BBC One's Dirty Rotten Scammers recently highlighted a fraud victim who had lost money to a convincing and growing HSBC scam. This was called a ‘spoofing’ scam, where the scammers were able to call from what appeared to be the bank’s phone number. We have a detailed guide on how to protect yourself from impersonation scams here.

The scam starts with a phishing email or a phishing SMS, which is where the scammers send you a message pretending to be a trusted organisation, like the Royal Mail, in order to get your details. In the case highlighted by the BBC, the victim from Sussex received an SMS from O2, their mobile supplier, highlighting that they had not processed their latest bill and to provide her details via the link. Once she completed the information request in the link, the scammers had all the details they needed to convince her they were HSBC.

The scammers called her from HSBC’s fraud team, from the bank's number and told her that scammers had tried to take out direct debits on her card. They convinced her it was the bank as they had her card number and personal details so it appeared to be the bank. Unfortunately, the scammers use the information they gleaned from the SMS phishing message in order to convince her they were the bank. This is how the scammers usually operate this scam and why it can be so convincing.

The victim was convinced that their money was at risk and that they had to send it to a new safe account in order to prevent it from being stolen. Unfortunately, this was not a safe account but an account controlled by the scammers.

The victim lost their entire life savings. If you have lost money in a similar scam, Refundee can help to get your money back from your bank.

HSBC has signed the CRM Code, sometimes called the authorised push payment scam code. This means that HSBC agreed to the higher level of protection for scam victims that the Contingent Reimbursement Model provides as other large banks have.

The CRM Code says that banks should refund fraud victims, unless they provided a thorough and relevant warning which was ignored or if the customer did not have a reasonable basis for belief. Put simply, if the bank didn’t give a really good warning that was relevant to you, or if the scam was convincing, your bank should refund you.

Regardless of whether the contingent reimbursement model applies, HSBC should be protecting scam victims by responding to fraud trends and taking steps to stop fraudulent payments. This includes if you are sending large payments to cryptocurrency wallets in your own name, as the banks have known about this being a big fraud risk for a number of years.

Often, victims may be tricked into sending the money to a cryptocurrency wallet in your own name and then to the scammer. Where that happens, we may still be able to help. Banks like HSBC should have known about this type of scam for a long time, as it has been common for a number of years.

Transfers to cryptocurrency wallets and then to accounts controlled by fraudsters are often investment scams. This is a type of APP fraud that usually involves a third party broker or trader which pretends to trade and shows good results in what are often fake trading platforms.

Fraudsters tricking victims into sending money through cryptocurrency is one of the biggest recent investment fraud trends in the UK, with Action Fraud regularly warning banks and others about the scam risks.

Banks like HSBC should still be protecting customers when they make payments like this into cryptocurrency wallets, and so Refundee can still fight the case for you.