I sometimes think that being a scammer is one of the most lucrative ways to make money for relatively little risk in the UK. I don’t mean to be flippant about fraud – it’s a horrible, insidious crime that ruins lives. However, far too few scammers are made to pay for their actions. And there are literally millions of attempted scams each year.

According to UK Finance, fraud losses in 2021 totalled £1.3 billion with £1.4 billion in attempted fraud prevented. That’s just reported fraud, and Stop Scams UK tell me that the real figure is probably closer to £4 billion. In short, fraudsters lurk around every corner. So we need to be prepared.

Lately, my inbox has been filled with horror stories from readers who have been conned by ‘hi mum / hi dad’ WhatsApp scam messages. Action Fraud said £1.5 million was lost between February and June last year to this con. However, I suspect the actual figures are much higher – especially as there has been a surge in complaints over the last few months.

So what is the Hi mum, hi dad scam, what other WhatsApp scams are out there and what does the law say when it comes to refunds? Here’s my guide.

Hi mum, hi dad

The hi mum, hi dad scam is actually an evolution of a scam that’s been circulating for well over a decade now. It used to be known as the ‘friend in need’ or more basically the ‘impersonation’ scam, which are good descriptions of how the con works. Fraudsters used to target people through emails, then through ‘spoofed’ text messages (using technology that makes a number look like it’s from a business or someone you know). Now WhatsApp seems to be the preferred method.

Many people assume that because WhatsApp is encrypted, it’s not possible to use it to commit fraud. Now it would be irresponsible for me to tell you precisely how fraudsters and scammers get access to your WhatsApp or use it to send fake messages, but let’s just say that the options they use are both simple and horribly ingenious.

The scam works when you receive a message from a family member or friend (hence the name). The messages usually start with a reassurance text, something like ‘hi mum, this is my new number’. The messages then continue ‘I lost my phone/my phone isn’t working’.

What happens next depends on the variation of the scam. There’s usually a suggestion of an emergency situation – but not one dramatic enough to make you call the number. You might be asked to lend some money to repair a broken phone or pay a bill that the sender is struggling to pay at that moment in time. The scam works by playing on our emotions and desire to help the people we love. When we hear from a friend or relative in need, it’s natural to not question. If the fraudster makes it easy to transfer the cash you can find yourself conned in minutes, all from the comfort of your own sofa.

And here’s the rub. When you send money by bank transfer or wire transfer, it’s usually very difficult to get back, if not impossible.

What’s the law on this?

Banks, building societies and card providers have traditionally put the responsibility for preventing fraud on to their customers. This is deeply unfair – and I’ve been campaigning for this to change for years. Good news may be on the horizon, but right now, the rules are still arguably in the bank’s favour.

The T&Cs of most bank and card accounts generally say you must take ‘reasonable’ care not to allow your card or account to be compromised. That includes leaving your card somewhere, giving it to a friend, not checking transfer details or sharing log-in information. Of course, ‘reasonable’ is a subjective term and lots of the people I speak to report differing results when trying to get money back that they’ve been tricked in to transferring.

T&Cs are constantly evolving, so if you haven’t checked yours for a while, I’d recommend you do. You’ll discover that as certain types of fraud become more widespread, the T&Cs have changed to reflect this – and the circumstances under which refunds will be given.

However, there is considerable inconsistency both between banks and sometimes within individual banks when it comes to refunds. For example, becauxse you’ll now be asked to check bank details before you transfer cash and confirm that you know the recipient, a bank may argue that you’ve had ‘fair’ warning before you made a payment and refuse to refund anything you’ve authorised on the phone, via a link or through online bank.

However, it’s being reported that the Financial Services and Markets Bill – which has been trundling its way through parliament for years now – will make both the bank that sends money and the one that receives it increase consumer protections and refund in many cases where people are tricked in to transfers. Of course, it’s not as simple as that, as you’ll see in the rather dry Government report.  In short, refunds rights due to improve (possibly) but for now it’s the same service as before.

Other WhatsApp scams

Of course, where there’s a weakness in security, scammers will keep exploiting it. There are lots of other variations on WhatsApp scams doing the rounds at the moment. A alternative version of the impersonation con is the ‘six-digit code’ scam. This is where a ‘friend’ messages you with a six-digit number asking you to confirm it for them as they are locked out of their phone/account/other password protected portal. Only this is a code generated to unlock your phone/account/other password protected portal. Once in, they can try to get your personal details or scam your own WhatsApp mates.

There’s also been a rise in ‘fake offer’ WhatsApp scams. This is where a (hacked) friend sends you a link to an offer, vouchers or a free giveaway. This is pretty low-tech. You click the link and the fraudster cleans you out. A worryingly large number of people I know were suckered in by a deal for a free cooler full of a certain lager over Christmas. Yes, it was too good to be true.

Then there are the official-looking messages from banks, retailers or e-payment services telling you your account has been compromised. These cons work on the ‘split-second’ principle. They catch you in a moment of weakness. You click the link to find out more. You’ve filled out your personal details before you’ve had time to realise what you are doing. No legitimate business will text or message you and ask you to click a link to a website. If you are contacted legitimately, you’ll be told to use your regular phone or website details to check your accounts.

Getting help

If you have transferred money or accidentally given access to your accounts, then contact your bank as soon as possible. You can call them direct or through the free 159 number if you can’t remember the card providers. This service will connect you to your bank’s fraud team. The sooner you seek help, the better your chances are of getting your cash back.

If you’ve been conned, then get a crime reference number. Yes, I know you might not get anywhere. But it demonstrates that you are being honest about the situation and the stats are vital when it comes to demonstrating the scale of fraud in the UK. Take some time to note down exactly what you remember about the fraud and how you were contacted, along with how quick you reacted.

If you’ve made a complaint but you aren’t getting a refund, the free Financial Ombudsman can assess your complaint. The Ombudsman has made its view on fraud and refunds clear to financial service providers over the years and regularly upholds complaints rejected by banks and card providers. Forewarned is forearmed, so check out their guide here first.

Featured in Times Money Mentor – Martyn James

How a WhatsApp scam could change your fraud refund rights

Please share me around

Share useful info with your friends