The crook also took out a £15,000 Halifax loan at 5am
These days, losing your phone is more than just an inconvenience. And as Andrew Merritt, a member of the Be Clever With Your Cash Facebook community, discovered – it can be financially devastating.
Some articles on the site contain affiliate links, which provide a small commission to help fund our work. However, they won’t affect the price you pay or our editorial independence. Read more here.
Pickpocketed in London
In late April, Andrew, 28, was on his way home after a friend’s gig when he realised his phone was missing from his pocket.
He turned around but couldn’t see anyone making a quick getaway into the crowd at Piccadilly Circus, central London. Andrew, a deputy financial controller, said his initial thought was how he’d be able to get home as he was relying on Apple Pay.
He found a policeman who put him on a bus for free but it took two hours to get home. By then the crook had already changed the password on his iPad and had started making applications and accessing Andrew’s accounts.
By 5am a £15,000 Halifax loan was approved in Andrew’s name as were several credit cards. As the hours wore on, Andrew also got notifications from his own providers, Chase and Wise, saying his cards and accounts had been frozen following suspicious activity.
Andrew said he didn’t know what to do. He said: “I felt completely helpless. I couldn’t contact anyone and I just had to sit there and watch as the thief did more and more damage.”
A prolific thief
Within two hours of stealing Andy’s phone, the pickpocket had accessed his banking apps and began moving his money.
Andy’s apps required further authentication to access his accounts, but as the thief had his email and phone number, he was able to reset many of them. He was also able to reset Andrew’s Apple ID password and add his payment cards to Apple Pay, to allow him to spend contactless from Andrew’s phone.
If the criminal had simply stolen the money from one of Andrew’s accounts, the unauthorised transactions would’ve been refunded by the next working day.
But as Andrew is an avid Be Clever With Your Cash reader, and has multiple savings and current accounts, it got complicated.
The crook clearly understood the banking system and knew to move multiple sums from Andrews savings accounts to his current accounts, to avoid detection and to ensure he could transfer the money out.
Movements between different current accounts suggest he knew which accounts he could easily withdraw money from.
Over the next 24 hours, these are some of the transactions the criminal made between Andrew’s accounts:
| Starting account | Money moved | End account |
| NatWest savings account | £5,000 | NatWest current account |
| Lloyds Help to Buy ISA | £11,130 | Lloyds current account |
| Lloyds savings account | £2,000 | Lloyds current account |
| Lloyds current account | £8,000 | Chase current account |
| RBS savings account | £5,000 | RBS current account |
| Nationwide savings account | £1,2000 | Nationwide current account |
| RBS current account | £200 | Wise account |
| Tesco credit card | £430 | Wise account |
| Multiple current accounts | £9,400 | Wise account |
Credit applications
The crook was also able to take out a £15,000 loan with Halifax at almost 5am that morning. Of this loan, he moved almost £5,000 to Wise straight away.
Andrew also received a flurry of emails from credit card providers as the criminal continued to apply for credit in his name, although many were unsuccessful.
£20,000 gone in 16 hours
Andrew had an old phone which he used to start calling his providers, meanwhile the crook was going on a spending spree.
In total, he managed to move around £30,000 of Andrew’s savings between his accounts and then spend around £20,000 in 16 hours in Wood Green, north London. This included £3,000 spent in JD Sports and £5,000 in Kodak.
The thief had also made purchases from Footlocker and bought a £530 playstation from CEX. He visited the barber several times and had meals in an East African restaurant. He spent £1,000 on online marketplace Onbuy and made large cash withdrawals from cash machines. Another £1,200 of purchases was declined in Argos.
Andrew says he can’t believe his banks didn’t do more to stop the transactions. He says: “I’ve never moved money out of my savings accounts and I’ve had them for years.
“So why didn’t my banks question why I was suddenly emptying them in the early hours of the morning? And surely someone taking out a £15,000 loan at 5am should trigger further checks or even a phone call?”
Andrew has also never used his Wise account for purchases and yet the thief was able to transfer £10,555 to Wise and spend all but £119. Furthermore, over £5,000 was spent after Wise emailed Andrew saying his account had been frozen. Wise says it believes the crook was able to unfreeze the account as he had access to Andrew’s email and carry on spending.
How did the crook access Andrew’s money?
We don’t know for sure but it’s possible the crook targeted Andrew, looking over his shoulder until he saw him entering his passcode, before stealing his phone from his pocket. And from there, he reset Andrew’s passwords, intercepting the instructions via email or text message.
BBC Rip Off Britain’s resident technology expert, David McClelland, told us: “Password resets are a vulnerability criminals repeatedly exploit in order to gain unauthorised access to potential victims’ online accounts.
“If a hacker has visibility of a potential victim’s email accounts and their SMS – e.g. with access to their smartphone – they would be able to action password resets across various online services, enabling them to take over those accounts.”
What did the banks do?
Many banks refunded Andrew swiftly, in line with the rules. However, it wasn’t as straight forward with Halifax, Lloyds and Wise.
Lloyds and Halifax said as the money had been moved to another account in Andrew’s name, he should speak to the receiving providers – Wise and Chase. And Halifax refused to clear the loan unless Andrew repaid the £4,800 that the fraudster had already spent.
But Richard Emery, fraud expert at 4Keys International, says this was wrong. He told us: “If Andrew did not authorise the transfer of money from his Halifax account to his Wise account (or indeed to anywhere else), Halifax must refund him. The fact that the money went to another account in his name is completely irrelevant.”
Wise initially refused to refund unless further evidence was provided.
Get the best of our money saving content every week, straight to your inbox
Plus, new TopCashback customers get a high paying £18 welcome offer
Resolving the matter
I’m pleased to say that after speaking to Lloyds Banking Group and Wise, Andrew’s case has almost been resolved.
Wise has now reimbursed all but £250 (which it is planning to return). Lloyds has fully refunded Andrew, has promised to unwind the loan and will return his savings accounts to their original position.
A spokesman says: “This is a complex case involving payments made to genuine accounts our customer held at other banks. Protecting our customers from fraud is our priority and we have a great deal of sympathy for Mr Merritt as the victim of a scam. We review each claim in line with the relevant regulations when deciding if we’re able to provide a refund.”
A Wise spokesman says: “We are deeply sorry for the experience faced by Mr Merritt. It demonstrates the lengths criminals will go to to separate people from their money.
“Sadly on 27th April, Mr. Merritt fell victim to a sophisticated account takeover scam. Following an investigation and working closely with Mr. Merritt, we will be fully returning the funds associated with the fraudulent activity to him.”
What can a criminal do with your phone?
David says: “An unlocked phone snatched from a victim’s hand is a treasured prize for criminals who know how to extract value quickly from the device.
“This might include access to apps, email, contacts, passwords stored in notes, files in Dropbox and personal information that could be used in identity theft and apply for credit or accounts. Usually, none of this will require any further authentication.”
As a test, I swiped down to search on my iPhone and typed in ‘passport’. And there, found in my messages were photos I had sent of my passport to friends and family when they needed my ID information. I could also find my banking apps by typing them into the search bar, which is useful for thieves trying to steal my identity.
If the phone is locked, criminals can take the Sim and put it in another device allowing them to receive messages, including two-factor authentication codes and password resets, send messages and make calls posing as the phone owner.
David also says you could be a target without knowing. This isn’t to make you paranoid – but be vigilant.
A friend’s boyfriend recently had his phone whipped out of his hand by someone whizzing by on a moped. And this is common, especially in London. David says criminals often work in gangs to identify ‘marks’ and steal their devices, by foot, bicycle or scooter.
Pickpockets often operate in busy areas, like tube stations or bus stops. Not only are there lots of victims but one of the first things people do when they hop off public transport is check their phone for messages or directions. This gives criminals the opportunity to peer over their shoulder at their passcode before swiping their phone.
Or, if they’re lucky, they may be able to grab your phone before it’s locked, for example if you’re already using your phone or on a phone call.
How Andrew now protects his iPhone
Andrew’s introduced a number of security measures on his smartphone so if he’s ever pickpocketed again, his money and accounts are protected. These include:
- Never using a phone case that can hold cards. Andrew kept his driving licence in his phone case which may have aided the criminals in applying for loans
- Only keeping one banking app on his phone now. The rest are on his iPad/laptop
- Storing no passwords in Apple’s keychain. If the fraudster manages to get your phone passcode, then they will be able to access your passwords. He now uses Microsoft authenticator
- Using an app called ‘Cape.’ This hides Chase from his phone when he goes 100 metres from his house. He can temporarily unhide it but he’s set up a shortcut to remind him to hide it again once he closes the app.
- He’s added his partner as a recovery person on iCloud
- Turning off message preview notifications
