Eimear was getting ready for the funeral of a friend’s mother last September when the harsh trill of her home phone broke the morning silence. Slightly exasperated by the intrusion, she was mollified when she heard her husband pick up the receiver. Within just a couple of hours thousands of euro that the couple had saved to pay the bills of their two teenage children – who were looking forward to their first year in college – had vanished from their bank account.
Almost seven months on from that black Friday, Eimear is still beating herself up over what happened. And when she’s not blaming herself, she’s marvelling at the series of coincidences that made the work of the criminals who had targeted her at random so easy.
“Normally my husband [wouldn’t be] in the house at that time and he was actually on his way out the door when the phone rang,” she says. Had he left two minutes earlier, the call may have gone unanswered.
But he was there and he did answer, and while she continued to prepare for the funeral, he called out to her that it was Eir on the phone and asked if they had had any recent dealings with the telecoms company.
As it happened the couple were Eir customers, and by complete coincidence, they did have a problem with their broadband. Not only that but just days earlier Eimear had been in touch with the company to highlight the problem and was half-expecting a call back.
“When my husband called out to me, I was a little exasperated, to be honest, and quite distracted because I was getting ready to go to the funeral,” she says. “So I shouted down that we had an issue with our wifi but that he would have to deal with the call as I was busy.”
So her husband spoke to the person on the other end of the line – who appeared to be in a call centre in India – for several minutes.
“Then I heard him say to the person on the phone that I was going to take over the call as he had to go out and then he called me to come on the phone.”
Eimear's husband wasn't making up a pressing need to be elsewhere just so he could get out of a dull conversation with an Eir rep – he did actually need to leave their Mayo home for a scheduled trip to Dublin, where he was due to spend the weekend.
So Eimear grudgingly took over the call when she heard the voice on the other end of the line. Nothing about it seemed unusual. She says it appeared clear that the person she was talking to was in a call centre and there were all the murmurs and background noise you might expect from such a call.
Bad news
The man she was speaking to had good news. He said Eir had identified what the problem was with her broadband and he explained she was not on the correct IP address.
“The conversation went on for a long time, and he said the problem would be easy enough to address once they dealt with the IP issue,” she says.
“Because I came to the phone call halfway through it, I don’t think I was really on the ball and was definitely distracted but I was also delighted that the broadband issue we had had was going to be fixed and the wifi would be back to normal,” she says.
Then the tone of the conversation changed suddenly, and Eimear was told there had just been a “breach in our security and I was told that my personal and financial details had been hacked. I was totally hooked at that point,” she admits.
I was completely frazzled and spun out with it all
She was put on hold so she could be transferred to another call centre operative – one who could deal with security issues, she was told. There were repeated references made to the National Crime Agency in the UK, and she was told to take a few minutes off the call, while the man stayed on the line to look up the NCA website so that she could be certain everything was above board.
She did that and was quickly able to establish that the National Crime Agency did in fact exist. She even called up to her teenage daughter and got her to check the bona fides of the site on her phone. Everything looked to be in order. Then she was asked to download a piece of software that would give the authorities remote access her laptop to they could run a sweep and trace the criminals.
As it happened, on RTÉ's main evening news the night before, Eimear had watched a report about a major cyber fraud operation in Ireland, "and I made a link between the two things," she says.
She was also still under pressure and still needed to get to the funeral, “but they kept stressing the gravity of the situation and the urgency so I downloaded the software”.
Access to everything
Suddenly the callers – whoever they were – had access to absolutely everything she did on her computer, and they could follow every key stroke. But they needed just a bit more than that.
As the call dragged on, Eimear recalls asking how she could be sure she was not talking to the hackers. “I actually asked the question but I didn’t break off the call and to be honest that’s one of the reasons it is so difficult for me to get past this. I was suspicious and yet I went along with it. I’m really ashamed to tell you that.”
Then the people “running the checks” on her laptop asked her to go into her email and into her online banking to make sure everything was in order. They did not ask for any personal details or any details of access codes for her online banking.
They didn’t ask because they didn’t need to – as she typed they could see exactly what she was doing.
“I was completely frazzled and spun out with it all,” she admits.
Her two children were to start college the very next week, which was why she and her husband had lodged just over €15,000 in their current account only days earlier. With the call now reaching the two-hour mark and the funeral due to start, Eimear told them she had to go. They said they needed 24 hours to make sure everything was okay with her computer system and they warned her “not to discuss what was going on with anybody because now I was under threat by people who are operating on the dark web”.
Really suspicious
They said they would call her with an update the following morning and they assured her everything would be resolved.
“I hung up and went to the funeral but that evening I was really nervous about the whole thing. My husband was in Dublin for the weekend and I told him what had happened and he was really suspicious. I didn’t sleep that much that night, and then at five o’clock in the morning I just sat up in bed and realised I needed to go to the guards. But I waited for the call back from these people and sure enough at 10am the call came.”
The callers said they were still working on the problem but Eimear was by that point very suspicious. The call ended and minutes later her mobile rang. It was her husband and he was calling to say that €15,000 had disappeared from their account the previous afternoon.
I said we had been the victim of fraud and the woman in the bank said: 'Lovely, we can sort that out for you.'
She went straight to nearest Garda station.
“That was a whole new set of disappointments,” she says. “My uncle is a guard and I have great respect for the guards, but it was very disappointing. First they just said it was out of their jurisdiction and there was nothing they could do. They just seemed to be intent on lowering my expectations and they told me I would have to go to the bank.”
She stood her ground and said a crime had clearly been committed. “The guard said I should go home and have a glass or two of wine and try and relax and go to my bank on Monday morning,” she says. “Now I know he was trying to be nice but I was just so angered by it – not least because I don’t drink and never have. I was told to come back on the Monday evening to make a statement.”
On the Monday morning she went to her bank, still optimistic that the money could be recovered because it was so clearly fraud. She and her husband queued in a branch largely devoid of staff, getting more anxious with each passing minute. Eventually it was her turn to speak to a human being.
“I said we had been the victim of fraud and the woman in the bank said: ‘Lovely, we can sort that out for you.’”
Eimear was almost rendered speechless. “Did you just say ‘Lovely?’ I asked. To be honest, I was welling up at that point.”
‘The money was gone’
Eventually she and her husband were brought into a smaller office where they could talk in private but “the person really didn’t know what to do and didn’t even know the number of their own fraud office”.
Time passed and eventually it became clear that €10,000 of the couple's money had been transferred to bank in Lisbon, with €5,000 transferred to an AIB account. "But because it all happened on a Friday morning and this was now Monday morning, the money was gone," she says.
The bank assured the couple that they would do everything in their power to get the money back, and she did get several calls from senior people on its fraud unit, but eventually she was sent details of a victim impact number and told there was nothing more the bank could do and that the case was closed.
She was told she could contact the Financial Ombudsman if she was unhappy with how the case had been handled. She has done that and is waiting to see how the cards fall.
“I know I made a mistake and I know that I was stupid, and I have to live with that, but I do have issue with how the whole thing is dealt with,” she says.
She questions whether local Garda stations are best equipped to deal with cyber crimes of this nature and wonders why the banks don’t have proper anti-fraud systems in place that could have flagged the two withdrawals as highly unusual and therefore suspect.
“We have lost €15,000 and that money was to be used to used to cover the costs of our two children starting college. It is a massive amount of money and we had to earn €30,000 to save that. It is gone now and I don’t think we are getting it back, but this sort of crime is happening to a lot of people and I just want to warn them. I would hate someone else to go through what I have gone through”.
