Two men from Leicester have been sentenced at Inner London Crown Court after stealing more than £187,000 from bank customers in a one-time passcode fraud.
Mohammed Hassan Farooq and Deva Raval were part of a Leicester-based organised crime network that deliberately targeted elderly and vulnerable bank customers between November 2024 and July 2025. The duo also exposed victims to a further £300,000 in attempted losses, which were flagged and stopped by banking systems.
Victims were sent fraudulent text messages impersonating organisations including the DVLA, TV licensers and retailers offering promotions. The messages contained a link that asked victims to input their banking details.
The pair then followed up with those who had clicked on the link, using phone and video calls to impersonate bank staff and deceive victims into handing over one-time passcodes and downloading payment processing applications to transfer funds.
One-time passcodes are the short codes banks send to a customer’s phone to approve a payment or login. Once a fraudster has the code, they can authorise transfers from the victim’s account as if they were the account holder — which is why banks repeatedly warn customers never to share them with anyone, including anyone claiming to be from the bank.
Following an investigation by the banking industry, systems identified at least 164 fraudulent transactions across several months. The group had used multiple short-term rental properties to conceal their activity and distance themselves from the offending.
Investigators found that Farooq had played a leading role within the group, purchasing nearly 12,000 sets of stolen personal and financial data from criminal vendors operating on Telegram channels and accounts, which were then used to facilitate further offending.
Raval was found to have worked closely with Farooq and was involved in the day-to-day execution of the fraud, contacting victims pretending to be a bank official and persuading them to authorise payments or transfer money.
Officers from the Dedicated Card and Payment Crime Unit (DCPCU) executed a coordinated operation at a rental property in Bedworth, Warwickshire, where Farooq and other suspects were arrested. Examination of a mobile phone uncovered further crimes by the pair, including repeated fraud against a vulnerable 80-year-old victim in London.
The DCPCU is a specialist police unit sponsored by the banking industry, made up of officers from the City of London Police and the Metropolitan Police Service alongside staff from UK Finance. It targets the organised criminal gangs behind card and payment fraud.
Both men pleaded guilty at Inner London Crown Court on 22 October 2026. Farooq received a custodial sentence of four and a half years, and Raval was sentenced to two years, suspended for two years.
Detective Constable Ant King, of the DCPCU, said: “This case highlights the scale and sophistication of modern fraud, and the lengths criminals will go to in order to exploit innocent people. Farooq and Raval were key figures in a coordinated operation that caused significant financial loss totalling £187,000 across a short eight-month period.”
He added: “This case also shows why people should be cautious when they receive unsolicited text messages from numbers they do not recognise. Follow the advice of the Take Five to Stop Fraud Campaign; Stop and Think before sharing personal or financial information and treat one-time passcodes as carefully as you would your PIN.”
Fraud cases continue to reach London’s courts. A rental fraudster who took nearly £77,500 recently had his jail term cut on appeal at Southwark Crown Court, while six men with London links remain on the National Crime Agency’s most wanted list, including for fraud.
