Vodafone allowing calls at other customers' expense via security loophole

NFH

I have a Vodafone PAYG SIM card that I use for data roaming when I don't have a local SIM card. Because of some mistakes by Vodafone's e-mail based support team, I had to phone Vodafone customer services. I therefore phoned them on 08700 700191 using inclusive calls from my fixed line. When you get through, it asks you to enter your Vodafone number. Then before you enter the queue, it tells you that 25p will be deducted from your balance, even if you're calling via the 0870 number. It turns out that Vodafone makes this charge even if you never get through to an advisor (as they cut me off while in the queue when my call continued past their 8pm closing time), but that's beside the point.

The security loophole is that there is no validation that the caller is the customer of the entered Vodafone number. When you eventually get through to an advisor, they ask for your Vodafone number again, so it would be very easy to enter someone else's Vodafone number to enter the queue and give your own number when you eventually get through to an advisor. The purpose could be:

• To phone Vodafone customer services at another customer's expense
• To deplete the PAYG credit of someone you don't like by making repeated calls without getting through to an advisor

In either case, it's difficult for the victim to notice because Vodafone, unlike other networks such as Orange, neglects to provide any itemisation on PAYG accounts.

Guys_Dad

If you are correct - and I don't doubt that you are - then this is a scandalous bug. I would suggest you email the Vodafone rep using their normal communication that's been on so many threads here and get them to investigate.

chanz4

Any mobile tells you that your charged, it works on the number you call off. same as if you phone it off your landline bt charge you

Guys_Dad

chanz4 wrote: »

Any mobile tells you that your charged, it works on the number you call off. same as if you phone it off your landline bt charge you

Try reading the post again- carefully, particularly the bullet points.

MikeWhite

Well, on the Vodafone web site it says
Call us

Pay monthlyPay as you goFrom a Vodafone mobile191 (Calls to this number are free)191*From another UK phone08700 70019108700 776655From abroad+44 7836 191 191+44 7836 191919Join Vodafone08080 408 408
- General enquiries - Monday to Sunday, 8am-8pm
- Lost or stolen mobile phones - 24 hours a day
- Calls may be monitored for quality and training purposes

*Calls to 191 from a Vodafone Pay as you go mobile are free. If you opt to speak to an adviser you'll pay 25p for the whole call.

So I cannot see how they can (legitimately) charge you 25p if you are calling the 08700 number.

Mike

Techhead_2

MikeWhite wrote: »

Well, on the Vodafone web site it says
Call us

Pay monthlyPay as you goFrom a Vodafone mobile191 (Calls to this number are free)191*From another UK phone08700 70019108700 776655From abroad+44 7836 191 191+44 7836 191919Join Vodafone08080 408 408
- General enquiries - Monday to Sunday, 8am-8pm
- Lost or stolen mobile phones - 24 hours a day
- Calls may be monitored for quality and training purposes

*Calls to 191 from a Vodafone Pay as you go mobile are free. If you opt to speak to an adviser you'll pay 25p for the whole call.

So I cannot see how they can (legitimately) charge you 25p if you are calling the 08700 number.

Mike

That's the whole point of the thread! They are doing it, but they shouldn't.

NFH

MikeWhite wrote: »

So I cannot see how they can (legitimately) charge you 25p if you are calling the 08700 number.

I suppose the only justification is that there is an audible warning before you enter the queue that you will be charged 25p "for the service". The problem is that you are also charged even if you don't receive the service, i.e. don't get through, or if someone else enters your number.

forgotmyname

I had noticed that PAYG users were charged to call customer services but not pay monthly.

But thats a bit naughty if i can call giving someone elses number and they get charged.

I would have assumed it was the caller being charged, As would many i presume.

Well spotted. All i need now is a PAYG Voda customer to test it on.

Does this only work with the 0870 or 191 also?

I did wonder if i could use my contact phone to call them for a PAYG customer without a charge?

Techhead_2

forgotmyname wrote: »

I had noticed that PAYG users were charged to call customer services but not pay monthly.

But thats a bit naughty if i can call giving someone elses number and they get charged.

I would have assumed it was the caller being charged, As would many i presume.

Well spotted. All i need now is a PAYG Voda customer to test it on.

Does this only work with the 0870 or 191 also?

I did wonder if i could use my contact phone to call them for a PAYG customer without a charge?

I'm guessing you accidentally phrased that wrongly and aren't another one that didn't read the OP.

I guess you mean " Does the caller enter the number, they are calling about, if they are calling 191 from a contract Vodafone? If they do is the PAYG customer charged?"

NFH

Now that we're starting the working week, could the Vodafone Company Representative please address this issue?

Vodafone

Hi NFH,

I am slightly confused by your post.

You mention that you called from a landline on 08700 700 191. This may or may not be inclusive as part of your landline package. It will be down to your current provider.

If you call from a Vodafone PAYG number, you would be charged 25p for the call which would be deducted from your balance and you would be notified at the start of the call.

This is shown online here.

Does that clear up any confusion?

Thanks,

Heidi
Web Relations Team
Vodafone UK