call centre fraud warning & praise for HSBC

jimmyY

Ironically I'm in an Systems Architect specialising in security, so I'm pretty damn careful in how I use my bank/credit cards. Yesturday the bank rang me up to say that there was suspicious activity on my account and ~£1.5K in transactions had happended in the last 24hrs - they had caught it and suspended my account.

Now this slightly shocked me as I'm well aware of the key fraud scams and so I'm pretty damn hard to get at for a fraudster.

A bit of digging/profiling on my behalf, revealed that the fraudster also had my address details, but looked like an amateur as he was paying hid County Council, Sky subscription and gas bills with my card - he'd also rented a car with it....how dumb can you be!!! In fact this initially looked so dumb that I suspected that no one could be that stupid and therefore my whole identity must have been cloned by a seriously sophisticated gang (passport the lot). I suspect this is now very unlikely and I was just panicing :rolleyes:

Anyhoo - I traced the activity to the Wolverhampton/Staffs. area and both because of the location, amatuer fraud profile and my usual high level of security, I can pretty much say with certainty that my details were stolen by a legit, big business (utilities) call-centre employee during a phone payment. I usually make all payments like this through my bank, but this one time I thought "what the hell, it's gotta be a secure call-centre with appropriate SOPs (Security Operating Procedures) for control/protection!"

The sad truth is these guys already have all the detail available for cardholder-not-present fraud (i.e. they even have your address). As soon as you give them your card details you're relying on the companies SOPs for protection. If, as I think this shows, a large utility company has loopholes in its SOPs that allow fraud, then it suggests the risk of fraud is present in any telephone transaction with any company.

So my advice to anyone now is - don't get lulled into a false sense of security by a company name - don't even pay your ustility bills over the phone!

As an aside HSBC were superb - they noticed it, not me. They rang me up ~16hrs after the first fraudulent transaction (I was at work...doh!) - and already refunded one of the transactions after 8hrs. Although I have other accounts which hold the majority of my savings, I have stuck with these guys so that I have a good history to fall back on if I need it. They have always been excellent with me. You may get 0% on your savings with them - but as this shows there is a real bonus as the level of service has so far been faultless. This is despite the fact that I syphon almost all of my income out of their accounts at the end of every month into other high interest accounts leaving only a few thousand for me to draw on and them to make money on - they've got to get !!!!ed off with that!

DCodd

Thanks for that! A number of my friends pay a lot their bills over the phone as they beleive the Credit Card companies and utilities companies that they are dealing with will have air tight security and most of these companies will state that they have.

I shall direct them to your post for their information.

Thanks again

mazza111

A few call centres have now banned pen and paper for this very reason, including the one my daughter works for. Should they need to write anything down, they have to use a whiteboard and erase at the end of the call. So fair play to this particular call centre, maybe it's something that all should be doing.

jimmyY

mazza111 wrote: »

A few call centres have now banned pen and paper for this very reason, including the one my daughter works for. Should they need to write anything down, they have to use a whiteboard and erase at the end of the call. So fair play to this particular call centre, maybe it's something that all should be doing.

Yes they should but that doesn't solve the issue as anyone (as I have) could learn a simple technique available on the internet to memorise all these details in seconds for later recall. The technique is an old one, based on going for a walk, and is widely available.

Ultimately, you need automated systems to deal with the key bits of information, so that only partial bits are exposed to tele-operators. This is what the banks do and is the only way to be 100% sure.

That said, the memory technique does require some prior planning as it takes at least a day to learn/memorise the 37 key features in a reliable manner to make it work.

so2006

Personally, I believe the most secure way would be for call centers to put you threw to a automated answering service. Where you can key in the information and then it would transfer you back to the call center operator.

It would work lol

I hardly pay my bill by phone anyway :rotfl:

I remember when Natwest rang me for a 1p transaction :rotfl:

(EDIT) Crap just noticed Jimmy had the same ides :rotfl: Soz!