Premium

'I was affected by BA's data breach. Now a fraudster has stolen £54k. Are they connected?'

An airport carousel with luggage on it. One suitcase has the words 'card details' on it
Our reader was targeted by a fraudster who already had a lot of his personal and financial information - where could this have come from? Credit: Veronica Grech for The Telegraph

Has a company treated you unfairly? Our consumer champion, Katie Morley, is here to help. For how to contact her click here

Dear Katie,

I booked a business trip with British Airways in September last year and it later emailed to say my data may have been leaked in its massive hack. It offered me free access to a fraud monitoring service, but when I tried to use it there was an error.

As a precautionary measure I asked my bank, Metro Bank, to reissue me with a new card. About two months later I had a call from what appeared to be Metro Bank about a fraudulent payment to Apple.

The man had a lot of my details and this made me trust him. He tricked me into giving away seeds from my eight-digit security code by saying there was a system error so I need to give them again. Shortly after the call my account containing £54,000 was emptied.

As soon as I realised I called Metro Bank. Its customer support was appalling. I recalled in the afternoon and the same person answered and said: “what do you want me to do? Have the fraud department call you and say ‘we’re looking into it’”. Actually, that would have really helped my mental state.

Two days later I visited a branch and no one would speak to me about the fraud. I spent around 40 minutes on the phone with a fraud team who couldn’t even locate my complaint. Another two days passed and I’d heard nothing so I called the support number and was told that my contact information was suspended.

The next day I was told I would not be reimbursed due to my negligence. Metro Bank’s empathy levels have been shameful. The fraudster knew everything about me and, although I have no proof of this, I wonder whether this is linked to the BA hack?

AD, London

Dear AD,

I believe you were targeted by the same criminals as HF from Milton Keynes, whose letter was published in this column in May. He was also a Metro Bank customer and the scam was virtually identical. He lost £25,000.

You were taken in largely due to the large amount these scammers knew about you. Your name, address, your bank details. Where could the caller possibly have got this from if it wasn’t the bank? There are numerous possibilities.

BA was hacked last year Credit:  Steve Parsons/PA

You may have fallen for a phishing scam – common ones include emails from organisations like HMRC, the DVLA and even banks. Or someone could have intercepted the mailbox at your home and stolen your letters.

Another option is that details obtained in the BA data breach were used to extort you. This would be incredibly difficult to prove, even by forensic investigators, as stolen data is generally bought and sold anonymously on the dark web.

While it is possible that some of the data held by the fraudsters came from the hack, any card details would have been redundant by the time of the fraud, as you had a new one by then.

It also occurred to me that if your fraud was connected to the BA hack then HF may have also been affected. However he confirmed he was not.

So although the data breach was a serious event affecting more than 400,000 passengers – with BA now facing a £183m fine – I haven’t found hard proof that it facilitated your fraud.

Conversely, you have supplied me with overwhelming evidence that Metro Bank staff let you down abysmally in the wake of this fraud. The lack of care you were shown was truly shameful.

To give Metro Bank its due it now admits it failed you and has expressed its sincere apologies. It said you were put through to the wrong team when you visited the branch, which was its own mistake.

It didn’t refund you because it said you received a text containing a code, with wording saying you were setting up a new payee. You were instructed that if you were not setting up a payee you should not divulge the code to anyone, but you read it out to the fraudster regardless.

However, Metro Bank added that it does appreciate that fraudsters’ methods are becoming more elaborate and convincing. I’m pleased to say that following my involvement Metro Bank has put its money where its mouth is by refunding you the full £54,000.

After a period of extreme stress as a direct result of this crime and Metro Bank’s lack of care towards you, you are elated. You have donated £500 of your refund to a charity of my choice (St Mungo’s, which helps the homeless) and you have also decided to adopt four orphaned baby elephants and a rhino. I am very touched by this.

A Metro Bank spokesman said: “We take our customers’ security extremely seriously and we have a range of safeguards in place to help defend them against fraud, which we constantly review.”

The full Katie Morley Investigates column will appear in print every Saturday and Sunday. You can get an early taste every Friday at 1200.

For the week's most important personal finance news, analysis and expert advice, from pensions and property to investment ideas and savings tips, sign up to our weekly newsletter.