Re: "'Scammers stole £40k after EDF gave out my number"

Theo <theom+news@chiark.greenend.org.uk> wrote:

In comp.mobile.android Carlos E.R. <robin_listas@es.invalid> wrote:

On 2025-03-05 14:25, Frank Slootweg wrote:

Chris <ithinkiam@gmail.com> wrote:
[...]

Fortunately, the victim has had his 40k refunded.

 
Do you have a reference - with details - for that? I.e. who accepted
responsibility for which fault(s)?

 
Quote: «National Savings and Investments said it had refunded him the
money taken from his account.»
 
And that's the £40000, because earlier it reads (quote):
 
«Worse news was to come, when he learned his National Savings and
Investments password had been changed.
 
"After an hour of talking to different people there, they said, 'You've
actually taken out a very large amount of premium bonds, over £40,000',"
said Stephen.»

 
What I don't understand is how that's a fraud vector.  NS&I premium bonds
(a kind of government-backed savings account with 'interest' generated by a
lottery-style algorithm, with certain tax advantages because they count as a
lottery not savings) used to be paper things that you could 'hold'.  But
nowadays it's all electronic - it's a savings account in your name
effectively.  So if he did buy £40k of premium bonds, I don't know how the
fraudster would have cashed that out - unless there's some flaw in the PB
system?

Yeah, I'm not sure how it worked either.

I had some PBs until recently and you can only withdraw to a designated
bank account and it takes a couple of days. They do use 2FA, but it was
only enforced (relatively) recently so if the victim hadn't logged in for a
while it might not have been set up.

So given it took 48 hours for him to realise he'd been compromised and he
only had email authentication set up, then the thief could have had time to
change the bank details and then withdrawn the PBs.