‘Can’t you see where the funds have gone?’ he asked sharply. ‘Which bank account and where?’
Pause. He heard the tapping of a keyboard. ‘Have you ever shared your password with anyone else? A family member? A partner? A friend?’
‘Never.’ Sweat oozed between his shoulder blades. Even the shade temperature became unbearable and he dragged himself indoors, where he could switch on the air conditioning.
The questions began to come thick and fast. ‘Do you keep your passwords with your phone? On a notes app? Or in your phone case?’
‘They’re in a book, but usually I use facial recognition.’ Instantly, he wondered whether keeping a book was wrong.
More keystrokes. ‘Do you know the whereabouts of that book now?’
‘Yes.’ Of that he was confident. It was on the breakfast bar, blue and dogeared. ‘I can see it from here.’
‘Might anybody living with you have access to that book?’ asked the woman’s disembodied voice.
‘I live alone now, in Italy, but until a few weeks ago I was based in the UK. Mostly, I lived with my girlfriend. And her dad was around. We had accommodation at the business we owned.’ He crossed to the sink and ran cold water, scared he might passout. He filled a glass and flopped onto a bar stool, leaning his forearms on the cool work surface.
A pregnant pause. ‘Were there many people coming and going?’
He tried to be precise. ‘It was a hotel, so the larger premises, yes. The owner’s accommodation – not so far as I know.’ Despite the heat of the day, his guts were slowly filling with ice.
The bank employee continued to ask questions, clearly aimed at discovering whether Leo had been negligent. Over and over, she returned to the question as to whether Leo had ever shared his password.
‘No,’ he stated clearly, each time. Had he used public Wi-Fi to access the account? Yes, but he had a virtual private network. Could he remember responding to calls or texts that might have been scams? No. Could he have clicked on any suspicious links, even from what appeared to be a reputable source? He didn’t think so, he was careful. Had his phone or laptop been running abnormally slowly, indicating the possible presence of malware? No. It was how he imagined it must feel to be interrogated by an ultra-polite police officer.
‘There’s no evidence of hacking or security being bypassed,’ she said again. ‘Could anyone have seen you input your password at any time?’
Anger made Leo’s reply clipped. ‘Possibly, I suppose, but never that I was aware of. As I say, usually, I use facial recognition, but sometimes the software asks for the password instead. You know that.’ A bizarre idea occurred. ‘Unless someone could have held my phone up to my face while I slept...?’
‘Usually, your eyes would need to be visible.’ She sounded more sympathetic now. A few more clicks. ‘I’ve placed the accounts under investigation. I can open a temporary current account to service any standing orders or direct debits.’
Leo felt as if this was happening to somebody else. Someone stupid, who left himself open to disaster by not being aware of phishing scams or how to spot a confidence trickster. ‘Um,’ he said, ‘I don’t know if I have any, now I’m in Italy. So, that’s it then? I’ve lostall my money?’
‘Let’s check for direct debits and standing orders,’ she said comfortably, as if they were working on a puzzle together and his last question was unimportant. It turned out that all that was left was a podcast subscription, which was paid up until New Year anyway.
‘Now,’ she said. ‘Do you have access to a computer? I’d like to talk you through checking your email account for any forwarding instructions.’
‘Yes.’ He pulled his laptop towards him and woke it up. ‘What forwarding instructions?’
‘I’m looking for a reason that you might not have received confirmation of a password change,’ she said. And when, under her guidance, he burrowed into his email settings, lo and behold, he found an instruction to filter emails from the bank to an email address he’d never seen. Numbly, he read the address out to her.
‘Thank you... for what it’s worth,’ she added, as if knowing that such an email address wouldn’t be associated with usable information. ‘After this call,’ she went on, ‘I recommend that you change every password you have. And when you change each password, immediately log out of that app or website on every device you use and log in afresh. Set up multi-factor authentication on all sites and apps, then run software updates on all your devices, to benefit from security fixes. Going forward, it’s advisable to have your notifications turned on for your bank accounts, because that can warn of unexpected activity.’
Head spinning, he made notes on his pad. ‘This is shit,’ he growled.
‘I understand,’ she answered, not unsympathetically. ‘We’ll report the situation to the police. Please can you report it to Action Fraud without delay?’ She provided a case number.
‘Yes, but what happens?’ he asked blankly, sensing that she was preparing to end the call. ‘How do I get my money back?’
‘We’re beginning our investigation. I know it’s upsetting,’ the woman said gently. ‘And the bank is cognisant of that. But I can’t offer a solution here, today.’
The next hours passed in a daze of disbelief and onerous, pedantic changing of passwords and entering them into a secure password manager app, before contacting Action Fraud. Leo’s blue book of passwords was filled with crossings out.
He researched the relevant terms and conditions, his responsibilities to the bank and the bank’s responsibilities to him, with growing dismay. It seemed that everything hinged on whether he was judged to have beengrossly negligent, but also that there was no clearly defined or generally accepted understanding of the term. Was keeping his passwords in a book in an unlocked drawer at homegrossly negligent, because password manager apps did a better job? Did that constituteconsciously disregarding a foreseeable risk of loss? He was horrified to discover that there appeared to be more protection afforded to those who fell victim to a scam than to those who were let down by someone they ought to be able to trust.
Eventually, heart sinking at the shitty, difficult conversation in the offing, he telephoned Isabella.
She answered in a shriek. ‘Leo, I can’t talk to you now! Somebody’s emptied the business bank account.’
