Digital bank Monzo is one of the fastest-growing new banks in Britain, opening 750,000 accounts over the past two years. Now, in an extraordinarily candid move for a bank, it has thrown open its doors to Guardian Money to expose the scams and brazen criminality that threaten customers – and how it is fighting back. Some of the scams are shocking, others audacious – and one so simple we are banned from telling you about it.

The student ‘mules’

Students are selling their bank accounts – giving someone else their account details such as logons – for as little as £50 to £100, often as they are finishing university and heading abroad for a period. These accounts are then used by fraudsters to evade the strict checking procedures when individuals try to open an account.



These “mule” accounts are a vital link for crooks moving money around the banking system. A common cry among victims of fraud is that banks must have an electronic record of where their money has gone. The mules are the way stolen money is transferred and laundered through the system.

Sometimes the scamsters ask students for their active cooperation – for example, they will tell them that £20,000 will come into their account and that they should send £19,800 to a different account, often overseas, and keep £200 themselves.

Monzo says it uses artificial-intelligence systems to flag up unusual sums and block accounts. But Tom Blomfield, the bank’s chief executive, makes a plea to students: “Don’t sell your identity. All you are doing is enabling money laundering.”

Students pressed for cash are ’selling’ their bank accounts to fraudsters. Photograph: Anchiy/Getty Images

Transaction attacks

On the Monday morning I visited Monzo’s offices, just 12 hours earlier there had been a “pan enumeration” attack on its computer systems. This is where fraudsters, often based overseas, bombard a bank’s computers, trying to guess passwords and logins, or attempting to do transactions by generating card expiry dates and three-digit CVCs (card verification codes) in the hope that some might break through.

Often the attacks begin in the middle of the night. I was shown a screen of transaction activity that spiked around midnight on a Sunday. Suddenly Monzo was being hit with 100 failed transactions a second. This went on for 10 minutes. I was told that the bank experienced “a few of these every month. Last night’s attack could just be a warm-up,” said an IT expert at the bank.

Monzo is aware that as a challenger bank it is high on the target list for fraudsters keen to exploit any gaps in its defences. But it also has an advantage – its new IT systems are better primed to deter fraud than the legacy systems of traditional banks. Monzo says that following Sunday’s attack it had “new kill switches and triggers” in place within hours.

Blocking dodgy transfers and deposits

One of the saddest scams is when an older person is conned by a cold caller posing as their bank manager. They are told there has been suspicious activity on their account and that they need to switch their money to a safer place. The calls can be frighteningly convincing.

What Monzo sees is the other side of the equation – when a large sum from a big bank is deposited into a Monzo account (which later turns out to be a mule). Using sophisticated machine-learning techniques, Monzo says it is better able to identify suspicious deposits. In one instance, it froze thousands of pounds that had arrived into an account. “We blocked it and contacted the originating bank,” says Blomfield. “But that bank [one of the biggest UK players] said it was all fine. Then it rang a few days later to say it looked like the customer had been conned. Luckily, we were able to return the money.”

Frustratingly, there are few mechanisms for banks to communicate with each other. “In the US, there is a web portal for banks to contact each other on these issues. Here, it’s just email, Blomfield adds. “Sometimes we are even told to use a fax.”

Detecting data breaches

Ticketmaster faced a large number of fraud attempts. Photograph: Alamy

On 6 April, Monzo was contacted by 50 customers reporting fraudulent transactions. This was not remarkable in itself – Monzo has about 750,000 customers – and it replaced their cards immediately. But its financial crime and security team noticed a pattern. “About 70% of those affected had used their cards with the same online merchant between December of last year and April this year,” a Monzo statement said. “That merchant was Ticketmaster. This seemed unusual, as overall only 0.8% of all our customers had used Ticketmaster.

“Within four-and-a-half hours, the team rolled out updates to our fraud systems to block suspicious transactions on other customers’ cards. That evening, we reached out to other banks and the US Secret Service (which is responsible for credit card fraud in the US) to ask if they had seen anything similar. At the time, they hadn’t.”

The following week, it saw four more compromised cards – all had been used at Ticketmaster. “Given the pattern that was emerging, we decided to reach out to Ticketmaster directly,” the statement continued. “On 12 April, Ticketmaster’s security team visited the Monzo office so we could share the information we had gathered. They told us they would investigate internally.”

Over the next few weeks it became obvious that something was happening with cards used on Ticketmaster. Confident that the ticket site had suffered a data breach, the bank contacted Mastercard and replaced every Monzo card – 6,000 – that had been used at Ticketmaster.

Meanwhile, on 19 April, Ticketmaster told Monzo it had found no evidence of a breach. But on 27 June, its customers were informed by that they could be at risk of fraud or identity theft, admitting a major breach had affected tens of thousands of people.

The question is why it took Ticketmaster so long to inform customers, given Monzo’s warnings. Ticketmaster says: “When a bank or credit card provider alerts us to suspicious activity it is always investigated thoroughly with our acquiring bank, which processes card payments on our behalf. In this case, there was an investigation, but there was no evidence the issue originated with Ticketmaster.”

Meet Fraudster No 1

Monzo has identified a fraudster who has taken £40,000 – but the police have so far taken no action. Photograph: Artur Debat/Getty Images

In Monzo’s financial crime unit at its London offices just off London’s so-called “Silicon Roundabout”, he is known as Fraudster No 1. I was shown his picture, name, full address (in south-west London), Facebook page and even photographs of the luxury goods he has snaffled with money looted from other people’s accounts and ostentatiously posted on Instagram. Monzo has shared all these details with the police. Yet this man has not been apprehended. Why? Because, much to the frustration of Monzo’s fraud team, the police are not interested because the sum stolen – £40,000 – is deemed not large enough to bother the authorities.

The man is known as Fraudster No 1 not because of the £40,000 he has stolen, but because he was the first account holder that the bank, which was founded in 2015, identified as a con man.

“He used the dark web to buy a few hundred stolen debit and credit cards,” says Tom Blomfield, chief executive of Monzo. “He loaded cash stolen from those cards on to his Monzo prepaid card, then used that to buy goods. He’s utterly brazen. He has posted on Instagram the high-value electricals he has bought with the money, from stores such as Maplin.

“He has stolen £40,000 from us. We have passed his details to the NCA [National Crime Agency]. It’s so frustrating. He actually poses in pictures with his stolen gear. If someone smashed your windows and stole £40,000 from you, the police would be all over it. But nothing has been done to him.”

In one extreme case, Monzo identified a man who was convicted for card fraud, who subsequently used a stolen debit card to pay his court fine. Unlike Fraudster No 1, at least he has been apprehended.

Monzo suspends or terminates accounts when it identifies fraud, but can’t tell the “customer” of its suspicions. The response from the fraudsters is shocking. “They will go on to their Twitter feed and accuse us of being scammers,” says Natasha Vernier, head of Monzo’s financial crime unit. “We don’t respond. They will call our customer centre and use every trick to try to get them to buckle and reopen the account, so they can continue defrauding others.”

Call centre workers will hear sob stories from crooks who pretend that the account closure is causing them huge grief – to the extent that they even use recordings of babies crying, while screaming down the line that they need the money for baby food. The call centre workers have to stand firm and refuse to reopen the account.

Fancy a £5,000 refund?

Some gangs grab a POS terminal in a shop, run out and try to process a refund outside. Photograph: Alamy

A gang goes into a shop and distracts staff. One of them goes to the point-of-sale (POS) terminal, inserts their card and requests a refund. Monzo says it is aware of merchants losing up to £5,000 in this way, and banks do not cover them for it.

In a more basic version of the fraud, gangs grab a POS terminal in a shop, run out and try to process a refund outside.

Fuelling card crime

Petrol stations can be a target for card fraud – especially at night. Photograph: Alamy

This is an extraordinary new fraud, which relies on petrol stations where there are no attendants – often at night – and where drivers can use a card to pay at the pump.

According to Monzo, it works like this: the customer has a card with £100 in their account. The card reader at the pump pre-authorises the person wanting to fill their car by taking an initial £1 payment, purely for card validation purposes. After that, the driver can fill up with up to £100 worth of petrol. The charge may take a day or two to be deducted from the person’s account. The fraudster does the pre-authorisation again and again, with just £1 deducted each time, until the £100 on the card has been used up. The customer therefore gets 100 times £100 worth of petrol, at a deduction from the card of just £100. Only later is the £10,000 worth of petrol charged to the card, which does not have the funds and is therefore bounced.

Fraudsters are buying vans and retro-fitting them with huge tanks. Monzo says it knows of £56,000 worth of petrol stolen in this way. The loser here is the petrol station as, while the money initially comes off the card, it is then charged back to the forecourt operator.

The police are concerned about the prospect of vans carrying vast amounts of petrol.

Natasha Vernier, head of Monzo’s financial crime unit, says that when other banks spot a new kind of fraud, they can take weeks to put in place technical patches to spot it on their systems. “When we first saw pay-at-pump fraud, we had a new rule in place in five hours,” she says.

Your ears are the giveaway

Monzo says ear positions are the most difficult thing to fake. Photograph: Ben Gingell/Alamy

Monzo requires that new account openers submit a photo of their identity document, plus a selfie video. It sends this to an ID verifier such as Jumio or Au10tix, which have software that checks whether the person in the ID photo is the same as the one in the selfie.

I was shown pictures of one male in his 20s who made four attempts to open an account at Monzo. He was identified as a fraudster on his first attempt. In later attempts his picture changes – it is still him, but with a beard, then a long beard, short hair on top, longer hair on top, and so on. Each time Monzo’s systems identified him – because of his ears. According to Monzo, ear positions are the most difficult thing to fake.