The O2 PAYG £30 topup scam

pokerbirch

Hi Guys n' gals,

Have been a long time browser and have finally registered.

I have an O2 PAYG phone and normally topup via the O2 website. On 09/10/2010, I had to topup while away from home, so used O2's 4444 call number. As it was the first time of using this method, I had to register my Visa Debit card by keying in the number. The £10 topup went through fine and I was happy.

A few days later, I went to a cash machine to get some money and my card was blocked, so I phoned my bank (Santander) to ask why. Turns out that there had been a number of suspicious attempts to take payments from my card - all a few days after I topped up. I then noticed a £30 payment had been taken by O2 two days after my initial £10 topup, yet it was never credited to my phone. Santander advised me to speak to O2 as they had 30 days to give me a refund. I called O2, got through to their "Fraud Department" after a very long wait and was told that they would contact me within 24 hours. Contact never came, so I emailed them a few days later and got a semi-automated response from an Indian customer support person. Called O2 again and was promised a return call which again did not materialize, so I decided to wait the 30 days and then contact Santander. They told me it was O2's duty to refund me, so again I contact O2 and they tell me that it's upto Santander to refund me via an Indemnity Claim.

To me...to you...to me...to you...apparently, I only have 60 days to make the claim otherwise I lose out.

BUT...this post is not so much about the 30 quid, it's more about the fact that O2 has a known security problem that has been going on for a few years and they appear to be doing nothing to fix it. Type these words into Google, you will see complaints dating back to 2008 and beyond: "O2 £30 topup scam".

Is it actually legal for a company to continue trading while knowing they have a security problem that is costing customers? Or is it a nice little earner because they hang it out for 60 days and then pocket the money?

:mad:

Techhead_2

You've misunderstood several things.
For example, the £30 scam you mentioned. The max you can top-up by card is £30. So if someone 'steals' your details, and fraudulently tops up then they obviously go for the max. To do a top-up they need address and full card details. Therefore you will find plenty of reports of £30 transactions, but that doesn't mean there is a scam at O2. Indeed O2 work with the card companies to reduce this. And they get lots of complaints about the restrictions that are in place. (see their own forums)
I would concentrate on sorting your own issue. Quite frankly, I would more likely believe O2 than Santander.

pokerbirch

Techhead wrote: »

You've misunderstood several things.
For example, the £30 scam you mentioned. The max you can top-up by card is £30. So if someone 'steals' your details, and fraudulently tops up then they obviously go for the max. To do a top-up they need address and full card details. Therefore you will find plenty of reports of £30 transactions, but that doesn't mean there is a scam at O2. Indeed O2 work with the card companies to reduce this. And they get lots of complaints about the restrictions that are in place. (see their own forums)
I would concentrate on sorting your own issue. Quite frankly, I would more likely believe O2 than Santander.

I fully understand your reply, however the theft of my card details is directly linked to my initial O2 transaction as it was a "virgin" card that had never been used for anything other than a couple of ATM withdrawals and had not been used for around 6 weeks previously. So the theft was 100% related to my card number been sent over the O2 network while topping up. At no point was my address confirmed or sent or otherwise given by me. I am VERY particular about security and this was a one-off.

Helix

pokerbirch wrote: »

I fully understand your reply, however the theft of my card details is directly linked to my initial O2 transaction as it was a "virgin" card that had never been used for anything other than a couple of ATM withdrawals and had not been used for around 6 weeks previously. So the theft was 100% related to my card number been sent over the O2 network while topping up. At no point was my address confirmed or sent or otherwise given by me. I am VERY particular about security and this was a one-off.

You have to enter the numbers in your postcode when you register your card on the phone. Therefore confirming your address.

pokerbirch

Helix wrote: »

You have to enter the numbers in your postcode when you register your card on the phone. Therefore confirming your address.

Don't recall that, but is a postcode all a scammer would need to create an address? I'm assuming that the connection to O2 was somehow intercepted as there is no other way.

Also of interest is that only the £30 payment got cleared. My bank reported that there were a number of other suspicious transaction attempts a few hours later but they were related to online sites and the user(s) clearly didn't know the full card details. So how come the first £30 to O2 cleared but the rest didn't? Maybe O2 has a dodgy employee who took his/her £30 and passed the card on to someone else? In different circumstances, I would just get a refund and forget about it, but this was a very unique situation that proves there is a problem with O2's security.