Hamilton Academical FC £989,000 Vishing Fraud (RBS Bank Impersonation)

What happened

Over 9-10 October 2017, fraudsters phoned Hamilton Academical FC's finance department claiming to be RBS cyber-security or fraud staff and convinced the club's sole authorised Bankline user that the club's money was under threat and had to be moved into new "safe" accounts. Across two days the employee authorised transfers reported as totalling £989,000 from three club accounts into 26 recipient accounts, using disguised payment references at the fraudsters' instruction. RBS's fraud controls reportedly suspended the first two payments, £40,000 and £70,000, and the bank contacted the club about the activity, but the employee, still following the scammers' script, told the bank to proceed. The club later recovered about £170,000 through suspended payments, leaving an outstanding loss reported as roughly £800,000 in February 2018. Hamilton announced plans to pursue RBS for approximately half the loss, arguing that the bank's security procedures and duty of care had failed; RBS denied a security breakdown and said the payments had been approved by the authorised user.

How it worked

Over 9-10 October 2017, a fraudster reportedly using the alias "Stuart Davis" phoned Hamilton Academical Football Club claiming to be from RBS's internal fraud investigation team and told the club's sole authorised Bankline user that suspicious activity required funds to be moved into other accounts. The caller cited a fabricated large payment to a fertiliser company in Spain. The employee was walked through moving funds via Bankline into 26 recipient accounts, reportedly using player and football-club names as payment references. The first two payments, £40,000 and £70,000, were suspended by RBS, but the employee was instructed to mislead the bank's security staff and the payments were allowed to proceed. More than £250,000 moved in six payments on the first day, followed by 20 transactions totalling £655,000 on the second day. The caller promised to complete the clean-up and return the money, but the club later realised it had been defrauded.

The lure and the tell

The lure was a fabricated bank-fraud emergency: a caller impersonating RBS's internal fraud team and using the alias "Stuart Davis" claimed that suspicious activity required funds to be moved to other accounts, citing a bogus large payment to a fertiliser company in Spain. The caller promised that the money would be returned. Tells that stood out only in hindsight included requests to move money to other accounts, disguise payment references with player or club names, and continue after RBS suspended the first two transfers and contacted the employee about them.

Outcome

Hamilton Academical recovered about £170,000 of the reported £989,000 through suspended payments, leaving the club roughly £800,000 out of pocket in February 2018 reporting and £830,000 in a March 2018 follow-up. A December 2017 Daily Record report separately said the club sought back about £863,000; the excerpts do not reconcile that figure with the later estimates. In February 2018 the club's board instructed law firm Levy & McRae to pursue RBS for approximately 50% of the loss, reported as £400,000 and later £415,000 alongside the differing loss estimates. RBS rejected liability, stating that the payments were approved by the authorised user and that it had questioned the transactions. BBC reported on 6 February 2018 that RBS had not yet received a formal response from the club's lawyers. In the most recent dated coverage identified here, a Daily Record follow-up dated 22 March 2018, the club's CEO said RBS had refused his request for a daily Bankline transfer limit.

Why it matters

The case is an example of vishing against a business. It illustrates the risk created by concentrating payment authority in one employee and the disputed question of liability when bank controls flag transactions but an authorised employee, under social engineering pressure, tells the bank to proceed.

Defenses

RBS's fraud controls reportedly suspended the first two transactions, £40,000 and £70,000, and the bank said it questioned the activity, but the authorised employee instructed it to proceed. Measures that could have reduced the risk include: (1) dual authorisation or maker-checker review for high-value or unusual transfers; (2) independently calling the bank through a previously verified number rather than trusting an inbound caller; (3) treating requests to move money into a "safe" account or disguise payment references as fraud indicators; (4) applying stronger holds or additional verification when a business account rapidly pays many new recipients; and (5) training payment-authorised staff to recognize urgent bank-impersonation scripts.