It was a sickening, gut-wrenching moment when, one evening in October 2012, Sally Donaldson checked her bank account and realised she had made the silliest financial mistake of her life.

Two years earlier, hairdresser Sally had organised for her monthly pay, £1,000, to be transferred from her HSBC account to the joint account at Nationwide building society she shares with her husband. But on that October night, the mother of two discovered she had made a simple but calamitous error.

It's a mistake anyone can make. To transfer money online from one account to another, you simply tap in the recipient's name, their sort code and account number. But Sally had incorrectly typed in just one of the eight digits in the account number – and the money was sent to the wrong person.

What makes her story so extraordinary, though, is that she made the mistake in May 2010. Every month since – for more than two years – her pay was going into someone else's Nationwide account. And now, to her horror, Sally is discovering she has almost no chance of getting back a penny of the £26,650 transferred in error.

The recipient took the money, spent it, and is refusing to repay it. Nationwide says there is nothing it can do – and won't tell Sally who the recipient is because of data protection rules.

The fact she correctly entered her surname as the intended recipient at Nationwide, alongside the correct sort code, counted for nothing. When banks transfer money, they use only the sort code and account number – it turns out that account names are irrelevant.

Legally, Sally has every right to demand the money back – no one is entitled to keep money wrongly credited to their account. But getting it back is an altogether different matter.

Many people will sympathise with her over a silly mistake. But most will also wonder how she and her husband failed to notice a missing £1,000 every month. Indeed, Nationwide says it has never before come across a case of "mis-applied credit" that went on for so long.

The answer may lie in the widespread switch to paperless statements, where an account can only be viewed online. Sally did not see a bank statement from Nationwide for the entire period the money was going astray. She kept an eye on the balance when she took money out at the ATM, but that was about all, while her husband, who also paid his income into the account, sorted out most of the bills.

"It wasn't until October 2012 that I discovered the £1,000 was not showing on our joint account's monthly statement. Having moved over to paperless statements in 2010, I had been checking that my wages were leaving my business account held with HSBC at the end of every month. However, to my horror, I now saw they had never arrived in our joint Nationwide account. Scrolling back, the last time my wage appeared on our statement was May 2010.

"I frantically checked my numbers for the bill payment scheme I had set up with HSBC and could see that, on setting it up, I was one digit out … the money has been going to another Nationwide account holder for the past two years, amounting to £26,650!

"The payment was set up clearly to my name, my sort code but with one account number digit being incorrect.

"Phone calls to Nationwide that night, many tears and numerous subsequent calls and letters, have left us with just £1,000 returned and a complete blank of information from Nationwide," she says.

Sally is not her real name, as she wishes to remain anonymous. "We have been reluctant to tell anyone we know about the error, so have dwelled heavily on it ourselves. It leaves a sick feeling in my stomach to think someone has been spending all that hard-earned money and I've been going to work – running my own hairdresser's business – when I could have been enjoying a little more time at home with my two sons."

Sally is not rich. They live in a modest semi, her husband works in the public sector, and they have a joint income of less than £50,000. "We live a simple life; we are quite frugal. We even went overdrawn on that account for a while and cut back as a result."

But what about the lucky recipient of Sally's income? Is there really nothing Nationwide can do to recover the money? The building society says that where money has gone into the wrong account, the law entitles it to take it out again without seeking permission first, up to six years after the credit is wrongly entered. But in Sally's case, the recipient had withdrawn the money through ATMs, so Nationwide could not grab it back.

"By law, a person is not entitled to rely on another's mistake to keep money to which they were not entitled," a Nationwide spokesman says. But he adds: "The final payment transferred was recovered, but previous payments were no longer in the account. The recipient has been contacted and we have established she doesn't have the funds to repay."

Can Nationwide at least see where the recipient transferred the money to? "Unfortunately, there is no trail. The receiving customer simply made regular cash withdrawals rather than transferring monies to another account."

Neither Nationwide or HSBC is prepared to reimburse Sally. They both argue the mistake was the customer's, and that there is a risk of fraud if they were to make repayments to people who credit the wrong account.

Data protection rules make life even more difficult for Sally. Nationwide can only release the name of the recipient if Sally obtains a court order. Sally will then have to decide if it is worth paying to take legal action.

The Financial Ombudsman Service says it receives about 100 complaints regarding mis-applied credit every year, mostly from individuals who have seen money come into their account and want to keep it. The ombudsman nearly always rules against them; just because the bank made a mistake does not mean you can keep the cash. Sally is considering taking her case to the ombudsman, but it says she may not have much joy– it can only rule if the banks acted improperly, and can't take action against the recipient.

If there is a wider lesson in Sally's story, it is not to agree to paperless statements. In November 2012, RBS/NatWest became the first bank to stop posting monthly statements, instead opting for statements every three months. Other banks are expected to follow suit. Critics say going paperless increases the chances that charging blunders, unexpected debits and fraud will go undetected for months on end.

This article originally appeared on guardian.co.uk