Exchange rant/warning

sousie27

Having never come across anything like this before, hopefully in the right forum, I am posting what has happened to me as a warning that even a purchase which is satisfactory and straightforward could cause an unforeseen problem in the future.

I bought a laptop online from a reputable store. I was completely satisfied with it and all was well until suddenly 4 weeks later I received an email from them confirming that I had made a telephone enquiry saying I wished to return it and replace it with another model costing £300 more. The replacement was down for next day delivery and the collection date for the original was to be 3 days later. I rang them immediately to say they had made a mistake as I had done no such thing, so they agreed to put a stop on the transaction. I then checked my account on the store's website and discovered that the address to which the replacement was being sent was not mine. It also stated that my credit card would be debited with the full amount of £900+ and the difference was to be refunded when the returned item had been received and checked by them. Thankfully, presumably because I had notified them, nothing was taken from my credit card but I informed the bank anyway and it was cancelled.

I have been in contact with the store several times and they are basically saying that this was a fraudulent attempt to obtain goods which is being investigated as such. It seems that someone rang them and managed to convince one of their agents into believing that it was me, which is why they agreed to go ahead. The arrival of a courier at my door to pick up the so-called return seemed to confirm this. Needless to say he went away with nothing. So, in other words, they were going to send this so called replacement to an address 150 miles away from where the original was to be collected!

I take my security very seriously and follow all the appropriate measures, so I have been absolutely shocked by this and worried as to how it could have happened. So it just goes to show that anything can happen no matter how safe you think you are. I haven't named the store as it's still an ongoing investigation and I'm not yet in possession of all the facts from their end, but I'd be very interested to hear what others think.

sousie27

Well I've received an email from them(it's John Lewis.com)saying that they don't know how this fraud happened and they have been made aware that as long as my card has been cancelled, and I have deleted the cookies off my browsing history this should stop things like this happening again. They have now put in strict procedures to make sure. They also hope it does not deter me from internet shopping. Well it undoubtedly won't, but I'll still think twice before shopping there again.

DCFC79

Ive used JL.com before and been happy with it and nothing has happened like what the OP experienced.

chuckley

sounds well dodge. but ive never shopped with them myself.

hopefully they get to the bottom of it sharpish!

Littlestars_2

it could be if your online account has been compromised or your email address hacked into. They will tell you they don't know how it happened because of data protection (and because it can be really hard to tell how sometimes), legally when fraud happens all the customer can be told is that its fraud and nothing else and to do the usual - go to the police, cancel card, change online passwords etc.

But it seems more likely your online account has been hacked because how would they know about the other laptop unless they could see your history.

tom15387202

It doesn't matter how safe you think you are when buying on the high street or on the internet.

There is someone, somewhere in the business that has your card details, full address, telephone number and account details. We just have to trust that the business 100% monitors handling of these details.

Also, if you had any kind of invoice or delivery box that you binned anyone could have riffled through the rubbish and took a punt on ripping you off.

If the thief knows what they are doing they can call a customer service adviser and easily get your account password reset and email changed to allow them full access to all your personal details.

sousie27

That's what I was thinking too, yet they say their site is secure. My computer security is as good as I can get it and I don't take unnecessary risks but I suppose anything can still happen. In the meantime I've done all the usual things. Their last email I think was them telling me sorry, we apologise for what's happened but that's that now so please go away.

Edit
Post crossed with yours Tom....just to add I've still got all packaging, nobody reset my password or changed my email as that's what alerted me to it and stopped them charging my credit card.

securityguy

sousie27 wrote: »

That's what I was thinking too, yet they say their site is secure. My computer security is as good as I can get it and I don't take unnecessary risks but I suppose anything can still happen. In the meantime I've done all the usual things. Their last email I think was them telling me sorry, we apologise for what's happened but that's that now so please go away..

The problem for retailers is that there are two way the same phone call can go.

1. Company that prides itself on customer service receives a phone call from a slightly hesitant person who says that they're a bit hazy about using computers, but they do a bit of online shopping and are having a problem with their account. Could the retailer help? Being helpful, they do some ad hoc things to try to establish identity and then do whatever the customer is asking for.
   
2. Company that prides itself etc. Being security conscious, they run through a properly constructed process in an attempt to verify security and, finding it doesn't check out, tell the customer they cannot help.

For every case where scenario one is the right response, and scenario two will see someone complaining to you and yours about rigid and inflexible online retailers with their stupid security policies, there's a case where scenario two is the right response, and scenario one will see someone complaining to you and yours about lax security leading to potential substantial losses. There's little the customer can do about this with computer security, because the issue here is precisely that a helpful retailer is doing an end run around the security process, an end run which nine times out of ten results in a happy customer.

I would guess that John Lewis are more likely to get into this situation than some other companies precisely because they want to be helpful.

This problem gets even worse when multiple companies are involved, where company one will release information that's harmless to them, but company two will then accept for making transactions (see for example here). It's noticeable that in this example, the original problem was Apple (who pride themselves on customer service) being helpful.

sousie27

Yes, I can well believe that 1st scenario. On the occasions I've phoned them myself, they asked for name, 1st line of address and postcode. I don't know what other procedures thay may have put in place since then.

That article made interesting reading....scary stuff.

Littlestars_2

Yes they do ask for first line of address, name and postcode but other questions can be asked as well if its a security issue or the agent feels it may be dodgy. The issue is it can be really hard trying to tell if someone is a scammer or not because they can sound so genuine but at the same time there are quite a lot of lazy ones out there as well that as soon as they speak you know.

If someone called up claiming to be you then they would need to know your name, address, postcode, card number (to verify the extra payment details if it was coming from your card) and the fact you bought a laptop from them which would make either your emails or account being compromised likely because they would need this information.

Fire_Fox

I wonder if someone you know has passed your details on. Even with good security you can still be spied on or hacked - might be worth checking with the Techies board if there is anything else you could/ should be doing. For example you say you have now deleted the cookies - instead download a programme called CCleaner which will get rid of more than just cookies, other rubbish that is a security risk or clogs up your machine.