I Lost £10K to This Scam - Don't Make My Mistake

One of the things I've noticed about small business owners is they quite often will complain about having cash flow problems, but it's often not a cash flow problem because the money flows in and it flows straight back out again. What small business owners really struggle with is making more money and then ensuring that they keep hold of that money. There's another thing as well to bear in mind as we go into this, that keeping our money safe in 2024 is massively important, and there's been a huge rise not just in the UK but overseas as well on various things called push payment scams. So in the rise of the online bank, you know, a shift away from high street banking, it's made it much easier for people to fall foul of these scams, many scams which are out there at the moment, because there was a certain standard of the way that we used to bank when we were banking with the likes of HSBC or Lloyds or NatWest or those traditional high street banks. But because now with the advent of technology where apps are so much more complex that we don't fully know exactly the ins and outs and the ways that they've been working. If you think about it, traditional banking has been around for hundreds of years, whereas these apps are in their infancy. Many of them are less than 5 years old. So our natural preconceived ideas around how safe and secure our money should be are slightly skewed. And the reason for that is because I think a lot of people are a little bit naive and And they think, oh well, I doubt it'll ever happen to me, despite the fact that almost daily now we're seeing stories of people who are losing tens of thousands of pounds or dollars to these various different push payment scams and phishing scams that we now see that are rife online and coming through on our telephones. And the thing is as well, they're really convincing, and I think this is the hardest thing for us to get over. So I'll come back to what I said before. We need to be much more shrewd as business owners, making sure that we figure out creative ways to make sure that we're making more money, but most importantly, that we protect that money once we've made it. And I always repeat this statement, it's very clichéd, I'm sorry, but I'm going to say it again: turnover is vanity, profit is sanity, but cash is king. You can have a multi-million dollar business on paper in your profit and loss account, but if your bank account shows zero— and it doesn't matter whether it's because you're not making enough cash or what I'm going to be talking about in this video, people are actually stealing that cash— you've got to make sure that you are protecting your cash flow and cash at all times. It should be the one thing that you are the most skeptical over, because money, at the end of the day, has been the one sole cause of greed and robbery and stealing over the, like, thousands of years. And I'm not talking here about coins. Now we have digital wallets, but years ago people used to steal sheep and cows and things like that. They used to go rustling for those because that was the currency back in the day when people were bartering in the Middle Ages. So we have to really think and be very savvy about our money and how safe we keep it. And I'm gonna give you a few hints and tips about my personal experiences of having people try and scam me and what I've learned from that. So the first one, everyone I would hope by now would know about this, but some of you may not. It's just the traditional phishing scam. So that's not spelled with an F, that's phishing spelled PH at the start. And how phishing scams work is a Salubrious people will create these emails which look very convincing. They look like they could be from Wise or Starling or Revolut in this case. They have the logo on there, they use the same fonts and typefaces, and you get this email in there and it says you need to click on this button and log into your account to do something. Now the thing is, it's gonna be rare that those establishments are gonna email you because they know that phishing is a thing. So their emails are either gonna get caught up in the whole phishing thing and people will think, oh, is this a phishing email, and not click on it. So what they do— a lot of these, uh, organizations like Revolut and like Starling and like Wise, they— it's much more of an on-demand service. So when you need something from your bank, they anticipate that you will log into your— into the app or onto the website to get what you need from that bank. It's rare that they will be reaching out to you. The only caveat to that is if they do think that there is some kind of fraud being detected on your account, maybe there's some transactions which have gone through which you didn't authorize, your account will be blocked. And you may still get a call from your bank, but rarely will they actually email you to say that fraud is taking place. Now the thing is, a lot of these fraudsters, these scammers, will play on just basic human psychology around something called loss aversion. Lots of studies actually around the psychology— if we feel worse about losing £10 than how good we feel about gaining £10. So if we could quantify it, we might be, yay, I'm a 2 out of 10, I found £10 on the street. But then if somebody comes and When we steal that £10 note off us, or $10 note, we're like an 8 out of 10 off the Richter scale. It feels awful and like our heart's just been ripped out. So the scammers will play on that simple psychology around loss aversion because they know that we don't want to lose our money and we feel awful about that. So what they'll start to do is ramp up and heighten around those emotions and kind of— you see, start to feel a little bit pressured into taking action. And that will be with what they put into those emails. Now, it's very hard to tell the difference quite often nowadays between a normal email from a company and a phishing email because they do look very similar. But there's a couple of things which you want to look out for. And by the way, there are now text messages and WhatsApp scams as well. So it's not just in email. You'll get— there are similar things happening in different media now. So this applies to both emails, text message, and WhatsApp as well, and even in Messenger as well on social media. So this might arise in lots of different ways, but the things to look out for mainly are going to be, are there any typos and spelling and grammatical errors in the emails which you're receiving? Quite often the scammers aren't native English speakers, so naturally they will use AI, but they will make lots of mistakes within these emails, mistakes that very expensive and very highly paid people, marketeers in these organizations, wouldn't naturally make because they're probably English-speaking or native speaking in whatever language it is, because you might not be English watching this video, of course. But look out for spelling errors, typos, grammatical errors, just really easy mistakes, really, that ordinarily you'd think big corporate businesses wouldn't necessarily make in their emails or text messages. The second thing to look out for is the website address that you're being looked to. So if, for example, it's not linking to the usual website for Starling or Wise or Revolut, so you can hover over it on with your mouse over the email and it will pop up and give you a preview of the website address. And if it looks like a random obfuscated website address, it's not the one you're expecting for your bank, don't click on it. That's really, really important. Also, just as a minor point of note, I think now a lot of people are still using— well, not still, but they're using their mobile devices to check emails and things like that. If I get a message that's in any way related to my finances and it comes in on my phone, I do not click on it as a rule. I keep it— it's like a really simple rule. You can't be caught out if you don't click on anything. And that also applies to your standard email inbox. Approach it with a lot of skepticism and a lot of caution when you get seemingly emails. And it doesn't have to be your bank. It could be from your local government institutions, HMRC here in the UK, or a .gov website, or any number of different organizations that ordinarily you might get emails from. But just approach every email with a little bit of skepticism, a little bit of caution. Because it's so simple to click on it, and you might not actually— it might redirect to the website. But what happens is when you click on one of those links, even if it redirects to the real Starling website, you've just sent a little ticker off to someone, a scammer, a fraudster out there in the ether, to say, hey, I'm Robin and I click on these spoof spam emails that I get sent. And then they will prey on that. So the people that click on those emails, they'll start to work harder and harder to try and get hold of your personal information through these phishing emails, and then eventually you'll find one that's super realistic. And their goal ultimately is to get you to put in your username and password into these apps so that then they can access those or use that information to start to defraud you of your money. Now, the phishing emails are normally the early stage of what is ultimately going to be the main part of the scam, which is what I'm going to go on to next. These are the push payment scams that have been— everybody's talking about in the media at the moment, especially in regards Revolut Financial, the online bank. And, um, one of the reasons Revolut has been targeted so extensively is because it's not just an online banking system. You can make investments on there, you can do stocks and share trading, you'd set up your ISA, you can do, you can do all sorts of different payment transfers in all sorts of different countries. So they're kind of picking on this because there are so many different types of transactions which happen on Revolut which don't happen on some of the other online banks that that have come up in the last 5 years. So that's why they're targeting them. So how do we transition then from a just a simple phishing email as a scam and then into what is now known as these push payment scams? So what they'll do is once they've got your login information— so typically here you'll have your whatever your username is, whatever your password is— but typically they can't access your accounts without something called a 2-factor authentication code. Now these 2FA codes typically sent to you in an email, or you may have an authenticator app. For example, like Google have an authenticator app, or some of the banks have their own independent authenticator apps, or you might have an app on your phone which is like an inbuilt authenticator code generator. And so what happens is they're now going to use the information they've got from the phishing scam in conjunction with a telephone call. These telephone calls, when you get them— so this is like the second stage now which we're moving into— the telephone calls sound incredibly convincing. And I've even had one from my online bank not less than 2 weeks ago. And I was sold on it initially because they— he spoke— it was obviously an English native-speaking English person. They were very convincing and they knew a couple of little things about me and about where I spend my money. So I was kind of a little bit fooled initially, but then it got— what they do is they start off very cool, calm, casual, build a little bit of rapport, ask a couple of simple strategic questions, and then within just a matter of minutes, they start to really ramp up the pressure and give you this false sense of urgency that you need to act now because they're taking money out of your account right now. Again, it's playing on just basic psychological fears that we hold as human beings, especially in this modern digital age where we don't want to lose our money. So somebody's telling you you've got money coming out of your bank right now, you start to panic. Now the thing is, when that fear kicks in, you're actually— your rational brain disappears. And so, and again, they're playing on this. They want you to get into that state of frenzy so that you're more likely to fall for the scam. And so as I'm going through this process, I did have a little bit of skepticism anyway for the reasons which I said. To be fair, another thing to look out for when the phone call comes through, it is possible now to spoof the number so it does appear as though it's coming from your actual bank. And what I would suggest as well, or a number similar to your bank as So the first thing I would suggest is that if genuinely it is your bank, they shouldn't worry about you saying, oh, um, actually hold on a second, I'm just checking my security. I'm gonna hang up this call now and I'm gonna dial my bank back directly. If they're a genuine bank, they'll go, no problem, Mr. Waite, that's absolutely fine, you go ahead and do that. And they might give you a few instructions as to which department to ask for, or maybe even give you a reference. I've had that happen before as well. A bank has genuinely called me and there genuinely has been a fraud attempt attempts on my account, and I just said, sorry, I'm not going to give you any personal information. I'm going to go and find the number and call the bank back. Never call back the number that appears on your phone because most likely that's going to be going back to the scam— the scammer that's called you in the first instance. So that's just something to be wary of. But just hang up the phone the moment you get a slight bit of doubt. Hang up the phone, go and find the bank's number directly within your app or within— from their website, and then give them a call back. Go through the security questions and then say, oh hey, by the way, I got this call, was this you? And then they should be able to verify whether it was genuine or not. So that's a great way to protect yourself. But if you're on the actual phone, phone call itself with the scammer, you'll start to feel this heightened, like, they're trying to get a sense of urgency. The money's leaving your account, you've got to give us this information, we're going to send you a code. And that for me was the point where I was like, well, hold on a second, if it was genuinely my bank, they wouldn't be asking me for my 2FA code. That is just not something which they do. Don't ever give out a 6-digit code or any security details, especially when you get an inbound call, because the person calling you should know who you are because that's how they've got your telephone number that's linked to that account. So don't give out your date of birth, don't confirm your address, don't confirm any of the transactions they're talking about. Don't— just definitely do not give out your username or your password, or most importantly The two-factor authentication code, because unfortunately, as soon as they've got those details, they have access to your bank account and they can set up. And typically what tends to happen is they will then log in using an app on another phone. They'll log in then seemingly as though they're you because they've got the two-factor authentication code, which means they can set and they probably got your password because of the phishing attempt earlier on in an email. So they can now start setting up recipient pay, you know. People to receive the payments and set up as many transactions as they like to send that out. And the thing is, most online banking apps these days will let you transfer up to £1,000 without having to put in a password or passcode or a 2FA code. So that means what typically tends to happen is they'll just be doing transaction after transaction, just very low amounts time and time again. And then, but because they've got all of your login information, you've given them access to your bank. And this is what Revolut have been pulled over calls for, they said, well, you authorized the payments. That person's got your bank details, therefore it's your responsibility. Now, these banks have a duty of care, and they only do so much. And I do think in this day and age with the technology we've got, they should get better at being able to spot any activity that's unusual, transactions coming from different locations, for example, and they should be able to put a stop to it very quickly. But it seems with the push payments, i.e., where they're sending out batch transfers, It just seems that they're not— they don't have the technology there to be able to pick those up. Because to all intents and purposes, once the fraudsters have set up the app on their phone, it looks like they're you, just like you've set the app up on a new phone. So it's very hard, like, if you've given away the information. Some banks are better than others, but Revolut were just being very reticent about giving any money back. And typically how the refund system works with these online banking scams is that the bank who initiated the transfer has to pay 50%, and the bank that received the transfer has to pay 50% of the whatever's going to be refunded to you. And a lot of the times Revolut will only refund like a partial amount of it, up to say 60% of the transaction. So in a very short space of time, you can have your business bank account or your personal bank account absolutely wiped out and be left with nothing, with the potential that you're not going to get any of that money back. Now there is a— you can obviously approach your financial ombudsman. They should be you know, with a letter or an email or a complaint, and they will obviously push to get you compensated for, um, if you are a victim to one of these scams. The banks have a duty of care to refund that money, or some of it at least, within the first 5 days after the scam has taken place. Because obviously, if you're running a business or if it's your personal account, you're going to have bills which are going to come out. And so you are reliant on having that money in the bank. And not only that, but you've probably worked bloody hard for that money, so you have absolutely every right to fight to get that money back. I did have a friend of mine who very sadly, he was scammed out of $30K, but he's based down in South Africa and the rules unfortunately do differ from country to country and they have the different governing bodies have different views on it depending on where you are in the world. And he was just like, I'm never going to see that money again. It's just that, you know, and he kind of wrote it off. I kind of told him, no mate, you should really fight this and really try and get your money back because it's like you've worked so hard for that cash, you know. And I suppose it's down personal choice. But yeah, look out for phishing emails. If you get a weird random call from your bank, just be ever so skeptical. Don't give out any personal information, certainly not any security codes, 2-factor authentication codes, passwords, or usernames, because that just gives them instant access to your app. Another thing which they've also said that you should do as well on these scams is the moment they've set it up on their phone, they'll say, oh, you should delete the app because that's how they're accessing your funds. So you then delete the app, and because they've now got your passwords and things like that. When you go into, you know, reset up the app when you've finally realized you've been duped and it's a, it's a fraud, a scam, you now can't set up your app because they've changed all of the passcodes and things like that. So as well, never delete your apps on your phone. Always keep your banking apps. That's another part of the scam. Just be really skeptical. And what I did in the end when I realized they were asking for my 2FA codes, and I did get a couple of text messages through with the 2FA codes in there, I was like, I'm sorry, this is a scam, and I just hung up the phone. It's as simple as that. And there's nothing they can do in that, in that instance. And again, these scammers all talk to one another. If they get wind that you're receptive to these scams, you'll go on a list and you'll get more of these attempts to like hack into your accounts. If they get wind that actually you're quite a savvy, smart person, you don't give out your— the information on a phone call, you go on to a separate list that says don't call this guy back because, you know. But my fear is, my worry is that my information is is out there and they got that far to be able to push 2-factor authentication codes to me. And for me, I do a couple of little things just to, again, to protect myself. I have my money spread over different accounts, which means that essentially that they could only— it kind of limits the damage. It doesn't mean I'm not going to be at some point, you know, part of one of these frauds or victim to one of these frauds. But what it means is that it limits— there's a limitation on the amount of money that they could drain out of one of the accounts. if my money's spread over in different places. You know, so there's a few things here which you can do to protect yourself. But Revolut, you need to do better. I think Revolut is just not justified or not right that in this day and age that we don't have the protection we deserve as consumers using these apps. We put our faith in, you know, the technology that should be available in like 2024, 2025. And when it doesn't work, And then they let us down by not refunding us. I think it's just shoddy. I think it's really awful. But hopefully through this video, we've just reduced the chance of you watching this actually becoming a victim to one of these scams. So if you've been a victim of one of these online banking scams, push payment scams, or phishing attacks, and maybe you found a unique or interesting way to protect yourself in the future, or there's something which I've missed in this video, I'd love it if you could help me and the other viewers out there watching this video, just drop it into the comments below and we'll make sure that we put it into the description so that other people don't make the same mistakes and fall foul of these scammers and fraudsters that are out there.