I used to be phoned by somebody from ‘Amazon’ about iPhone fraud – then he scammed me out of £1,200

My Thursday began as most weekdays do with a workout, early school-run and a walk before opening my laptop.

When my mobile phone rang mid-morning, everything shifted, not least because £1,200 later vanished from my bank account. I’d been the victim of fraud.

If, like me, you’ve always thought you’d never be fooled by scammers, I’m proof that even if you think you have read widely about how scammers operate you can be easily duped.

Afterwards, you’ll likely feel (as I did) foolish, embarrassed, furious with yourself and anxious about any monies lost and passwords or other personal details that could have been compromised.

Despite significant efforts to tackle fraud across the finance industry, according to UK Finance, the trade association for the UK banking and financial services sector, £1.17 billion was stolen through fraud in 2023.

So, how did I come to be £1,200 out of pocket?

Let’s go back to that 10.30am call. The man who called me claimed to be from Amazon’s fraud investigation team. 

My Amazon account had been hacked from an IP (Internet Protocol) address in California, he said, before asking if I’d been placing iPhones in my Amazon shopping basket without checking out. I hadn’t.

At this point I should tell you our internet was down, which immediately put me at a disadvantage.

I had to put him on speaker on my smartphone while I used the same device to log into my Amazon account – and, sure enough, there were two iPhones costing £599 and £499 awaiting payment. 

Before my eyes, a third iPhone appeared in my basket. My account was being hacked in real time, but my gut told me there was something amiss.

‘Prove who you are,’ I snapped and calmly he replied that he would text a one-time password (OTP) to my mobile phone from Amazon as a security measure.

Within seconds, a four-digit code appeared in a text from the same Amazon number I’ve received countless previous text messages from to advise about delayed or attempted deliveries.

Disruptions from builders working at the house that morning added to the chaos. 

And that’s precisely when these criminals manage to dupe otherwise smart people like me; if they get lucky and catch you off guard or at a busy or vulnerable moment, they’ll put you in a tailspin and, bingo, they’ve hooked you.

Any other day, I’d have given the man short shrift and put the phone down. Instead, I panicked and made a series of blunders, namely following instructions from him to first download an app called Zoho Customer Assist from the App Store, which he told me would secure my compromised Amazon account.

Next, he talked me through setting up what he said was a ‘safe account’ with Revolut (the global financial technology company which was granted a UK banking licence in July) to ‘protect’ the various mainstream bank cards attached to my Amazon account which I use to pay for goods. I was instructed to put money into the Revolut account to pay for any future goods from there.

Had I paused to think about this, I’d have realised that it made zero sense and hung up.

Instead, he talked me through sending £599 and £499 for the iPhones and another random payment into the new Revolut account to ‘protect’ that money from the fraudsters who he said had hacked my Amazon account. It would, he assured me, be paid straight back into my main bank account.

I received ‘live’ messages purporting to be from the ‘Amazon Secure Server’ telling me that ‘90 per cent of the work has been completed and now we will refund the money’. 

Seconds later, I came to my senses and hung up on the fraudster having yelled a few expletives at him.

Frantically, I checked the Revolut account on my mobile and saw the money had vanished. It was too late. The scammer had set up the Revolut account so he’d had access to it all along.

Terrified of what else he might have access to, I immediately closed and deleted the Revolut account, then the Zoho Customer Assist app.

I then reported the incident to Action Fraud, the UK’s national reporting centre for fraud and cybercrime. 

It issued me with a crime number and reassurance that I’d fallen for a common and sophisticated scam to which countless other ordinarily vigilant, intelligent people – including police officers – have fallen victim.

One scam victim is comedian Simon Evans, who recently shared his own identical experience on social media to warn followers of the Amazon impersonation scam.

His alarm bells clanged louder than mine and at the point that the criminals sent him a one-time passcode pertaining to be from Amazon, he changed his log-in password and hung up.

Reporting the crime to Amazon by phone was impossible. Though I did so by email, I never had a response. Communication with Revolut was only possible via email or an online chat in its app.

Presumably, this is one of the reasons that scammers embroil the likes of Amazon and Revolut, knowing that their victims can’t make a quick call to either company to verify if the person contacting them is genuine or not. 

When I asked Revolut why, a spokesperson told me: ‘Speaking to us via chat means that our customers can be 100 per cent certain they are connected with a member of our team, rather than a caller who may be a scammer.’

Earlier this month, Action Fraud revealed that Revolut had been named in 9,793 reports of fraud in the past 12 months, around 2,000 more than Barclays and Lloyds.

The company now faces questions over the effectiveness of its security controls in spotting what could be suspicious activity on an account.

Revolut has more than nine million UK customers and the company told me: ‘Banks and financial institutions are often the last link in the fraud chain – and so by the time the customer is making the transfer, the fraud has already happened.

‘Banks and financial service providers should be the last line of defence against fraud, not the only line of defence.’

Later investigation found my money had been sent from the Revolut account to an account registered in the name of Manikanta Jannu, a popular name in India.

I needed to speak with someone to adequately convey what had happened and understand what my options were for trying to reclaim the money, but I was told: ‘We can’t talk to you as you don’t have a Revolut account.’

I didn’t have an account because I closed it down the moment I realised I’d been a victim of fraud.

A Revolut spokesperson told me: ‘We are aware that there has been an increase in impersonation scam attempts by criminals and are deeply concerned that large numbers of frauds are being enabled by criminals using fake and spoofed phone calls and SMS messages.

‘Fraudsters take advantage of a psychological factor known as “compliance pressure”, where individuals feel rushed or emotionally manipulated — leading them to act without thoroughly verifying the legitimacy of a request.’

The fraud investigations team at Virgin, my own bank, was incredibly helpful in liaising with Revolut on my behalf. 

Eight frustrating days after the crime, Revolut refunded the funds to my bank account, but not without a battle.

With effect from October 7, new rules set by the Payment Systems Regulator (PSR) came into force around fraud reimbursement rules, meaning that more customers will now be reimbursed for Authorised Push Payment (APP) fraud, which occurs when a criminal tricks someone into willingly making a bank transfer to them.

I remain ashamed of my own gullibility, not least making payments in line with the caller’s instructions, money he assured would be returned to my account.

My relief was as colossal as the lesson I learned about trusting my instincts, not hesitating to hang up on someone and never giving out personal information.