Tommy coughed, and looked over his shoulders in both directions, as if to check that no one else could hear them.
"Darling, let's talk about this another time, okay? First of all, let's see where my - our - money has gone to."
Twenty minutes later, sitting in his wife's car on the driveway with Tommy's phone powering from the cigarette socket and on hands-free, they finally got through to someone in the online telephone banking centre. After going through several excruciating rounds of security questions to which Tommy always struggled to remember the answers, the person on the other end of the phone was finally able to identify Tommy and start to have a proper conversation with him.
It then took the man on the other end of the phone several minutes to understand what the problem was, and he had to ask Tommy to calm down several times.
"It's quite simple, I've been robbed. This morning my accounts were full of money, and now they're all empty. Someone has either taken the money, or your systems can't be working properly. Has anyone else reported any problems with their online accounts?" Tommy asked.
"Not that I'm aware of, sir."
At first the man was rather unhelpful. He could confirm that the bank balances were all zero, but he couldn't see any records of any transactions going in or out of the accounts.
"Does that not strike you as odd?" Tommy asked the man, now sobering up.
"Actually, yes, it does." The man finally conceded. "Could you hold for a moment? I'd like to talk with my supervisor."
Before Tommy could even answer, the man was gone, and Tommy was listening to some late night relaxing jazz music. Which Tommy did not find at all relaxing.
For what seemed like an age, they were kept on hold, growing to hate the saxophone more by the second.
"Hello?" the man's voice almost surprised them. "I've just spoken with my manager and the IT department, and we were able to pull up a copy of your records from the back-up server which was spooled to it three hours ago. I'm looking at it now. I can see that three hours ago each of your bank accounts did have money in them. Not as much as you say you thought you had, but there are certainly lots of records. Although more transfers out than transfers in. In fact, there are a lot of transfers out. From what I can see, you've been transferring most of your funds out of your accounts to two or three other accounts. Is that correct?"
"No! That is NOT correct!" Tommy shouted down the phone. "I haven't touched our money." Tommy insisted, then looked over his shoulder at his wife, who saw the questioning look on his face and shook her head violently in reply. "And neither has my wife!"
There was a moment's silence during which everyone took stock of the situation.
"What accounts are my funds being transferred to? Can you see?"
"I'm sorry, Mr McNunn, are you telling me that you're not responsible for making these transfers?"
"Have you not been listening to me, you prat! Someone has been stealing my money. Tell me, where has the money been transferred to?"
The man at the other end of the phone coughed.
"From what I can see, the majority of your funds have been transferred out to three different accounts. The first, with the least amount going to it, is Battersea Dog's Home. Are you a lover of dogs, Mr McNunn?" The man asked, probably quite innocently, but rather foolishly.
"Are you fucking with me?" Tommy replied. "The Dog's home? Where is the other money going to?"
"Oh dear," he could hear the man breathe out.
"Do you like cats then...? The other money, about ten thousand pounds, has been transferred in several instalments from your different accounts to... to.. the Edinburgh Cat Home?"
"And the rest?" Tommy said, rather quietly, trying to keep a grip on reality. "Where did the rest go?"
"About fifty thousand went to what is probably a company. I can just see some initials. AJB Ltd?"
"What did you say?" Tommy demanded, his voice turning cold.
"AJB Ltd? Do you know them? Is it someone you know?"
Suddenly this was all starting to make sense.
AJB Ltd stood for Andrew James Burns Limited.
His accountant.
Tommy screamed, ripped the phone from the cable he was charging it with and started to smash it against the dashboard of the car. It disintegrated into a hundred pieces.
-------------------------
Andheri
Near Mumbai, Maharashtra
India
Wednesday
4. a.m. India Standard Time (IST)
Today would be the second day in a row that Anand would not be going to work.
His family were now even more worried about him. Lack of sleep, and hours of being hunched over the laptop without leaving the room to get a breath of fresh air, were leaving him looking drained, with big, black circles under his eyes.
They were also worried about his job, the only source of income they had coming into the house.
"What are you doing?" they had started to ask.
"Nothing." He had said, monotonically. What could he tell them?
Now Anand had started on his quest, it had become an obsession. And the more tired he got, the more the guilt played upon his mind, and the more McNunn became the focus of his wrath and confusion.
Whoever the hell Tommy McNunn really was, Anand was going to destroy him.
So far there was nothing that Anand had done which had been mind-blowingly difficult. It had all been perfectly within his grasp. It was almost as if all his years of hacking had led him to this point: years of practice and dummy runs on other networks that now came together to bring down one common target in a combined advanced persistent attack.
The first real key success had been to get access to McNunn's bank accounts. Thankfully most of the important basic information which he required to do this had been provided to him by looking at the records on his Swiss Insurance account. That simple activity gave him his bank account details, the bank’s address, and all his personal details, including perhaps most importantly, his date of birth. This information was useful, but Anand had then also hacked into Swiss Insurance and after elevating his user privileges so that he had the highest access rights possible, he had looked at the actual data that was kept encoded on the server for Mr Tommy McNunn. From this information, he had been able to decode his passwords, his credit card details and security pin numbers - which Anand was amazed to see that Swiss Insurance had recorded and kept in memory from the last time it had been provided by McNunn - surely that was illegal? -. The password was a basic one, with several letters at the beginning of the password, an 'S', and an 'I' followed by the number '19' and then several words and a text string 'CarolineWessex£'.
Seeing the password, Anand was able to guess that McNunn probably used the same password structure for many different accounts.
For example, for his BT telephone account if he had one, it would probably be 'BT', followed by the number '2' - since with 'S' for 'Swiss' he had used number 19, because 'S' was the nineteenth letter of the alphabet. The rest of the password would, very possibly but not definitely, be 'CarolineWessex£'. In Anand's experience, many people thought they were being clever by ensuring that part of their passwords were variable, but they couldn't be bothered to make the rest of the password too difficult to remember, and got lazy and just went with something simple for the rest of it. So, the password for BT would most likely be 'BT2CarolineWessex£', and likewise for the Royal Bank of Scotland account he had, it would be probably be 'RB18CarolineWessex£'.
The good thing about having the personal details from the Insurance company was that the date-of-birth Mr McNunn would have provided would the real one. Anand knew that for many online accounts, clever people would just use the same fake date-of-birth. But with insurance companies people used their real date-of-births for fear of one day having their insurance policies voided and resulting in no pay-outs, if it was discovered they had lied about their age.
Another good piece of information that he had
picked up from the Swiss Insurance records were the answers to several basic security questions: these were the answers to the questions that the system would ask a user if they ever forgot their passwords so that the system could verify their identities and then generate them another one.
For example, in the case of Mr Thomas McNunn, his mother's maiden name was 'Stone'. His favourite colour was 'green'. And the name of the first pet he had was 'Ben'.
Having these basic details, along with the post-codes, date-of-birth, and the answers to the other basic security questions, would then make it easier for Anand to generate new passwords for any online accounts that Anand couldn't get into if he couldn't now guess the passwords. And once he got through the password selection on any account he could then change the password, change the security questions and answers, and then lock McNunn out from further use of those accounts. Anand would take them over, and McNunn would never be able to use them again.
When Anand had accessed McNunn's bank account for the first time, he had made notes of lots of interesting transactions and records. For example, he had taken note of any regular transactions, and any inter-bank account cash transferrals. These gave him the account numbers of other accounts that McNunn also had, from which he transferred money back-and-forth to his current accounts, of which he seemed to have six.
One of his accounts seemed to have joint holders, the other holder being a Mr Andrew James Burns. That particular account seemed to be the one from which standing order, direct debits and other payments were made to utilities companies and other services to which McNunn had subscribed, such as the 'Playboy' television channel.
Anand noticed that once a month that same account made a payment to AJB Ltd, which a quick search on the internet and the records in the UK Companies House, revealed to be a company which provided accountancy services.
From there it didn't take much to figure out that Mr Andrew James Burns was Mr Thomas McNunn's accountant, and that he had full authority to pay most of the bills and run the affairs of Thomas McNunn.
Suddenly, once this was revealed, a lot of the payments out and transfers in to the joint account became very interesting.
In particular, Anand became curious about a payment that came into McNunn's account once a week from another bank. It was a large sum of money.
After some research, Anand discovered that the bank from which the money came was a small independent private bank based in the north of Scotland.
To get more information Anand needed to have greater privileges within the network and banking servers of that bank.
Looking through McNunn's emails he eventually found an email from the bank and using the name signed at the bottom of the letter and the structure of the bank's email address given in the header, he had constructed a phishing email which he had sent to the bank and the owner of that signature. The email he had made up, pretended to come from a local distillery near to the bank, inviting the person in the bank to a celebration of a new whisky which was being unveiled. It promised to be an interesting evening with a free Ceilidh, - a Scottish party with music and lots of dancing.
Within an hour of sending it, the recipient in the bank had clicked on the link to R.S.V.P. This immediately launched some malware into the bank's networks, and not long after that, Anand had full access to their core systems.
He was then able to view all the details of the accounts - there were actually five separate accounts - that were held by AJB, only one of which listed Thomas McNunn as a joint account holder.
When Anand viewed the accounts and their details, in all their glory, he couldn't believe his eyes.
The first of them gave a list of regular payments to a number of people in Scotland. Payments were also being made to business, suppliers, and a range of other accounts, the details of which were not immediately obvious.
On the other account however, the nature of the payments, the size of the payments, both those coming in as well as those leaving, and the destination of the payments, all immediately rang bells within Anand's head.
For a long time he stared at the accounts, trying to imagine what they could be, apart from the obvious.
In the end, he realised that the obvious was probably the answer.
At that point, Anand, for the first time, realised that Mr Thomas McNunn was possibly a bigger bastard than he could ever possibly have imagined.
And it was also clear that inadvertently he had stumbled upon something that he should never have seen.
Exactly what the accounts showed, Anand was not sure.
However, he was not stupid.
After all, there were not many companies that made regular LARGE payments of cash to companies in Columbia, Cuba, or Afghanistan.
Anand realised that his hands were shaking and his heart was beating so fast he thought it might explode.
They also showed payments being made to individuals throughout the UK and across Scotland, most likely employees, friends or associates of the business.
Strangely, instead of feeling scared, Anand felt exhilaration.
This guy, Thomas McNunn, was almost certainly not a good man.
Who he was and exactly what he did, Anand did not know.
However, these discoveries upped the ante and in his exhausted state of mind made Anand more certain than ever before that he had to destroy him.
And soon. Fast.
Before the man discovered who Anand was and tried to destroy him first.
From now on, it would be a race against time.
Chapter 29
Tommy McNunn's House,
Edinburgh
Wednesday
02.15 a.m. G.M.T.
It took Tommy McNunn and his wife almost two hours to drive to the local 24hr ASDA and to purchase a brand-new phone. In fact, he bought two just in case he lost his temper again in the next couple of days, which, in his current mental state was highly probable.
Luckily, he had found the SIM card amongst the wreckage of his earlier wanton alcohol fuelled outburst and after inserting it into the new phone, found that it still worked perfectly well. But just in case, he had bought several new pay-as-you-go cards.
Tommy then tried to call back the bank and get into his accounts again.
He still had lots of questions to ask.
There had to be a mistake. Somehow. Somewhere.
The alternative was too incredibly serious to contemplate. It would mean that his accountant had deliberately emptied his accounts and stolen all his money.
His wife had spent the past hour trying to calm Tommy down. She knew that when he had been drinking and was in this mood, he was a loose cannon that could do almost anything.
In this state, she had learnt never, ever to cross him or argue with him.
Right now, she was worried more about the life of their accountant, than the fact that all their money seemed to have disappeared.
If Tommy killed the accountant, one or both of them could end up in prison for the rest of their lives.
This time around however, Tommy was struggling to get through the security questions that the system always automatically asked him when he did telephone banking.
A few hours ago, everything had worked fine, and they had eventually been put through to an assistant in the call centre who had accepted their identification and been able to see their accounts. Which had been empty.
Now however, it was a completely different story.
"You need to speak to an operator," his wife pointed out.
"But how? The system won't let me through!" Tommy replied bluntly, cutting her short.
"Then, why don't you call the number for lost cards on the back of your card... then when you get through to an operator there, explain what the problem is."
Tommy looked at her. She definitely wasn't just a pretty face. "Good thinking..." he admitted quietly.
Looking at the back of his debit card he found the number for lost cards: 'IF FOUND CALL THIS NUMBER', and dialled it.
>
There were a few automated voices, then he got through to a human.
"Hi... My name is Tommy McNunn. I urgently, urgently need your help. If we get cut off, can you please call me back on my mobile..." he begged, and quoted his number to her.
"It's okay, I have it on the display. I'll call you back, if..."
"Good, " Tommy interrupted her, pressing on. "You see, it seems that someone has stolen all the money from our accounts. I was speaking to a colleague of yours earlier on, and was told that someone had emptied all our accounts. We got cut off and our phone stopped working. We've just bought another one and called you straight back..." he explained most of the fiasco, omitting the bit about him smashing his phone up.
"That doesn't sound at all good. Can I take you through security for your accounts and then I'll see if I can help you?"
"Aha... you see, that is the thing... When I just called back a few minutes ago, it seems that the security system does not recognise any of my cards or my accounts. I have my wife with me here, and we tried her card, and two of my other cards, as well as my MasterCard. None of them seem to work."
"Are you sure?"
"Yes, but I must admit I had been drinking a little before I called, and right now I'm pretty bloody upset that some bastard has possibly stolen all my money, so maybe I'm not thinking straight and I'm making some ridiculously stupid mistake each time. Can you please help us? My wife is here too, and we're on loud speaker in our car."
"Certainly sir. Can we start with one of your cards... Give me your account number, sort code and security pin? We'll start with your account number..."
What followed was incredible. Almost unbelievable. And as far as Tommy was concerned, it put the nail straight into Andrew James Burn's coffin.
McNunn's wife had never seen him so angry before.
He seemed to be losing his senses.
Worried that he was going to destroy the phone again, she had grabbed hold of it with her hands and begged the woman operator to hold on and not to hang up: they needed to think for a couple of minutes.
Say You're Sorry: A Gripping Crime Thriller (A DCI Campbell McKenzie Detective Conspiracy Thriller No 1) Page 21
