody will be able to help me with my situation. I have summarised it as concisely as possible below.

I had been dealing with a kitchen company who were to provide me with a new kitchen for my house. Having chosen the kitchen and having had it measured up, we were provided with an invoice to pay a deposit on Feb 1st 14:00hrs. We were also forwarded an electronic copy the same day at 14:26hrs. A subsequent email at 16:30 that day was received telling us that the bank details for BACS transfers was changing. The new details were sent in a further email at 18:17. We made a BACS payment using these details that night. The money went into their account on the morning of February 2nd. On Feb 3rd we received a call saying that they had not received the money. I asked to confirm the bank details and they said that the details were not for their account. They then said that they had not sent the emails regarding the change of details although the address was theirs. They said that they had been hacked.

At this time, I am currently out of pocket to the value of the deposit. The kitchen company are not accepting any responsibility. I have contacted my bank, however they have been unable to recover the money. Do I have any protections in consumer law to recover the money from the kitchen company or can I consider it gone for good?

|improve this question
  • Just from an technical standpoint, you can freely select any email-adress you want when sending emails, doesnt even have to be your own. Eg i could send a mail with the sender adress of google@google.com, ofcourse most email programms will flag that, but thats up to them – PLASMA chicken Mar 5 at 22:49
  • 4
    Are you sure the kitchen company itself is legit? – jcm Mar 5 at 23:00
  • Why in the world would you trust an message about changes to payment address without actually talking to the vendor? At any rate, if they truly were hacked, there should be an official public notice to all their customers (GDPR requires this). – Ben Voigt Mar 6 at 0:54
  • 2
    @user71659: From the question: "I asked to confirm the bank details and they said that the details were not for their account. They then said that they had not sent the emails regarding the change of details although the address was theirs. They said that they had been hacked." – Ben Voigt Mar 6 at 1:06
  • 2
    @BenVoigt The fact that their address was spoofed to a layperson would be that they were "hacked". But clearly there was a compromise of billing data. That could have occurred on either side. – user71659 Mar 6 at 1:08
7

OP, it is entirely possible the e-mail came from someone unaffiliated to the kitchen company - faking the sender e-mail address is not difficult and is commonly used to, for example, spread viruses under the guise they come from someone you know.

What it doesn't explain, however, is how the scammers knew that they should send you such an e-mail at that precise time - the scam could only work if they knew you were just asked to make a monetary transaction to some account, and only if they knew about both its participants. Clearly, the scammers had access to information they shouldn't have. So how did that happen? There are several possibilities:

  1. Your computer is compromised by a virus (some form of spyware, most likely) that allowed the scammers to read your emails (without needing to hack the email sever itself). If that is the case, you are out of luck and will almost certainly never see your money again. Still, definitely contact the police, even if your outlooks seem grim.
  2. Scammers gained your password and simply logged into your e-mail to get access to your correspondence. This can happen through a wide variety of means, from having a weak password to using the same one on multiple sites (one of which could be compromised. Database leaks with hundreds of thousands of passwords leak even to large companies from time to time). Again, in this situation, your outlooks would be very bleak indeed.
  3. The e-mail server itself got hacked. This is extremely unlikely, although possible. You might have a chance to sue for some compensation from the server owner. You'd need to consult your lawyer on that.
  4. The scammers had access to the kitchen company's e-mail (be it through them knowing the password, or having spyware, etc.). If that is the case, you should definitely sue. After all, the fault lies with them, not you. Their claim of "being hacked" would also hint at this possibility.
  5. Someone at the kitchen company is cooperating with the scammers and feeding them info directly.

Possibility 4 seems the most likely to me, but it could of course be the others (or some that I have forgot to list - possibilities are endless, as they say). In any case, you should immediately contact your lawyer and the police and have them find out just what exactly happened - don't get brushed off by the company saying "we got hacked". If they got hacked, then that's their own damn problem - they should have secured themselves better and should now bear the consequences.

As for why I advise you to sue - if the bank didn't manage to get your money back from the scammer account, it's almost certain that that money is gone forever. Sorry. But you can still get your money back from suing the person responsible for leaking the data needed to carry the attack out. In any case, contact the police and even more importantly, contact your lawyer.

|improve this answer
  • Further thinking about it, it's unlikely YOU were the one compromised - they'd need to read all your emails, which takes time, and such attacks rarely target just a single person on the off chance he happens to be making such a transaction. It is almost certain that possibility 4 is the one that happened, in which case I believe you would definitely have a good chance at court. – Gweddry Mar 6 at 9:51
  • Not at all. Attackers can easily make search patterns (regexps) for common account types and keywords like IBAN, SWIFT codes, sort codes, credit card numbers, etc. Many companies do this internally to prevent data leaks and improper storage of data. – user71659 Mar 6 at 18:03
3

Whatever happened here it has reached the level of criminality. Someone, possibly the builders themselves, has tried to cheat you.

So you need to go to the police. They have power to do things that you can't, such as find out who your money was actually paid to. Also they can check whether the emails really came from the builder's servers.

You may also wish to talk to a lawyer about your options if the money can't be recovered.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .