Chapter Fourteen
Leo lounged on the terrace of Villetta Nascosta, doodling on his notepad and occasionally staring at photos of Hotel Casa Leonardo and hearing again Jade saying that she’d miss him.
He still hadn’t made an offer on Hotel Casa Leonardo. Nor completed a mortgage application. Nor slept well.
He couldn’t unstick his heart from Como. If he stayed, was there anything to be resurrected between him and Jade? If there wasn’t, he would have sacrificed a perfect business opportunity . . . and would still want to get away.
He opened his banking app to check his UK savings account balance, as the monthly interest should have been applied.
And, of course, the app picked now to demand his password rather than accepting facial recognition.
Impatiently, he tapped it in, sighing when he received a try again message.
Then, when he’d tried twice more with the same result, a new message told him that he’d been locked out and he should contact his bank.
‘Vaffanculo,’ he muttered, as he telephoned the number, and only became further irritated at the bank’s agent, a man, wanting to drag him through security procedures. ‘Can’t I just choose another password?’ Leo asked. ‘Send me a link or something.’
The operative refused to be ruffled, guiding him courteously through the irritating rigmarole, including his current codice di avviamento postale, the equivalent of the UK’s postcode, his full name, date of birth and the answer to his security question.
Finally, the unseen man moved things forward. ‘Could you give me some idea of the balance you’d expect to see on your account, Mr Sartori?’
‘It was just short of half a million pounds last time I checked, but interest should have been applied.’ Leo closed his eyes and wondered how Jade was this morning.
Always having known her family history, he’d some idea of what a disorientating shock it would have been for her mother to stroll into Pensione Three Sisters.
‘Sorry to keep you,’ the bank employee said in his ear. ‘I need to consult a colleague.’
‘Why?’ Leo asked. But canned music was already assaulting his senses. Growing more annoyed by the moment, he put the call on speaker and balanced the phone on his pad while he doodled a pattern in the margin. A geometric pattern to illustrate how spikey he felt.
Then the canned music ceased and a woman’s voice took over the conversation.
‘Mr Sartori? Your call’s been passed to me and I’m going to see how I can help you.
’ She hesitated. ‘The concern is that your account stands at zero. I believe you told my colleague there would be a much higher balance, but those funds were removed in increments over three days, fifteenth to seventeenth of August.’
Leo’s voice stuck in his throat. His gaze fastened on the phone screen as if he could change the words emanating from it by sheer force of will. Zero? ZERO? He felt sick. ‘That can’t be,’ he said, through numb lips.
But, apparently, it could.
And his current account had also been cleared.
The woman remained composed. ‘I can see that your accounts were accessed with your password, in line with properly authenticated transactions. However,’ she said, ‘your password was changed on the same day as the first transaction occurred.’
Numbly, he whispered, ‘I haven’t changed the password.’
‘Did you receive email confirmation of the change?’ she asked.
‘I don’t think so. Hang on, I’ll check.’ Shaking, he accessed his inbox and then his deleted messages and spam. ‘No.’
‘I understand.’ She paused. ‘I need to ask you for information that might help us establish what’s happened.’
‘Can’t you see where the funds have gone?’ he asked sharply. ‘Which bank account and where?’
Pause. He heard the tapping of a keyboard. ‘Have you ever shared your password with anyone else? A family member? A partner? A friend?’
‘Never.’ Sweat oozed between his shoulder blades. Even the shade temperature became unbearable and he dragged himself indoors, where he could switch on the air conditioning.
The questions began to come thick and fast. ‘Do you keep your passwords with your phone? On a notes app? Or in your phone case?’
‘They’re in a book, but usually I use facial recognition.’ Instantly, he wondered whether keeping a book was wrong.
More keystrokes. ‘Do you know the whereabouts of that book now?’
‘Yes.’ Of that he was confident. It was on the breakfast bar, blue and dogeared. ‘I can see it from here.’
‘Might anybody living with you have access to that book?’ asked the woman’s disembodied voice.
‘I live alone now, in Italy, but until a few weeks ago I was based in the UK. Mostly, I lived with my girlfriend. And her dad was around. We had accommodation at the business we owned.’ He crossed to the sink and ran cold water, scared he might pass out.
He filled a glass and flopped onto a bar stool, leaning his forearms on the cool work surface.
A pregnant pause. ‘Were there many people coming and going?’
He tried to be precise. ‘It was a hotel, so the larger premises, yes. The owner’s accommodation – not so far as I know.’ Despite the heat of the day, his guts were slowly filling with ice.
The bank employee continued to ask questions, clearly aimed at discovering whether Leo had been negligent. Over and over, she returned to the question as to whether Leo had ever shared his password.
‘No,’ he stated clearly, each time. Had he used public Wi-Fi to access the account?
Yes, but he had a virtual private network.
Could he remember responding to calls or texts that might have been scams?
No. Could he have clicked on any suspicious links, even from what appeared to be a reputable source?
He didn’t think so, he was careful. Had his phone or laptop been running abnormally slowly, indicating the possible presence of malware?
No. It was how he imagined it must feel to be interrogated by an ultra-polite police officer.
‘There’s no evidence of hacking or security being bypassed,’ she said again. ‘Could anyone have seen you input your password at any time?’
Anger made Leo’s reply clipped. ‘Possibly, I suppose, but never that I was aware of. As I say, usually, I use facial recognition, but sometimes the software asks for the password instead. You know that.’ A bizarre idea occurred.
‘Unless someone could have held my phone up to my face while I slept . . . ?’
‘Usually, your eyes would need to be visible.’ She sounded more sympathetic now. A few more clicks. ‘I’ve placed the accounts under investigation. I can open a temporary current account to service any standing orders or direct debits.’
Leo felt as if this was happening to somebody else. Someone stupid, who left himself open to disaster by not being aware of phishing scams or how to spot a confidence trickster. ‘Um,’ he said, ‘I don’t know if I have any, now I’m in Italy. So, that’s it then? I’ve lost all my money?’
‘Let’s check for direct debits and standing orders,’ she said comfortably, as if they were working on a puzzle together and his last question was unimportant. It turned out that all that was left was a podcast subscription, which was paid up until New Year anyway.
‘Now,’ she said. ‘Do you have access to a computer? I’d like to talk you through checking your email account for any forwarding instructions.’
‘Yes.’ He pulled his laptop towards him and woke it up. ‘What forwarding instructions?’
‘I’m looking for a reason that you might not have received confirmation of a password change,’ she said.
And when, under her guidance, he burrowed into his email settings, lo and behold, he found an instruction to filter emails from the bank to an email address he’d never seen. Numbly, he read the address out to her.
‘Thank you . . . for what it’s worth,’ she added, as if knowing that such an email address wouldn’t be associated with usable information.
‘After this call,’ she went on, ‘I recommend that you change every password you have. And when you change each password, immediately log out of that app or website on every device you use and log in afresh. Set up multi-factor authentication on all sites and apps, then run software updates on all your devices, to benefit from security fixes. Going forward, it’s advisable to have your notifications turned on for your bank accounts, because that can warn of unexpected activity. ’
Head spinning, he made notes on his pad. ‘This is shit,’ he growled.
‘I understand,’ she answered, not unsympathetically. ‘We’ll report the situation to the police. Please can you report it to Action Fraud without delay?’ She provided a case number.
‘Yes, but what happens?’ he asked blankly, sensing that she was preparing to end the call. ‘How do I get my money back?’
‘We’re beginning our investigation. I know it’s upsetting,’ the woman said gently. ‘And the bank is cognisant of that. But I can’t offer a solution here, today.’
The next hours passed in a daze of disbelief and onerous, pedantic changing of passwords and entering them into a secure password manager app, before contacting Action Fraud. Leo’s blue book of passwords was filled with crossings out.
He researched the relevant terms and conditions, his responsibilities to the bank and the bank’s responsibilities to him, with growing dismay.
It seemed that everything hinged on whether he was judged to have been grossly negligent, but also that there was no clearly defined or generally accepted understanding of the term.
Was keeping his passwords in a book in an unlocked drawer at home grossly negligent, because password manager apps did a better job?
Did that constitute consciously disregarding a foreseeable risk of loss?
He was horrified to discover that there appeared to be more protection afforded to those who fell victim to a scam than to those who were let down by someone they ought to be able to trust.
Eventually, heart sinking at the shitty, difficult conversation in the offing, he telephoned Isabella.