Bank Fraud-Team Impersonation Vishing Drains Scottish Small Businesses: Perth (£31,000, 2019) and Handmade Craft House, Dumfries (£5,000+, 2026)

What Happened

Two separate but structurally identical bank fraud-team impersonation vishing incidents against small Scottish businesses. In February 2019, an unnamed Perth business received a call from someone claiming to be from Bank of Scotland's "fraud squad" who said the account needed urgent securing due to an allegedly fraudulent pending payment; the business transferred £31,000 to the caller. In January 2026, Mike Dixon of Handmade Craft House in Dumfries received a nearly two-hour call from someone claiming to be his bank's "fraud prevention team," who cited accurate account-balance figures, warned of hacking, pressured Mike to move funds to a "safe" account, and told him not to use his own phone; a second caller then posed as a building society representative to extend the fraud. The family's business and savings accounts were drained, with a net loss of over £5,000 after a partial bank refund.

How the Attack Worked

Two separate, structurally identical vishing incidents against small Scottish businesses, three years apart, both using bank fraud-team impersonation to induce an "urgent protective transfer."

2019, Perth: A caller phoned an unnamed Perth business claiming to be from Bank of Scotland's "fraud squad," stating the account needed to be secured immediately because of an allegedly fraudulent pending payment. Believing the call, the business transferred £31,000 to an account the caller controlled. Police Scotland (PC John Morrison, Preventions and Interventions team) later confirmed the case publicly and noted it followed a separate ~£1,000 fake-invoice fraud against another Perth business weeks earlier, prompting a police warning to local businesses.

2026, Dumfries (Handmade Craft House): Mike Dixon, 66, who runs the handcraft business with his wife Gail, daughter Gemma, son-in-law Tim Riddiford and two grandsons, took a call on a Monday afternoon from a man who introduced himself as being from Mike's "bank fraud prevention team." The caller said the account was being hacked and that funds needed to be "safeguarded," and demonstrated apparent legitimacy by correctly stating how much money was in the account and how much was "at risk." The call lasted roughly one hour 40 minutes, during which the caller pressured Mike to move money into a supposedly safe account, and warned him not to hang up or use his own phone because "hackers" would intercept the line. Once the business account (and some savings) had been drained, a second caller phoned pretending to be from the building society holding a separate savings account, reinforcing the false premise and attempting to extend the fraud to Mike's personal savings. Suspicion only grew when Mike borrowed his son-in-law's phone to call the bank independently and was told he had been speaking to a scammer.

The Lure & the Tell

The lure in both cases was a phone call from someone claiming institutional authority over the victim's own money: "fraud squad"/"fraud prevention team" staff calling to protect the account from an active or imminent theft. The 2026 caller heightened credibility by reciting specific, accurate account-balance figures and by sustaining a calm, "professional... as though he was a banker" tone for nearly two hours, per victim Tim Riddiford's account: "The people that do things are very good at mind games and using suggestive wording. It's like sleight of hand, very measured conversation. They suggest things and then bring it back around to you." The tell that should have broken the spell in both cases was the same one banks and police publish: a genuine bank or building society will never ask a customer to move money into a different "safe" account, and will never instruct a customer not to hang up or not to use their own phone. In the 2026 case, the arrival of a second impersonator (posing as the building society) to extend the fraud to a separate savings account was itself a signal of a coordinated multi-caller scam operation rather than a single rogue employee.

Outcome

2019 Perth case: £31,000 was stolen and, per the available Daily Record report, was not recovered; Police Scotland opened an investigation and publicly appealed to any other victims of similar scams to come forward. No arrest or prosecution has been reported. 2026 Handmade Craft House case: the family's business and personal/savings accounts were drained; the bank later returned some of the money but the family was left with a net loss of "over £5,000," which the bank told them was not its responsibility to cover. The family publicly appealed for help via a GoFundMe and BuyMeACoffee page, describing the theft as wiping out their Christmas-season revenue right at the start of the year's quietest trading period, and said it forced them to cancel planned expansions (craft courses, new product lines) because they could no longer afford related insurance and costs.

Why It Matters

These two cases, three years apart but structurally identical, show that classic bank-impersonation vishing remains effective against small, resource-constrained businesses that lack dedicated finance/security staff and cannot easily absorb a five-figure loss. The 2026 case is notable because the caller demonstrated accurate knowledge of the victim's account balance, which is a credibility signal that pushes past the "would my bank really know this / call like this" skepticism that basic security awareness training relies on; combined with a near-two-hour call designed to prevent independent verification, and a second impersonator call to extend the fraud into a separate account, it illustrates a coordinated, multi-step operation rather than a single opportunistic call. Both banks involved ultimately treated most or all of the loss as the customer's responsibility (no recovery reported in 2019; partial-only refund in 2026), underscoring that authorised push payment fraud largely falls outside standard fraud-reimbursement protections when the customer was the one who initiated the transfer, however convincingly they were manipulated into doing so.

Defenses

Both banks' own published guidance (Bank of Scotland) and Police Scotland state the core defense clearly: a genuine bank will never call and ask a customer to move money to a "safe account," and any call urging an urgent transfer should be treated as suspect regardless of how much the caller already knows about the account. Recommended controls, drawn directly from the police and bank statements in the sources: (1) hang up and call the bank back using a number from a card, statement, or the official website, never a number given by the caller, or dial 159 (UK bank-verification hotline) or 101 (non-emergency police); (2) use a different phone line/device to call back, since scammers can stay on an open landline line pretending the call has ended; (3) treat "don't hang up, hackers are listening" or "don't use your phone" instructions as a scam script, not a security measure; (4) verify unexpected invoices/payment-detail emails by phone via a known number before paying, since related email-invoice fraud (Perth, ~£1,000) hit the same town weeks before the £31k case; (5) businesses should have a second-person sign-off requirement for any "urgent" fund transfer request received by phone; (6) report suspected scam calls to Action Fraud/Police Scotland (101) even if no money was lost, to help build pattern intelligence, since police in the 2019 case explicitly asked prior victims to come forward.