3

There is a scam called 'authorised push payment' where customers are persuaded to transfer money to a scammer, thinking they were transferring it to a reputable business, such as a conveyancing solicitor.

Which have a page about it, but its instructions for avoiding this are very general (like "Take care"). Is it possible to define a set of concrete actions that you can perform to ensure the bank details you have been given are actually those of the organisation you think it is?

There are 2 situations that this is relevant to me:

The first I suspect is me being paranoid. I wanted a savings account, went to money saving expert, picked a high interest option that I had not heard of, and opened an account. About the same time I read that their certificate issuer was hacked, and as I was not aware of any other way to validate the credentials they provided online I was too frightened to transfer any money into the account.

The second is much more like the sort of thing that generates these scams. I am looking at buying property by auction. The auction website has a registration/login process, but appears to be pure http, I have not found a https page. I have had emails from the auction house, and they have no encryption but are sent from a SPF permitted IP address. The property is currently owned by a company with no web presence or telephone number available online, but exists on companies house. If I win the auction, I will have 24 hours to transfer 10% and 20 days to transfer the rest. I expect to get the payment details by email.

In cases such as this, is there a set of actions that an individual can take to ensure that any set of payment information is who they think it is, and safe to send a large amount of money to?

1
  • 3
    Legitimate real estate auctions accept escrow.
    – Ben Voigt
    Mar 19 at 16:23
1
+50

You've asked this as a generic question, so I'll give a generic answer. If you want to know how to verify a specific transaction then I think that belongs in a separate question.

It all boils down to trust and confirming identity. The various tools that are out there are mechanisms that build trust.

You trust a conveyancing solicitor because they've had an office in town for years. Your friend recommended them after using them to buy a house, which adds some additional trust. If you walk into their office and they hand your their bank details, then you are confident those bank details are legitimate.

When you use an HTTPS website, you trust that your browser maker (e.g. Mozilla) has verified the identity of the Certificate Authority (Cloudflare Inc) and that the Certificate Authority has verified that you really are looking at example.com. You already trust example.com because you've used them in the past, or you've seen TV adverts for them etc.

So you need to confirm that:

  1. you are dealing with an organisation you trust, because of their reputation. For a UK property auction check if they are NAVA propertymark protected.
  2. you really are dealing with the organisation, and not someone pretending to be that organisation.
4
  • This is a useful answer. In particular, how can you really confirm that you really are dealing with the organisation, and not someone pretending to be that organisation? Would you consider SPF: Pass enough for an email?
    – Dave
    Mar 25 at 13:06
  • @Dave That would make a good question in its own right on security.stackexchange.com. My gut is that SPF is more about preventing spam than being robust enough to trust a large financial transaction on.
    – thelem
    Mar 25 at 16:51
  • This best answers the question asked, so I shall accept it. I am amazed there is not a simple answer to this question, but I guess then the scam would not exist.
    – Dave
    Mar 27 at 23:12
  • Re SPF, HTTPS, etc.: The full answer is complicated and out of scope here, but the short version is this: Trust begins and ends at the domain. For the most part, security technology is centered around making sure that other people can't impersonate "the owner of example.com" in various ways. This is true of HTTPS, SPF, DKIM, and many other security protocols. But if you don't trust "the owner of example.com" in the first place, that's a social problem, not a technical problem. Technology cannot actually determine whether someone is trying to scam you or not.
    – Kevin
    Jul 30 at 7:37
2

To be honest, I'd be more concerned about the auction site than the seller of the house. If their security is so lax that they don't use a secured web page for login, what ELSE is unprotected? How secure is ANY of your information that you provide to them?

I'd have to seriously question the competency of the I.T. department when it shows such amateur data practices, and that doesn't inspire any confidence.

For me, there are too many red flags here to feel comfortable dealing either with the auction house or the seller of the property. I would have to waive off and find a different venue for buying auctioned properties.

4
  • Now the auction has started, I have a new login and it is a https site, with a certificate issued by Cloudflare Inc.
    – Dave
    Mar 24 at 12:53
  • 1
    I still think you have to be careful. ANYONE can get a secure server certificate, but that doesn't legitimize their business or practices.
    – RiverNet
    Mar 24 at 13:04
  • I certainly will be carefull, but is there anything I can do to check bank details more generally? It seems it must be a common problem.
    – Dave
    Mar 24 at 21:18
  • Easiest solution is to try using only auction sites which have a known, trusted reputation. If a site is new, Google their name and see what comes up, what kind of chatter or reputation there is out there about them. Read their FAQs very carefully, and if you're not sure about something, ask. If you're concerned about the sellers in an auction, ask if they will allow an escrow service to act as middleman to your transaction to protect your money. And most of all, if something sounds too good to be true (too cheap, too easy), it probably is, so use caution if you go ahead with it.
    – RiverNet
    Mar 24 at 22:13
0

I would say be careful, confront the auction host and make absolute sure that you will be getting what you want at the correct price. Also look up when and who certified their server and contact them to see if the certified person was a legit business.

This is all i can say but i hope this helps out

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.