Natwest Security issues?

Agricolae

Well your account has definitely been compromised.

Sounds like an attempted ACTO (Account Takeover).
In order to do all of that, the fraudster would have needed:
1. Account number and sort code.
2. Customer number.
3. Your full debit card details.
4. Complete personal details (full name, address, DOB etc.)
5. Possibly other details as well.

You probably never got your details wrong - the fraudster may have had a pop at your online security and failed it. If they were then able to set up new details then think about the amount of information that you had to enter to go through the reset procedure and consider that this is the amount the fraudster would have needed.

To get that emergency cash the fraudster would have needed full online access and have completely compromised the accounts.

The most common way to obtain these details is through social engineering although you don't seem like the type of person who would be suckered.

Blackpool_Saver

Social engineering? what's that?

Edited to add, have looked it up now

Agricolae

Blackpool_Saver wrote: »

Social engineering? what's that?

It's basically when you fool someone (or someone they know) into giving out their personal details. It includes phishing.

dalesrider

philhoward wrote: »

I don't remember the exact conversation, but it was a 2 way exchange of information - and backed up with a letter I received 2 or 3 days later. If it wasn't genuine, then they've been acting as go-between me and NW! There was no mention of Debit Card details or Bank Account number that I recall from that conversation.

Did they say they were from Nat West on that call?

Did it follow standard Nat West out bound security?

I take it that you did recieve a new credit card ?

What was in the letter?

If someone has reported a card lost, they would not know the card no.... So they would not ask for that info. I would wonder how many people actually know their sort/account number as well.

Have you confirmed with Nat West that they made that call?

jalexa

dalesrider wrote: »

Did it follow standard Nat West out bound security?

Sorry, what is "standard Nat West out bound security"?

Agricolae

There is no such thing as standard outbound security. Different departments have different procedures.

philhoward

Just incase I give anything away, NW told me things only they could know to confirm my details, and reciprocally.

Yes, I received a new card and a change of CC account number.

As for my account being hacked (in whatever way it was), it seems they got my online access somehow as I don't think they could have changed the password any other way (as I was told by the fraud team - they told me how many characters the password now was and it wouldn't have been the one I would use).

All I can say (thinking back to the last months access) is that I didn't use online banking through the hotel Hotspot internet, and when the "access denied" pages came up, it was the same page on 2 different machines, accessed from two different countries via two different ISPs. They (Fraud team) could tell me that the password was changed from an O2 internet access point (I don't use O2). Each time the "access denied" page popped up it appeared identical and the security signature bar in my browser had the green tag to it - and I don't use Internet Explorer purely as I know IE has "issues".

Malware bytes and anti-virus scans have come up clean on every machine I use, and I've had a text from NW to say my new card is due within 24 hours. At least then I can see if anything else has happened to my account...

When applying for NW online banking (its been a long time...), do they ask for full account and card details? Getting paranoid now...

dalesrider

Agricolae wrote: »

There is no such thing as standard outbound security. Different departments have different procedures.

Don't they ?

Nat West should have laid down standard procudures for ALL departments when contacting customers.
Any variation of this should/will be a sackable offence. As would be a serious information risk.

As to what is standard, is going to vary across diffrent banks.

HSBC simply want to know from me 2 numbers out of my DOB. Yet halifax want to know far more... In fact I stopped and told the person from Halifax. he is not getting anymore details :eek:

philhoward

Perhaps you mean the number of questions, rather than what those questions are?

pmduk

dalesrider wrote: »

Did it follow standard Nat West out bound security?

I suggest there's a problem in that few bank customers know what the bank's outbound security is?

I remember Natwest's complaints people being very surprised when I wouldn't confirm my bank details until they confirmed who they were.

Personally, I now insist on returning calls to a published number with which I am already familiar.