NatWest: Denial of service

samizdat

opinions4u wrote: »

I don't know the full facts of the case.

Equally, neither do you.

You don't know what triggered the systems to get over-excited and create the difficulty you currently have. You are looking at thing one dimensionally - you're transfer hasn't worked the way you expected and it's miffed you.

You don't know how justified Nat West are in taking the action that they've taken and you're never going to know the full details because unless they are really stupid they are not going to be sharing them with you.

So you don't know whether it's absurd or not.

Well, of course that is all true, up to a point. What I was trying to argue, and as you can see the language I used was akin to that used in computer security, was that I didn't think this was an effective approach.

I don't claim to be an expert on computer security, but I do have an amateur interest in the subject, and my reading has always suggested that robust forms of identity verification can be implemented that do not rely on surrounding these methods in secrecy. In the field of computer security, "security through obscurity" is, almost as a cliche, a shorthand for saying "this obscurity doesn't add any more security to the system".

Regardless of that particular argument of principle, I also feel that, on the facts as disclosed "one-dimensionally" by me, NatWest is operating a flawed system that should be improved.

Partly, that is because I think the actual transaction must look innocuous to any reasonable system. To reiterate, this was a payee that had been set up with a card reader. The payee was also the original source of funds paid in to NatWest.

But also, NatWest's intended remedy of sending me an activation code for online banking and a new PIN for the card I use in the card reader, made me feel there was a degree of circularity in their approach.

As I have said above, I had reactivated my online banking facility on the actual day of my attempted transaction, after NatWest had sent me a new activation code.

Immediately after activating the account, my first transaction, to a pre-existing payee - also the source of original funding to NatWest - is flagged as fraudlent. NatWest now proposes to resolve the problem by sending me a new code and PIN.

How can I have confidence that when this code and PIN eventually arrive, NatWest will allow me to transact on the account?

opinions4u wrote: »

It's possibly a silly error on their part. It may be poor system programming. More likely there's a pattern to recent transactions on your aco!!!!s that inadvertently mirrors similar patterns involved in certain stages of fraud.

Irritating when it inconveniences the innocent, I agree.

But you don't know the full facts of why Nat West have done what they've done so you don't know if it's absurd or not.

Very irritating!!

Granted, we cannot know the full facts, but I still feel it is reasonable to discuss the issue based on the facts that I am aware of.

opinions4u wrote: »

Do you remember typing this?

If you ask your customers to follow certain security procedures, then I think you must accept all transactions that are carried out in accordance with those procedures. If the bank feels that the published procedures are inadequate, and that additional measures are necessary, they should publicly change the procedures.

This goes back to my argument of principle, that the banks ought to be able to come up with transparent systems that are also robust. As I say, I was trying to draw an analogy with computer security.

What I was not saying was that, despite their apparent belief in "security by obscurity", the banks ought to be telling me, an ordinary customer, about any of the systems they have in place. I accept that if they have such systems, they should not be telling me about them.

All I wanted to do was to provide feedback to NatWest that I did not think these systems were operating effectively, given the facts as I know them. It is up to them whether they take that on board, or analyse the facts in this case, but I found it very difficult to get anyone at NatWest even to entertain the idea that a customer could validly provide any such feedback.

jalexa

samizdat wrote: »

In your second paragraph, I don't understand what you mean when you say: "Regarding the transaction issue, why the rant ahead of the complaint final response? That's why there is a complaint's procedure."

Are you saying I shouldn't be posting here until I have followed the bank's complaint procedure to a conclusion?

What I said was "why the rant...", not why the post.

I welcome payment issues being flagged up. An "issue" has occurred but something not yet substantiated by others (although invited) as common or indeed necessarily undesireable. The complaints process by "deadlock" will offer a response, though I predict a "predictable" response. At that stage if not satisfied you will have another option.

samizdat

jalexa wrote: »

I sometimes tidy up immediately after first posting without entering an edit reason. Where I subsequently make substantive changes it is my normal practice to provide an edit reason. *If* I did not do so *and* I changed the post to make it "completely different" more than a minute or so after first post then I apologise.

What are the two versions and timings of concern? Be aware that I would not always give an edit reason for a typo correction or minor word rearrangement therefore post timings may not always be relevant to the substantive content.

I note my original post is 08:19 and last edit 09:01 (cannot remember the reason). I also note your response is 10:33, plenty of time for you to accept the current wording.

Well, I can't remember what you originally said, but I know it was a completely different point. I only noticed your new post because I was going back through the thread to check another point.

As you can see, where people raise actual arguments, as opposed to mere observations, I am trying to respond to the points that people make. There has been a lot of back and forth, and I am just trying to say I might never have noticed your point at all, because I had read something completely different earlier, which in my mind was more in the "observation" category.

I know it's not the end of the World, and I didn't mean to annoy you, but as you can see I have been on the receiving end of some fairly hostile comment, and I want to respond to it as best I can.

samizdat

jalexa wrote: »

What I said was "why the rant...", not why the post.

It is harsh to say it was a rant. Clearly, I am annoyed by NatWest's approach, but I have tried to explain why in this thread.

(1) NatWest send me an activation code.
(2) NatWest allow me to activate the account with the code.
(3) The same day as (2), I attempt a transaction over the phone to an existing payee, which was also the account originally used to fund the NatWest account. NatWest say I should expect the payment to show up in a couple of hours, maybe the next day.
(4) NatWest decide to flag the transaction as potentially fraudulent, and block my account.
(5) I ring up to ask what has happened, and NatWest offer to send me a new activation code.
(6) I can't see how I can use the account at all in these circumstances, so I complain.
(7) NatWest refuse to give me a reference number for my complaint, and I have to tell the story to three different people over a two-hour period before anyone will give me a reference.

Yes, I found that pretty annoying, and I want to warn other people about the experience.

jalexa wrote: »

I welcome payment issues being flagged up. An "issue" has occurred but something not yet substantiated by others (although invited) as common or indeed necessarily undesireable. The complaints process by "deadlock" will offer a response, though I predict a "predictable" response. At that stage if not satisfied you will have another option.

I too predict a "predictable" response, which is another reason that I wanted to describe my experience here.

I think my best option, or at least my preferred option at this point, is not to deal with NatWest.

jalexa

samizdat wrote: »

(7) NatWest refuse to give me a reference number for my complaint, and I have to tell the story to three different people over a two-hour period before anyone will give me a reference.

I only want to deal with (7) here (because I am not in agreement about "the issue").

You describe a very common failure to implement their own complaint's procedure. I am not certain if a "reference" is generated immediately (something for an insider) but according to the complaints procedure a complaint can be registered in an number of ways. Then the procedure describes the first stage response timeframe (one week). The issue must be responded to or a holding response sent.

I always allow time for the holding response not to be sent. Then if no holding response contact Customer Relations.

IMO you can play this smarter.

samizdat

jalexa wrote: »

I only want to deal with (7) here (because I am not in agreement about "the issue").

You describe a very common failure to implement their own complaint's procedure. I am not certain if a "reference" is generated immediately (something for an insider) but according to the complaints procedure a complaint can be registered in an number of ways. Then the procedure describes the first stage response timeframe (one week). The issue must be responded to or a holding response sent.

I always allow time for the holding response not to be sent. Then if no response contact Customer Relations.

IMO you can play this smarter.

OK, but honestly I am not really trying to trip up NatWest, or trying to get any money out of them, other than my own money.

I just want them to at least examine the facts, and see if they can improve their systems. While I accept that we cannot know everything behind their decision to block the account, I do feel the nature of the attempted transaction was, on the face of it, entirely innocuous.

All I wanted them to say was, "I see your point, thank you for your feedback. We will certainly pass these details on to our security team, and I do assure you that they constantly review the security arrangements we have in place, balancing the needs of our customers to access their money with the need to reduce the potential for fraud. We take our customers' feedback very seriously.

In the circumstances, because this has inconvenienced you, we would like to offer you the option of visiting any branch within the Royal Bank of Scotland Group with your passport, where we will be happy to arrange for your funds to be transferred in accordance with your instructions. In case this is not convenient, perhaps you would like us to send you new activation codes by courier to your registered address.

Once again, I do apologise on behalf of the Bank."

stclair

jalexa wrote: »

I only want to deal with (7) here (because I am not in agreement about "the issue").

You describe a very common failure to implement their own complaint's procedure. I am not certain if a "reference" is generated immediately (something for an insider) but according to the complaints procedure a complaint can be registered in an number of ways. Then the procedure describes the first stage response timeframe (one week). The issue must be responded to or a holding response sent.

I always allow time for the holding response not to be sent. Then if no holding response contact Customer Relations.

IMO you can play this smarter.

A reference number is generated straight away and the concern is queued electronically for the "Care Team" to be allocated to a case handler who "should" respond to the customer within 5 working days.

coldhandoff

Are your contact numbers up to date? When the fraud team put direct payments on hold they try to contact the customer to authorise it before the payment ends up being rejected.

samizdat

coldhandoff wrote: »

Are your contact numbers up to date? When the fraud team put direct payments on hold they try to contact the customer to authorise it before the payment ends up being rejected.

Finally, an actual question relating to what happened!

You also have touched on one of the problems that may have caused this. NatWest did not have a phone number on file for me.

I had a slightly surreal conversation with the manager in the complaints department, who asked me the same question. Surreal because he refused to tell me whether this would have made any difference. Apparently, because NatWest believe in secrecy, he could not discuss with me what would have happened if I had a number on file.

I find it hard to accept that having a number on file would have increased the security of the transaction because, on the day of the transaction, I had just reactivated my online account, and within that interface it is possible to update one's contact details, including phone numbers.

NatWest knew this - that I was completing a postal reactivation and trying this specific transaction - because, on the day of the activation and transaction, I rang them to question why I was unable to make a payment to an existing payee (set up with the card reader months before) after just reactivating my account.

I was annoyed by this, because I had rung NatWest several days before to ask how to access my money. I told them that I had set up the account a year or so before, but had run into difficulties with managing my password manager. I was told: "You have an internet savings account, you can only access the money online. We will send you an activation code in the post."

I was not told, "Oh, by the way, even when you reactivate, we probably won't even let you make payments to your existing payees unless you also re-verify them with your card reader".

But, while I was on the phone shortly after reactivating, it was suggested by NatWest that I could make the transaction by telephone banking. The internet banking team transferred me to the telephone banking team, and I was apparently allowed to complete the transaction.

While I was complaining about all this the next day, one of the time-wasting solutions suggested to me was that I could in fact reactivate my online banking with my debit card without needing to wait for an activation code to be sent in the post. Actually, this is true, and would have have saved me several days of time earlier in the process, had NatWest bothered to tell me about it.

It did not help me get my money then and there, because even though you can get access to the banking interface, and make internal transfers (e.g. from esavings to current account), NatWest won't allow any payments to go externally until the card reader is used, EVEN THOUGH THE CARD READER WAS USED TO SET UP THE PAYEE in the first place, and the payee was the original source of funds to NatWest.

However, once you have money in the current account, it means you can go to a branch. NatWest didn't tell me, when I first asked how to access my money, that I could activate my online banking with my debit card, make an internal transfer to my current account, and then go to a branch.

A word of warning, though, is that the complaints manager told me branch transfers can only be done by CHAPS. Is this true?

opinions4u

Lots of things in that last post that could / would trigger various anti-fraud measures.