Egg security breach

nrsql

I received an automated call supposedly from egg. It started to ask for security information which I refused to give. It asked several times then said would call later - which it did.
It gave a number to call and a person there (again saying from egg) again asked for security information.
I called egg (on the number for ecurity breaches) who said they do have such an automated system. When I pointed out that this was very much like phishing and no one should respond as it could be from anyone the young lady said she would pass on the info. She said it was not possible to talk to anyone to do with security nor her supervisor nor a manager.
She said the press office was the best she could do but couldn't transfer at that time but gave a phone number.

I note that around that time their web site said it had an error so maybe the automated call was in error too.

For anyone else who receives this call I suggest they ring the Egg press office to complain on 0207 526 2600.

Never give out security information in response to a phone call or e-mail. It is probably someone trying to extract information.
Egg obviously don't take security seriously and you should probably take this into account when thinking of opening an account. It's difficult to get people to react sensibly to phishing when a suposedly reputable company does this.

masonic

How silly. If Egg want to do this, they should set up some security questions they have to answer when phoning you. That or give you a reference number and request that you call them on their published number to discuss anything sensitive. I'd refuse to enter into any discussion with someone who phoned me and couldn't prove who they were.

KTF

I have had a phone call from the automated egg thing in the past - usually when a large purchase trips the fraud bot - and when I phone up egg they ask the usual security questions - dob, maiden name, etc. These are normal for most banks as a means of identifying the person. I wasnt asked for card number or start date, etc.

nrsql

KTF wrote: »

I have had a phone call from the automated egg thing in the past - usually when a large purchase trips the fraud bot - and when I phone up egg they ask the usual security questions - dob, maiden name, etc. These are normal for most banks as a means of identifying the person. I wasnt asked for card number or start date, etc.

Yes - but only when you call the bank. A phone call to you could be from anyone - how difficult would it be for someone tp set up a similar automated call and as people are used to this from egg would they be concerned about giving account numbers etc?

Just as bad the automated call gives a number to call which could have a scam artist at the other end knowing he has a gullible caller on the line.

No institution should call you and ask for security information - it could be anyone.

PBA

I had a call a while ago from the egg automated system. I don't remember it asking for anything over the top, I think it wanted a couple letters from my password and a couple digits from my phone number. Enough for it to verify it was me but not enough for a scammer to access my account. I was certainly grateful to get the call, as there had been fraudulent transactions on my account but the fact that they spotted them and notified me so quickly meant the money got refunded to my account before the next bill was due.

If you do get an outbound call from a bank and don't want to give any security details, just hang up and then call the number on your card.

nrsql

PBA wrote: »

I had a call a while ago from the egg automated system. I don't remember it asking for anything over the top, I think it wanted a couple letters from my password and a couple digits from my phone number. Enough for it to verify it was me but not enough for a scammer to access my account. I was certainly grateful to get the call, as there had been fraudulent transactions on my account but the fact that they spotted them and notified me so quickly meant the money got refunded to my account before the next bill was due.

If you do get an outbound call from a bank and don't want to give any security details, just hang up and then call the number on your card.

Problem is that it doesn't take many calls to get the whole password and it could be set up to forward you to a person once they had verified that you had an account and were willing to divulge info; you then have the problem of remembering that you hadn't initiated the call when they ask for something more - like another couple of digits, your address and account number - maybe mothers maiden name....

chesky369

Yes and if you have all your other accounts on an Egg money manager, they could get through to them without any further validation required.

Paul_Herring

chesky369 wrote: »

Yes and if you have all your other accounts on an Egg money manager, they could get through to them without any further validation required.

Well since the passwords and other validation criteria are stored, and retained, locally on your PC, I fail to see how they can.

Rafter

Not a security breach at all.

I too have been grateful for the egg service preventing a fraud in the past.

The system never asks for complete information.

Personally I would rather than have that that have to pay much more to cover fraud costs or have a call from an overseas call centre to achieve the same thing.

Fraud, which still increasing is still fairly rare and as long as you don't give information like your pin number you are covered by a fraud guarantee under the UK banking code in any case.

There is always the keeping the money in a box under the bed option too.

R.

masonic

Rafter wrote: »

There is always the keeping the money in a box under the bed option too.

There is also the hang up and phone them back option.

nrsql

The concern is people getting used to giving information in response to phone calls - especially automated ones. It's a potential security breach.

I have no problem with an automated call asking you to check the account or call the institution as there may be a problem - as long as they don't give the phone number to call.