‘Free hamper – just pay P&P’: the scam offers targeting your bank details

There’s no such thing as a free lunch, they say, and the same may be true of hampers, laptops and chainsaws.

Scammers are using emails, text messages and social media adverts promising goodies such as afternoon tea from Marks & Spencer and tools from Screwfix to lure you into handing over your payment card details.

In examples online, victims report free hampers and vouchers from M&S, and Lloyds bank warns that brands including Amazon, Decathlon and Screwfix are being used in the fake promotions.

Lloyds says that between 1 January and 24 April this year, 1,400 of its UK banking customers had made credit card chargeback requests that appeared to be linked to fake subscriptions set up via these scams. It has so far returned £55,000 but suggests that almost four times that amount has been taken.

M&S says the scam using its name has been around for some time and is not related to the recent cyber-attack and the theft of customer email addresses.

What the messages look like

Some are emails telling you that you’ve been chosen to receive a free treat, such as an afternoon tea letterbox hamper or a beauty kit. Others are adverts or social media posts saying the same thing, or suggesting that a retailer is having a clearance and offering free goods. They use stolen logos to convince you that they are legitimate messages from the companies.

Sometimes, the scammers pretend to be a deals website/account that is spreading news of offers, and giving a link to the “deal”.

A fake Screwfix advert. Photograph: Handout: Lloyds bank/Supplied

In an example seen by Lloyds, fraudsters claimed that Amazon has laptops to clear and is giving them away to make space for new stock. A link took people to a site where they were asked to pay £1.87 for P&P. The fake Screwfix advert takes a similar form, saying you have been chosen to take part in a promotion and have won a free chainsaw.

To get your hands on the freebies, you may be asked to do a survey.

What the messages ask for

The scammers are after your card details. After some kind of preamble they will request them, usually saying it’s to pay for postage and packaging. They will ask for your payment card number, CVC and expiry date.

The card details will then be used by the fraudsters, probably to set up a continuous payment authority, which will take a monthly “subscription” fee from you.

One recent victim, posting on the MoneySavingExpert website, says they gave their details but no hamper arrived. “Then a few days later they charged £53 to my card … I contacted my bank and they told me they had blocked this ‘merchant’ from making further charges to my account. However, they continued to attempt to take four further payments, each a few days apart.”

What to do

If you have ever responded to one of these, check your bank and credit card statements. Lloyds says the payments commonly show the code PYD on statements and are often to accounts in Cyprus or Ireland. If you see one of these for a payment you do not recognise, report it to your bank.

In the UK you can forward suspicious emails seeking to get your payment details to [email protected]. Suspicious text messages can be forwarded to 7726. Photograph: Andrew Matthews/PA

In the UK you can forward suspicious emails to [email protected] and suspicious text messages to 7726.