BBC's 'The Traitors' Contestant Lost £40,000 Life Savings to a Phishing Scam

What Happened

Sam Little, a 35-year-old from Yarm, near Middlesbrough, England, lost £40,000 in cryptocurrency to a phishing scam in January of this year, according to the BBC. Little appeared on Series 4 of the BBC reality competition The Traitors.

The money was not spending cash. Little told the BBC it was savings he and his wife had built up specifically to fund starting a family.

How the Scam Worked

Little received text messages that appeared to come from his bank, warning him of multiple unauthorized login attempts and telling him to call a number. He called.

On the phone, he logged into what he believed was his normal online banking platform. The scammers never asked for his password. They never asked for a verification code. Those are the usual red flags people are told to watch for.

"They were somehow able to hack into the web page I would normally interact with," Little told the BBC. "Before I knew it, the phone went dead and everything had gone."

This is a well-documented technique: attackers use real-time phishing infrastructure that proxies the victim's actual banking session, capturing session tokens without ever needing to ask for credentials directly. From the victim's perspective, everything looks legitimate.

The Scale of the Problem

Little says he has spent considerable time researching financial fraud since January. The numbers back up his concern. According to the Office for National Statistics, 4.6 million people are affected by cybercrime and fraud every year in the UK. The BBC also reports that between 2024 and 2025 there was a 31% increase in the number of cases. That suggests Little's experience is far from unusual, though it rarely comes with a public face attached.

Fraud of this kind is also notoriously hard to recover from. Little told the BBC he has not recovered any of his money.

What He Did Next

Little reported the scam to Report Fraud, run by City of London Police. He says there has so far not been an investigation. The BBC contacted Report Fraud, and a spokesperson said: "We are in the process of exploring this report by carrying out a manual review. Crypto wallets are a complex area of policing and will take time to resolve."

The Strongest Counter-Concern: Victim Responsibility

A fair challenge worth stating plainly: financial institutions and some consumer advocates argue that individuals bear responsibility for actions taken on their own accounts, even under social engineering pressure. Banks design their security around the principle that customers should not act on unsolicited contact, and that guidance is widely published. If someone voluntarily logs in and authorizes activity, the argument goes, the bank did not fail its security obligation.

Little was not asked for a password. He was not asked for a one-time code. He did what any reasonable person would do after receiving what appeared to be a legitimate security alert from his bank. The scam worked precisely because it bypassed the warning signs that consumer education campaigns are built around. Blaming victims for failing to detect attacks they had no reasonable basis to detect is a convenient position for institutions that profit from the current system.

Why He's Speaking Out

"It feels like your world's just collapsing," Little told the BBC. "You work solidly for years to build this up, and it's just gone."

His decision to go public is deliberate. Using his profile from The Traitors to reach a wider audience, Little's stated goal is to warn people that these scams do not always look like obvious fraud. No misspelled emails. No requests for sensitive codes. Just a convincing phone call and a cloned session.

"I like to think I'm savvy, but it can catch anyone," he told the BBC. "It's really scary."

A Note on the Source Set

The Daily Mail source submitted alongside the BBC report contains no relevant content on this story. Its text is a 2024 Reuters piece about former footballer Bafetimbi Gomis and Al-Hilal. That source contributed nothing to this article. The BBC report is the sole substantive source here, and readers should weight accordingly. It is a single outlet's account of a single individual's self-reported experience, without independent verification of the £40,000 figure or the technical mechanics of the attack.