Online punters warned after fraudsters steal £8,000 from couple's accounts

A couple have warned of the potential risks of being defrauded online after close to £8,000 was stolen from a number of their betting accounts this month in the space of just a few hours.

As well as suffering the trauma of having money stolen, the couple, who are longstanding owner-breeders and wish to remain anonymous, also expressed frustration at spending multiple hours with bookmakers’ LiveChat operators trying to recover their funds with limited success.

Six bookmakers – bet365, Betfair, BetVictor, Skybet, Paddy Power and William Hill – were targeted by fraudsters after obtaining the couple’s account information with sums of up to £2,500 removed at a time from the online operators last Monday.

The couple, who had built up the totals in their online accounts primarily as the result of good performances from their horses and have reported the crime to Action Fraud, stated that only their William Hill account had not been compromised, while Skybet returned the funds “within 24 hours with no quibbles”.

The couple said no two betting accounts carried the same username or password, and indicated their alarm at the ability of the fraudsters who compromised their accounts to be able to add new bank card details and answer security questions when changing details on the sites.

Explaining what happened, one of them said: “We had a number of emails from betting companies telling us our passwords had been changed. [The fraudsters] changed the email to one that was very similar to ours – a hotmail address instead of aol – and updated the bank card details before withdrawing the money. From two of the accounts they withdrew £100 to our own bank account then sent the rest somewhere else and cleaned us out.

“Someone had managed to answer our security questions too. Things like ‘mother's maiden name’ or date of birth I suppose can be found, but one of our questions was my wife’s father’s nickname – how did they manage to answer that?”

He added: “We won’t be the only people this has happened to and we wanted to warn people that this can happen.”

A spokeswoman for Flutter Entertainment – the parent company of Paddy Power, Betfair and Skybet – declined to comment on the case but insisted the brands had robust anti-fraud measures in place.

A source familiar with the operators outlined a belief that the couple had been victims of ‘credential stuffing’, a type of cyberattack which steals usernames, passwords and email addresses that can then be used to imitate individuals online, rather than the individual betting accounts being hacked.

The couple confirmed that funds from the majority of bookmakers had now been returned, but felt their initial experience with online customer service agents through LiveChat functions, the initial point of contact for the majority of bookmakers, compounded their frustration and distress at being victims of crime.

“You never speak with the same people on LiveChat so you don’t know what’s being done or being changed,” said one of the couple. “My wife has spent 17-18 hours on LiveChat in the last week and they didn't seem to understand what had happened.

“If we’d have known who we were talking to, if someone could have rung us to begin with and gone through it, it would've helped so much.”

Latest stories:

Sean Levey to miss Ebor meeting after appeal against ban fails

Great Voltigeur favourite Alenquer to contest York's Juddmonte International

David Probert in dreamland as he rides first career five-timer

Oli Stammers: I can't really remember anything from the fall and the days afterwards

Derby runner-up Mojo Star faces three at Newbury as he seeks first victory

For all our exclusive free bet offers and must-have daily promotions click the free bets button or go to racingpost.com/freebets