Fraud for 600,000 kroner: Elderly woman tricked by fake police and bank
A woman over 80 was defrauded of 600,000 kroner by scammers posing as police and bank officials. Researchers warn of a legal loophole affecting victims of manipulation fraud.
Fake police called 80-year-old woman – and took everything
Helle Jacobsen's mother was over 80 and nearly blind when the scammers called. Nevertheless, she normally managed fine with digital services. That did not stop either them or her. She ended up losing 600,000 kroner.
According to forskning.no, the sequence began with a telephone call from a man who presented himself as a police officer.
– My mother received a phone call from someone who said they were from the police. They told her that they had detected suspicious activity on her account, and that they were now in contact with the bank, says Jacobsen.
It was partly correct — just not in the way her mother believed.
– They appeared very professional. They spoke polite, correct language and initially presented themselves as police.
Shortly after, another person called, presenting himself as a bank adviser: "I hear you're in contact with the police. That's fine. We're going to help you."
Technician collected phone and bank card
The scammers gradually obtained both passwords and NemID information. Then a man turned up at the parents' home, presented as a "technician". He took the mother's phone and bank card with him.
The parents had a flexible loan. The scammers transferred money to a current account and used it at, among other things, expensive watch retailers. Within a short time, nearly 600,000 kroner was gone.
Jacobsen, who herself works at the Data Protection Authority, happened to call her parents shortly after the man had picked up the phone. She spoke to her mother via her father's phone and immediately understood what had happened.
This initiated what she estimates to be around 90 hours of work with the bank, police, telephone, email, passwords and all the digital services the scammers had gained access to.
– The money itself was surprisingly simple to sort out. The bank returned it within about a day, she says.
– It was actually the least painful part of this story.
Legal loophole: Who presses the button determines everything
But what if the scammers had chosen a different method? What if the "police officer" had instead asked the mother to herself transfer the money to a "safe account"?
That is precisely the direction the fraud is moving, according to Finans Norge: "It appears that Norwegians in general have become better at not sharing BankID secrets, and the fraud has shifted in the direction of scammers manipulating victims into carrying out the fraud themselves, particularly by transferring money to a so-called safe account."
Vebjørn Wold, ph.d. researcher at the Faculty of Law, researches digital fraud and explains the consequences:
– Who presses the button and transfers money can have great significance for who bears the loss.
If scammers themselves gain access to your BankID and carry out the transfer, you are in principle well protected. The bank should as a rule cover the bulk of the loss.
If, however, you are manipulated into carrying out the transfer yourself, you risk being left with the entire bill.
– For me, it is not obvious that reading access codes out to scammers is much less negligent than being tricked into transferring money to what you believe is a safe account. Yet the liability can become completely different, says Wold.
Rules from another era
Wold points out that the current set of rules stems from a time when payment fraud looked quite different.
– When the first credit cards came out, there was a distinction between whether you yourself used the card or if someone else used it. Today's scammers have made this distinction far less clear. They do not necessarily need to steal the card or BankID. They can manipulate you into doing the work for them.
He believes that the distinction should instead be based on how negligently the customer has actually acted.
The EU has adopted new rules for payment services, and the question of protection against manipulation fraud has been central to that work. Wold is, however, not impressed with the result.
– The EU has recognised the problem that banks have very limited incentives to do anything about this type of fraud. It has been a lot of back and forth with many different proposals. In the end, they have not done very much about the fundamental problem. It will continue to be of great importance whether the scammer transfers the money or whether you are manipulated into doing it yourself.
Vulnerable customers do not receive adequate protection
Wold emphasises that the current model also makes it more difficult to take into account the fact that certain people are easier to manipulate than others — including the elderly and persons with disabilities.
– With a set of rules that covered more forms of fraud, one would have the opportunity to take far greater account of, among other things, age, life situation and other vulnerability. Then one could have a much more nuanced approach.
He points to the United Kingdom, which has introduced special protection for vulnerable customers against this type of fraud.
Helle Jacobsen's mother is precisely that kind of customer. Over 80 and nearly blind.
– After this incident, she actually said for the first time that she felt old, her daughter says.
Although she got all the money back, she did not get the same sense of security back.
– Before the fraud, she used digital services on her own. Now she has lost confidence in both the technology and her own ability to handle it.
Jacobsen believes that the rapid digitisation makes many elderly people more dependent on others — and that society has not kept pace in time.
Source: Google News DK — Crime (da)