The Friday Afternoon Safe-Account Call
At 4:12 pm on a Friday, a 78-year-old customer calls the fraud line. She says she received a call from 'her bank's security team' about a fraudulent £28,500 payment and was told to move her money to a 'safe account.' She is upset, says the caller knew her date of birth and last four digits of her card, and that she has already given a one-time code. She insists she needs to send the £28,500 now to 'protect' her savings. You see a new payee added 22 minutes ago, a device change 3 days ago, and a £1 test payment to the same payee. The customer's voice is shaking. She has £31,000 in the account. The payee account is at a different bank and the name doesn't match the 'safe account' story.
1. What immediate actions should the fraud analyst take, and should the £28,500 payment be executed?
Read the worked answer
Do not execute the payment. Treat it as an active authorised push payment (APP) scam.
Immediate actions:
- Place a hold or block on the outbound payment and on the new payee; freeze online access if necessary to prevent a second attempt.
- Calmly tell the customer you are securing the account, not that she is 'wrong'; avoid blaming language.
- Check whether the £1 test payment left the account and whether any other payees were added.
- Preserve the call detail records, device fingerprint, IP address, payee details and the customer's narrative.
- Escalate to the fraud manager and, if the receiving bank is known, contact its fraud team to request recall.
Reasoning: The indicators are cumulative: new payee 22 minutes ago, device change three days ago, a test payment, a caller who knew card and date-of-birth data, and urgency to move funds to a 'safe account.' A genuine bank would not ask a customer to transfer money to a safe account. The customer's insistence is itself part of the coercion; the bank's duty is to protect her, not to follow the instruction.
2. How should you interview the customer to confirm the scam and support recovery?
Read the worked answer
Approach:
- Use a calm, non-judgmental tone; shame and urgency increase the chance she will disengage and call the scammer back.
- Ask open questions: when did the caller first contact you, what number appeared, what exactly were you told to do, did you give any codes or allow remote access?
- Separate facts from instructions: 'Did the caller tell you not to discuss this with the bank?' A yes is a strong indicator.
- Check for remote-access software, new email rules, and whether her date of birth or card details were read back to her.
- Do not promise recovery; explain the recall process and timescales.
Reasoning: The interview is evidence gathering, not a test of the customer's intelligence. A confrontational approach may cause her to withdraw the complaint or re-contact the fraudster. Document her exact words; they support the fraud report and any reimbursement claim.
3. What reports and notifications are required, and what should be recorded?
Read the worked answer
Reports:
- File an internal fraud incident report the same day; record the attempted loss, the hold, the payee, and the customer contact.
- Report to the receiving bank and request a recall/hold; if funds left, follow the bank's APP recovery process.
- Report to the relevant national fraud reporting centre (e.g., Action Fraud or local equivalent) and consider a Cifas/industry fraud marker if policy allows.
- Consider a SAR/STR only if there is suspicion that the account is being used to launder proceeds; the primary report here is fraud, not money laundering.
Record:
- Timeline, call recording reference, device and IP data, the £1 test payment, the hold decision, and the customer's statements.
- The rationale for not executing the payment, including why the 'safe account' story was not credible.
Reasoning: Reporting is not a single form. The bank must protect the customer, preserve evidence, alert the receiving institution, and meet its own fraud and AML obligations without conflating them.