Scam watch: conned by a copycat Lastminute.com website

Dear Which?,

Recently, on Google, I found a cloned website that looked like the genuine travel firm lastminute.com. I was completely taken in and booked a trip to New York through the scam website, paying my deposit on my Mastercard. 

The scammers then called me posing as Mastercard and convinced me to grant them remote access to my phone. They deleted my firewall, scanned bank cards from my phone and spent thousands of pounds before the fraud department put a block on my cards. 

I’ve been refunded in full and the affected cards were cancelled and reissued. I’ve also replaced my phone and changed my number and email address. It was a very frightening experience that I wouldn’t wish on anyone, and I want others to be wary as we approach the holiday season.

Name supplied

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

Scam websites

Faye Lipson, Which? senior researcher, says: 

Your case sadly highlights the dangers of scam websites, and tricking us into making payments or providing card details is often just the fraudster’s first move. With the knowledge they’ve gained, scammers can then phone you posing as your bank or provider. That’s why it’s so important to be sure a link is genuine before you click. 

You don’t recall whether the search result you clicked on was a ‘sponsored’ post (a paid advert) or organic. Generally speaking, organic results (those selected by the search engine for their relevance to the search term) are more trustworthy than those that someone has paid to boost to a prominent position. 

If you know a website’s address, or if it’s obvious from the company name (eg ‘lastminute.com or booking.com’), then it’s always safest to go directly to that website by typing it into the address bar of your browser, instead of going through a search engine. Enter the URL who.is into your browser and you can see how long a website has been around by inputting its address. Look at the ‘registered on’ date to get a sense of its authenticity. You would expect a well-known organisation to have registered its site years or even decades ago – not weeks or months ago – so this can be a good way of catching the copycats. 

I’ve encouraged you to report the link to both Google and the National Cyber Security Centre, so they can investigate it and hopefully prevent others from facing the same scam.