Yes, I bought 16 jalfrezis, I tell my bank. But £1,000 on clothes? I’ve been hacked

I recently received a text asking me to verify whether I had made a recent purchase. This is something that happens a lot, as my bank is triggered by anything that doesn’t appear to be me. It will allow limitless funds to go on overpriced trainers, but block barbecue meats or Tottenham Hotspur merch. I am making this up, of course, as it seems entirely random what it double-checks, although I am sure there is a sophisticated algorithm that says things like: “Romesh doesn’t usually buy vegetables in January – he gets depressed and eats only pastries.”

It is worse when I’m on tour. The bank gets extra suspicious because I make purchases in so many different towns, particularly since almost every one is curry. I spent the whole of my last tour on the phone trying to convince my bank it was actually me having vegetable jalfrezi for the 16th consecutive night. If the system were truly sophisticated, it would trigger a call to a dietitian.

I don’t begrudge any of this, because it’s nice to feel there is a system in place to stop you losing your money. But I have been known to lose my shit when my card is declined in front of a queue of people in B&Q because nobody at the bank believes I would do DIY.

I was working when I got the text asking me if I had spent £1,000 in a clothes shop. Obviously, I hadn’t, but my complete lack of trust in my own sense of recall meant I started racking my brains to see if there was any chance I had simply forgotten. I realised that probably wasn’t the case, and immediately began to panic. Somebody had been using my card! I know this is an anonymous crime, but in my head I envisioned some Thanos-type character browsing the dark web and saying, “I knew I’d get you one day, Romesh!”, before spending all of my money on guns.

I immediately told everyone I was with that I had been the victim of cyberhacking, and phoned my bank. But getting across what had happened was more difficult than I had anticipated. First, I had to complete a series of puzzles in order to convince them it was me, ranging from telling them what I had spent £6.45 on the previous week, to remembering the number of times I had cancelled and renewed my gym membership. Once I had eventually reassured them, I was told not to worry as it was normal procedure to receive that text for security reasons. I said I understood that, but that it wasn’t me who had made the purchase; they told me not to worry, as it was normal procedure to receive that text for security reasons. This happened once more, before I said, in a slightly distressed manner, “I think I’m the victim of a crime!” Then they finally looked into it, and discovered not only that my card had been cloned, but that whoever did it likes to look incredibly stylish – a dead giveaway that it wasn’t me.

If I say I’m a YouTuber fan, do I sound like Matt Hancock pretending to like grime? | Romesh RanganathanRead more

They told me they would have to send me a new card and cancel the old one, and asked me to cut it up immediately. I made a huge show of doing this in front of the people I was working with, so they would feel sorry for me and perhaps even treat me as some sort of hero. Every day since then, I have discovered I have defaulted on yet another payment, because the service provider has my old details – including one for insurance on a phone I haven’t owned for almost a year. I updated the others, with the exception of the gym payment – on that one, I took the hacking to be a sign from above. Thanks, Thanos.