Friday Afternoon Fraud: The Scam That Wipes Out Your House Deposit In Seconds
You’ve found your dream property, made the offer, sorted the mortgage and survived the survey. Now, several months later, you’re finally hovering over the button to send your house deposit to your conveyancer.
You’ve checked and double-checked the account details supplied. The sum, amounting to five figures, stares back at you on the screen. You send the money. In an instant, you’ve lost everything. And the person who stole from you might have been waiting for this moment for years.
The scam we’re talking about is known as Friday afternoon fraud, but it also goes by many other names, such as payment diversion fraud and conveyancing fraud. Read on to learn about how it works.
How Friday afternoon fraud works
Friday afternoon fraud can happen any day of the week, but committing the crime on a Friday allows the scammer to escape immediate investigation, with victims sometimes not realising they’ve been conned until the following Monday.
It involves a fraudster hacking the email account of either a homebuyer or their conveyancer(property solicitor), allowing them to monitor and intercept emails. Usually, the scammer contacts the buyer posing as the conveyancer, providing them with fake bank details. Then, when the buyer comes to transfer their deposit, they unwittingly send it to the scammer.
The exact method fraudsters use depends on which party’s email account they’ve gained access to. If it’s the conveyancer’s account, the scammer can impersonate them and send emails to the buyer from the conveyancer’s genuine email address.
More commonly, however, it’s the buyer who has their email hacked. In these cases, the scammer will create a new email account with a very similar address to the one used by the conveyancer (perhaps changing one character) and copy the tone and email signature used in previous messages.
We’ve also seen instances of scammers phoning up the homebuyer posing as a member of the conveyancer’s accounts team and giving them new bank account details to send their money to.
A scam years in the making
Friday afternoon fraud can take months or even years, with fraudsters gaining access to email accounts and lurking until a suitable opportunity arises.
Cybersecurity expert Jake Moore told us scammers can set up software programs to automatically scan email accounts for keywords such as ‘conveyancing’ or ‘house purchase’. These scans might be carried out periodically, for example once a month. Once a keyword is found, the fraudster will begin their attempt to snag the victim’s money.
But how do scammers get access to these email accounts in the first place? Two common methods are via data leaks or if the account holder has entered their personal information on a dodgy website. If a large data leak has taken place, hackers can use the exposed data to guess passwords and gain access to accounts.
This underlines the importance of using different passwords for all your accounts, and changing your password if you’re informed that your data has been compromised. Jake says: ‘Large-scale data leaks have led to billions of lines of personal data being breached. This information can land on the dark web or online forums, where it’s sold or given away to those looking to carry out scams.’
How banks are protecting homebuyers
The sums of money lost to Friday afternoon fraud can be life changing, and it’s devastating consequences shine a light on an outdated homebuying process.
While many of us will be accustomed to using internet banking and banking apps to manage our day-to-day finances, sending tens of thousands of pounds this way seems a little too easy for such an important transaction. Without secure paywalls or portals to transfer the funds, the process is more vulnerable to fraud attempts.
When it comes to sending your house deposit to your conveyancer, there are two main options. The Clearing House Automated Payment System (Chaps) is commonly used for high-value transactions. Most banks advise that you use Chaps for payments of more than £25,000. And due to the large sums of money involved, some only allow payments to be made in branch or via post.
Alternatively, you can transfer money from your internet banking service or mobile banking app via the Faster Payment System. Banks place maximum limits on these transfers, for example Nationwide limits Faster Payments to £10,000, while Halifax allows payments of up to £25,000.
Banks have warnings in place on their apps that encourage homebuyers to double-check details before transferring large sums of money. Major banks including Barclays, Lloyds, NatWest and Santander provide a warning to call your conveyancer when you indicate that you’re making a house payment.
Conveyancers face cybersecurity challenges
Conveyancers must also do their bit to protect their customers, although there’s no industry standard advice that they must provide in relation to Friday afternoon fraud.
Sarah Dwight from the Law Society told us that most firms will state in their terms of business that customers should only transfer funds to the account number provided at the very start of the process.
In addition, she says that many conveyancers include fraud warnings in their email footers.
Homebuyers are more likely to have their accounts hacked than conveyancers, but that doesn’t mean scammers aren’t targeting firms.
The Solicitors Regulation Authority (SRA) visited 40 firms in 2020 to assess their cybersecurity. It found that 30 had been the target of a cyberattack. The remaining 10 firms all reported that cybercriminals had directly targeted their clients during a legal transaction.
What happens if you fall victim
If you realise you’ve transferred money to a scammer, contact your bank immediately and explain the situation. Most major banks are signed up to the Contingent Reimbursement Model (CRM) code, which states that blameless victims of bank transfer scams should be reimbursed for their losses.
In reality, however, whether you’ll get your money back can be something of a lottery.
The Payment Systems Regulator (PSR) has proposed introducing mandatory reimbursement for scam victims in all but exceptional cases, but this doesn’t currently cover Chaps payments.
Data from industry body UK Finance shows that £22.5m of bank transfer scam losses in 2021 relate to payments made by Chaps.
Which? supports the PSR’s proposal, but wants regulators to work together on introducing mandatory reimbursements across payment methods to strengthen these protections.
In addition to informing your bank about the scam, you can report it to the police by calling 101, and to the cyber reporting centre Action Fraud.
How to protect yourself against Friday afternoon fraud
Buying a home is a stressful enough process without the threat of being targeted by scammers.
Before transferring your house deposit to your conveyancer, send a nominal amount such as £1. Call your conveyancer on its registered branch phone number to ensure it’s received the money, and only send the rest of it once this has been confirmed by a trusted member of staff.
When communicating with the conveyancing firm, be on your guard against any unexpected emails or phone calls, and be suspicious if you’re contacted by a ‘new’ member of staff or someone claiming to work in a different department at the firm.
Finally, always set secure passwords on your email accounts and take your time before making any big decisions such as transferring large sums of money.
Scammers have a better chance of success if you’re in a hurry, so slow down, take a step back, and, if you have a hunch that something isn’t right, make sure you heed it.
It can be hard to tell if something is a scam – that’s why they work. Fraudsters are cunning and adapt quickly to convince you into parting with your money.
By Tali Ramsey
