

Enlarge   Blamed: Camilla Jackson is one of thousands to have fallen victim to a 'phishing' email.



The con usually involves directing people to a fake website, often via a link in an email, where they are told to enter user names and passwords for accounts. Armed with this information, crooks swiftly drain them of money.

New, more convincing forms of phishing are evolving to keep ahead of the high-profile warnings and campaigns.

Camilla Jackson, 38, from Calne, Wiltshire, lost £1,500 because of a ‘phishing’ scam involving PayPal, the online payment company.

She received an email in December, purportedly from PayPal, asking her to log on and change her password. She followed the instructions but what happened next left her panicked.

Camilla, who runs her own catering business, was emailed by the real PayPal to say that it had taken £1,500 from her Lloyds business account and paid it to another PayPal customer. Camilla discovered she had given her password to a fraudster who had used it to authorise the transfer.

PayPal assures customers on its website that help is readily available to victims of phishing.

However, Camilla disagrees and felt dismissed when she raised the alarm. She says: ‘Immediately I was on the phone to PayPal to say this was wrong but they said it was nothing to do with them and I should have known it was fraud. It seemed as if they washed their hands of the situation.’

PayPal says: ‘Like many online banks, shops and services, PayPal can be targeted by criminals who use fraudulent emails to deceive users. We will only ever ask a user to enter personal details on our secure website after they have logged in to their account. We never ask for details in an email.’

Lloyds replaced the money, but delays in signing forms prompted it to retract the refund. Camilla was left confused as she was unfamiliar with the process.

Endless phone calls and form-filling left the mother-of-three angry and exhausted.

‘I just wanted an answer,’ she says. ‘I was so tired of it all and spent hours on the phone.’

Lloyds told Financial Mail that in these instances it refunds customers immediately but requires further information to verify claims.


Camilla’s refund was withdrawn while the bank was waiting for necessary paperwork to be completed. These were submitted and the bank has now reissued the refund.

Others might not be as lucky. Banks pledge to refund victims of fraud with various online guarantees, but it is not a certainty in every case.

Payment services regulations require banks to refund fraud unless they can prove a customer acted negligently or fraudulently, but what constitutes negligence is a grey area.

Terms and conditions for HSBC customers, for example, stipulate that customers must take all reasonable precautions to keep personal security information secret. This includes never visiting an internet banking site from a link in an email.


Fake job adverts calling for ‘money transfer agents’, or ‘cash flow managers’, are snaring unemployed people searching for work.

The jobs ostensibly involve applicants’ accounts being used to move money, in exchange for a fee.

Sometimes applicants’ accounts are robbed. In other cases they are used to move money on behalf of criminals. In one instance, a job hunter was told she could work from home, but would have to deposit cheques, which she believed came from sales she had arranged. More than 45,000 instances of account misuse were identified last year, according to fraud prevention service CIFAS, of which many were thought to involve a ‘money mule’.

Victims could face criminal prosecution and exclusion from the banking system unless it is clear that they  were not wilfully involved.

Hundreds of phishing websites are established every day and each campaign can generate thousands or even millions of emails. Customers of banks and payment services, such as PayPal, are the most common targets.

But it is not just banks that are mimicked. Natural disasters are a trigger for fake charity appeals – exploiting donors’ generosity in the aftermath of a tragedy. Emails appear genuine and can tug on the heart strings. When in doubt, go direct to a known and trusted website instead of using a link in  an email.

According to not-for-profit organisation GetSafeOnline the average loss per phishing scam is £247.

Tony Neate, chief executive of the campaigning and advice group, says people should never give out their user names and passwords. Banks and building societies would never ask for these details in an email.

Online users also need to take greater care with the information they display on social sites such as Facebook and Twitter.

Anyone who has been the victim of internet crime should report their experience to Action Fraud.

Visit actionfraud.police.uk or call 0300 123 2040.