Diners at the luxury Ritz hotel in London have been targeted by “extremely convincing” scammers who posed as hotel staff to steal payment card details.

The scammers phoned people with exact details of their restaurant bookings, asking them to “confirm” card details.

They then tried to spend thousands of pounds at the catalogue retailer Argos.

The Ritz told the BBC it was investigating a “potential data breach” and said it had alerted the Information Commissioner’s Office (ICO).

However, the ICO told the BBC it had not yet had a report from the Ritz.

How did the scam work?

The fraudsters phoned people who had already made a restaurant reservation at the Ritz, pretending to be hotel staff.

One woman, who had made an online booking for afternoon tea at the Ritz as part of a celebration, received a call the day before her reservation.

The scammers asked her to “confirm” the booking by providing her payment card details.

The call was convincing because it appeared to have come from the hotel’s real phone number, and the scammers knew exactly when and where her reservation was.

One cyber-security expert told the BBC that caller ID spoofing in this way was “quite easy”.

The scammers told the woman that her payment card had been “declined”, and asked her for a second bank card.

After they had taken the payment card details, the scammers tried to make several transactions in excess of £1,000 at the catalogue retailer Argos.

When her bank spotted the suspicious transactions, the scammer phoned again – this time pretending to be from her bank.

He told the victim that somebody was trying to use her credit card, and in order to cancel the transaction she should read out a security code sent to her mobile phone.

In reality, this would have authorised the transaction.

A second woman, who made her original booking over the telephone rather than online, told the BBC the exact same tricks had been tried on her.

She later felt suspicious that the scammer had not been able to correctly answer questions about the hotel’s facilities.

“People tend to trust caller ID, which is perfectly understandable because in theory it appears to authenticate the caller,” said Dr Jessica Barker, co-founder of the cyber-security company Cygenta.

“On top of that, when a scam like this involves insider information it adds an air of legitimacy and authority.”

What has the Ritz said?

The Ritz said it had been made aware of a potential data breach within its “food and beverage reservation system” on 12 August.

It is continuing to investigate how the scammers accessed customer information.

It said it had emailed customers that may have been affected, warning them: “After a reservation has been made at the Ritz London, our team will never contact you by telephone to request credit card details to confirm your booking with us.”

It has not revealed how many people were affected.

How can I protect myself from scams like this?

Restaurants should never phone you asking for payment information to “confirm” your booking. If you receive a suspicious call, you could hang up and call the venue back using the telephone number on their official website.

Dr Barker warns against giving card details to somebody who had called you, and suggests always calling the company back yourself.

If a bank believes a transaction has been fraudulent, they will not ask you for security codes in order to cancel the transaction.

If you receive a suspicious call you think is pretending to be from your bank, hang up and call your bank using the number on the back of your payment card.

Do you have more information about this or any other technology story? You can reach Chris directly via email, on Twitter or through encrypted messaging app Signal on: +44 7861 520418

A UK boat has just provided an impressive demonstration of the future of robotic maritime operations.

The 12m Uncrewed Surface Vessel (USV) Maxlimer has completed a 22-day-long mission to map an area of seafloor in the Atlantic.

SEA-KIT International, which developed the craft, “skippered” the entire outing via satellite from its base in Tollesbury in eastern England.

The mission was part-funded by the European Space Agency.

Robot boats promise a dramatic change in the way we work at sea.

Already, many of the big survey companies that run traditional crewed vessels have started to invest heavily in the new, remotely operated technologies. Freight companies are also acknowledging the cost advantages that will come from running robot ships.

But “over-the-horizon” control has to show it’s practical and safe if it’s to gain wide acceptance. Hence, the demonstration from Maxlimer.

The USV was despatched from Plymouth in late July and sent to a location some 460km (280 miles) to the south-west.

With a multi-beam echo-sounder attached to its hull, the boat mapped more than 1,000sq km of continental shelf area, down to about a kilometre in depth.

This was a segment of seafloor that had essentially no modern data registered with the UK Hydrographic Office.

SEA-KIT had wanted to send the USV across the Atlantic to America for the demonstration, but the Covid-19 crisis made this impossible to organise.

“The project’s overall aim was to demonstrate the capabilities of current technologies to survey unexplored or inadequately surveyed ocean frontiers and despite the planning challenges we faced due to Covid-19, I feel that we have done that. We have proven the true over-the-horizon capability of our USV design and the team are exhausted but elated,” the company’s director of technology, Peter Walker, said.

The USV Maxlimer was originally developed for – and won – the Shell Ocean Discovery XPRIZE.

This was a competition to find the next-generation technologies that could be used to map the global ocean floor. Four-fifths of the sea bottom have yet to be surveyed to an acceptable resolution. Robotic solutions will be essential if we’re to have any chance of closing the knowledge gap.

Maxlimer makes use of a communications and control system known as Global Situational Awareness via Internet.

This allows an operator to remotely access CCTV footage, thermal imaging and radar through the vessel, as well as listen live to the USV’s surroundings and even communicate with others in the vicinity.

Maxlimer links to three independent satellite systems to stay in contact with the control room in Tollesbury.

The robot boat moves slowly, at up to 4 knots (7km/h; 5mph), but its hybrid diesel-electric propulsion system is highly efficient.

SEA-KIT CEO and designer, Ben Simpson, told BBC News: “We had a sweepstake on how much fuel would be left in the tank. We thought there was going to be 300-400 litres. It turned out there was 1,300 litres.” In other words, Maxlimer returned to Plymouth with its fuel tank still around a third full.

As well as the European Space Agency, partners on the project included Global Marine Group, Map the Gaps, Teledyne CARIS, Woods Hole Group and the Nippon Foundation-GEBCO Seabed 2030 initiative.

Another partner was Fugro, one of the world’s biggest marine geotechnical companies. The multinational recently announced a contract with SEA-KIT to purchase a fleet of USVs to use in survey work in the oil, gas and offshore wind sectors.

Jonathan.Amos-INTERNET@bbc.co.uk and follow me on Twitter: @BBCAmos

A new remake of the 1980s British computer the ZX Spectrum has soared past its crowdfunding target in just two days.

The ZX Spectrum Next Issue 2 has raised nearly £900,000 – far beyond its £250,000 goal – with 28 days of fundraising left to go.

More than 2,500 backers have chipped in to the project so far.

The Issue 2 is an updated version of an earlier ZX Spectrum Next, which was funded via Kickstarter in 2017.

More than 3,000 units of that version were made, the last of which were shipped earlier this year.

The ZX Spectrum Next Issue 2 is to include upgraded hardware such as a faster processor, twice as much memory and a high resolution mode – though its computing power is closer to the retro console than modern high-end computers.

The remade computers allow players to use the original game cassettes if they want, rather than merely emulating the games purely via software.

Both the Next and Next Issue 2 models have been spearheaded by London-based developer Henrique Olifiers, co-founder of game maker Bossa Studios.

A community of developers has embraced the ZX Spectrum Next models, meaning new games for the classic computer continue to be made, says retro games enthusiast David Douglas, who runs the RoseTintedSpectrum YouTube channel.

Mr Douglas, who has backed the new Kickstarter project, says his fondness for the Spectrum is partly thanks to the unusual style and tone of the original games.

“A lot of the games were very British, which you don’t really get nowadays,” he says.

He adds that he was inspired to shell out £325 towards the project to secure a slightly more advanced version of the ZX Spectrum Issue 2 himself because he was aware of the success of the previous Kickstarter.

“There’s a lot more confidence this time round in what it’s actually going to produce,” he says.

Not all ZX Spectrum-themed crowdfunding schemes have gone so smoothly.

The Vega+ console, a separate project that was crowdfunded through Indiegogo failed to meet expectations and the makers eventually lost the right to use the “ZX Spectrum” and “Sinclair” trademarks as a result.

In June 2016, Dr Ruja Ignatova told an audience of thousands at Wembley Arena that her new cryptocurrency, OneCoin, was a “Bitcoin killer” and would make early investors rich. Many in the crowd had already poured in their life savings. Many more followed.

About £2bn from across the world was spent on OneCoin tokens, including tens of millions of pounds from British families.

Then, in late 2017, Ruja disappeared and the scheme was exposed to be a scam. There was no cryptocurrency. It was an old-fashioned Ponzi scheme.

For 18 months, I’ve investigated the scandal for BBC Sounds, for the podcast The Missing Cryptoqueen, alongside my producer, Georgia Catt.

After a break, we returned for a new episode last week, which focused in part on the UK’s Financial Conduct Authority.

Just three and a bit months after the London extravaganza, the watchdog posted an online warning about the get-rich scheme, headlined: “Beware trading virtual currencies with OneCoin”.

It said consumers should be “wary of dealing with OneCoin” and the organisation was being investigated by the City of London Police.

“This firm is not authorised by us and we do not believe it is undertaking any activities that require our authorisation. However, we are concerned about the potential risks this firm poses to UK consumers,” it added.

This helped counteract the claims of OneCoin promoters, who were trying to pull in more victims.

And delighted critics would spend their evenings sending the FCA warning to potential new recruits.

But on or around 1 August 2017, with the scam in full momentum, the authority suddenly removed its notice.

Now, it was Ruja’s turn to be thrilled.

According to retired libel lawyer David Hooper, it should have been obvious to the regulator OneCoin’s promoters were going to use this “as a marketing opportunity”.

And OneCoin promoters quickly began claiming it meant the FCA no longer considered OneCoin a risk.

One triumphantly told his followers: “If [the FCA] still thought we were a fraudulent company… then, guess what, that warning’s not removed.”

While making the podcast, we’ve seen letters a UK law firm hired by Ruja sent to her critics.

The letters threatened legal action unless they deleted online posts claiming OneCoin was a pyramid scheme run by a criminal organisation.

And at some point, one of Ruja’s advisors – although it’s still not clear exactly who or when – realised the FCA might have overstepped its regulatory authority.

And, according to multiple sources, the law firm pressured the FCA to have the notice removed.

Heavily promoted

All regulators have their own turf to referee.

The FCA’s covers financial products and services.

What’s included isn’t always clear, especially with new products.

And being so novel, cryptocurrencies were, and still are, outside this “perimeter”.

In response to a query at the time of its removal, the FCA said it “had been on our website for a sufficient amount of time to make investors aware of our concerns”.

However, several alerts have remained live on the FCA’s website for years, even decades. Not to mention the scam was still being heavily promoted in the UK at the time.

When we asked again, it told us the initial decision to publish the notice had been at City of London Police’s request and the decision to take it down had been made “in conjunction” with the force.

“It did not appear that OneCoin was carrying on any activities that required FCA authorisation,” it said.

“The FCA does not regulate crypto-assets and therefore it could not take this matter further.

“Any queries should be directed to the City of London Police on this.”

We followed this up with the police force. But it made clear responsibility for the notice was the regulator’s alone.

“The City of London Police was made aware of the FCA’s intention to take down their alert on OneCoin and their reasons for doing so,” said a spokesman.

“The force accepted that the decision belonged to the FCA given that this was their alert.”

We went back to the FCA to ask again what its reasons were but it declined to comment further.

City of London Police ultimately dropped its own investigation, citing “insufficient evidence to support criminal proceedings” but was thanked by US prosecutors for helping them convict a lawyer who had helped launder $400m (£300m) of OneCoin’s proceeds.

However, neither of these events happened until two years later, in 2019.

And critics believe once the decision had been made to issue the original warning, there was an obligation for the FCA and police to stick with it.

“They clearly had responsibilities not to pour a bucket of whitewash over OneCoin,” Mr Hooper told us.

The hunt for Ruja continues – if caught, she faces up to 80 years in a US jail.

For the many thousands conned out of their savings, justice won’t be served until the matter is revolved.

But in the meantime, many can’t help feeling the UK authorities could have done more to thwart the scam and at the very least shouldn’t have backtracked from keeping their concerns public.

Download or stream the Missing Cryptoqueen podcast on BBC Sounds.