They used to say: “Watch out, there’s a thief about!”
Nowadays, a better slogan might be: “Watch out, there’s a thief in your phone!”
Why do I say this? Here’s why.
A few weeks ago I received a telephone call from a man claiming to be DCI Paul Graham, who said he worked for the National Fraud Department of the Metropolitan Police.
He wanted me to know that one or both of my bank debit cards had been compromised that morning.
According to Graham, someone had used one of my cards to make a £699.00 purchase in the Apple store in London’s Covent Garden, and had then used either the same card or the other card to make a substantial withdrawal from the cash machine at Sainsbury’s in nearby Holborn.
When I asked him for some more detailed identification, he repeated that he worked at the National Fraud Department of the Metropolitan Police, that he was based at Holborn police station, that his badge number was EK350 and that I could dial 101 and someone at the Met would confirm that he was a regular policeman.
What would you do, under the circumstances?
I dialled 101 and someone did, indeed, confirm that DCI Paul Graham, badge number EK350, worked in the National Fraud Department.
I was nevertheless still suspicious, so Graham suggested I call the number on the back of my debit card and ask my bank to confirm that he, Graham, was a bona fide policeman working for the Fraud Department. They would know, he said.
I dialled the number and was told that Graham was bona fide. I was asked if I had given him any of my personal details and, when I said no, was told that was a good thing.
I remember that, in the course of this call, I wasn’t asked any security questions. Doh!
As soon as I hung up, Graham was on the phone again, this time telling me I shouldn’t be so suspicious; that it had been confirmed by two people that he was a genuine policeman; and that I should believe he was only trying to help me.
Although his plausibility was doubtful, I remember thinking he might be OK when he gave me what he called a Crime Reference Number – CE030917085826 – and a package reference number, PK350.
He also asked me to turn off my computer’s router, which I did.
He then asked me to check to see if either of the chips on my bank cards looked in any way damaged.
I told him they didn’t, at which point he said both of them would still have to be analysed by someone on his team and that, in order for this to be done, both would have to be collected and taken to Holborn police station for examination.
“Only trying to help”
I had, by now, started to get much more suspicious and somewhat distraught, especially when Graham kept repeating that he was only trying to help me, which I had begun to doubt, and constantly prevented me from saying anything to him by talking across me.
“Bear with me,” he kept saying. “Bear with me. I’m only trying to help you.”
Believe me, if this ever happens to you, you’ll know how cleverly persuasive these guys can be.
Graham’s next ploy was to tell me that, if his team were to succeed in their examination of my cards, they would have to know the PINs and, please, would I put them into my telephone keypad.
I initially refused, as any sane person would. But, when he repeated, persuasively, that he was only trying to help me, and only trying to prevent any further fraudulent use of my cards, I reluctantly agreed and punched the PINs into my phone.
At this stage I’d become so distraught and malleable that, had he told me to shoot myself in the foot, I’d have asked him to wait while I went and bought a gun.
Instead, he told me to put the two cards into an unmarked envelope, seal it and a courier would come to my house and collect it.
I asked him how long that would take. He said it would be about fifteen or twenty minutes.
“Have a cup of tea”
By this time I was beginning to get very distressed by the whole experience, so he suggested I put my phone onto speaker mode so that I could – as he suggested – go and get myself a cup of tea and “relax”. With the phone on speaker mode, he said, he would still be able to keep in touch with me.
I didn’t make a cup of tea, but I did hear Graham saying the courier was now only six miles away.
Then he said he was only two minutes away.
When I asked how I was supposed to recognise him, Graham said he would be from Express Couriers and that he would ask for package 242. I was not, under any circumstances, to hand over the envelope unless the courier asked for package 242.
A few minutes later the courier arrived at the house. I live on the ground floor of a converted terrace house, so I let him into the common hallway.
The ‘courier’ was probably no more than 18 or 19 years old, about 5’ 6” tall, of Indian or Pakistani origin, with black hair and a young man’s beard. He was wearing black clothes and carrying a black backpack. This much I remember.
When I asked him for some form of identity, he simply said he was from Express Couriers and that he had come to collect package 242.
I asked him again for some identity and again he said no more than that he was from Express Couriers.
I said something along the lines of “No identity, no package” and he again said only that he was from Express Couriers.
“Give him the envelope”
Graham was still on the phone, so I told him the ‘courier’ was here and he said it was OK, I should give him the envelope.
Foolishly, I did, and the ‘courier’ immediately left the house.
When I picked up the phone, I could hear Graham laughing like a maniac, saying something like “That was a good fraud, eh? Now I’m going to take fifty grand off you! A good fraud, eh!”
At this point I completely lost my self-control and, because yet again he was talking across me, I screamed at him to shut up.
He just went on laughing at me.
In my rage, I told him he was nothing more than a common criminal and that, if he was ever caught, I would personally make sure he was thrown into hell where I would light – and stoke – the fires myself, forever.
After a few moments, he hung up.
As soon as I could, I rang my bank and, after answering the necessary security questions, reported the whole incident, including the fact that I had re-started my computer and could see on the screen that, by using the stolen bank cards at 11:58 and again at 11:59, someone had accessed the cash dispenser at the Earls Court branch of Sainsbury’s and withdrawn £300 from each of my bank accounts.
The bank promptly cancelled both my bank cards and then transferred me to a member of their fraud team, who took the details of the whole incident, as best I could remember them.
A complete fiction
I subsequently reported the incident to the Metropolitan Police. After confirming that Graham was not a bona fide policeman, and that his badge number EK350 was entirely fictitious, they arranged for a couple of uniformed policemen to visit me.
When the policemen arrived, I was so unsure of everything I said them: “How do I know you’re policemen? You could have picked up those uniforms in a fancy dress shop.”
It was a relief when one of them showed me his Metropolitan Police badge.
Later that day, about four hours after I’d been the victim of what I now recall as a terrifying fraud, I received three calls on my mobile phone, all from an unknown number.
I rejected the first two but answered the third.
To my horror, it was – or at least sounded very like – Paul Graham, who seemed to be saying he was sorry for conning me but, after all, he had only taken £600 not the £50,000 he had boasted of, so I should be glad to have gotten off lightly.
This time I didn’t say a word, other than hello, but just let him prattle on until the line went dead.
Next time you receive a call from an unknown stranger claiming to be either a policeman or someone working for your bank or credit card company, simply hang up.
If the caller’s genuine, they’ll ring again and you can decide whether or not to speak to them.
If you’re still unsure, hang up again.
Remember: even though you think you might have friends in your phone, you might just as easily have a thief.
Beware. What happened to me could happen to you.