Unauthorised direct debit set up!

grumbler

Hominu wrote: »

So customers set up DDs on the CC/etc, then complain about late payment fees and other charges because they forgot to check for when the DD made it onto the system so they could ring up the bank and tell them they wanted it made active. Or do you mean that the bank should send a letter to the account holder asking them to confirm the DD? Neither is really practical IMO.

Don't make this more complicated than it actually can be.

1. I give my permission to a company to set a DD. At this point they inform me that I will need to activate it when they set it up and let me know.
2. The company sets it and contacts me as we agreed earlier (letter/email/phone call/text) asking to activate it.
3. I am expecting this correspondence and activate the DD as soon as I receive it. In online banking it's simply ticking a tickbox.

As simple as that. If I knew that it needed activation and have not done this for some reason before the deadline, I have to use an alternative way to pay.

I know simplicity is good, but it shouldn't be a priority at the cost of security. Taking money from other people's accounts is a very delicate thing and has to be treated accordingly.

A better idea would be the other way around: Secure or text message (but not email) saying something like "A new direct debit has been setup on your account to company X, If you have no knowledge of this please contact us."

E-mails and texts are not everyone's cup of tea. And I am not supposed to keep contacting my bank because of some bogus DDs set up in my account by some unscrupulous 'approved originators'. In Jeremy Clarkson's case it was an 'approved originator' too that in fact not only passed the power to set DDs on their behalf to virtually everyone, but also allowed doing this anonymously.

Gromitt

grumbler wrote: »

And I am not supposed to keep contacting my bank because of some bogus DDs set up in my account by some unscrupulous 'approved originators'

How many bogus DDs have you had setup on your account? I have 10 current accounts and only ever had 1 bogus DD which I noticed and cancelled before they took any money.

grumbler wrote: »

In Jeremy Clarkson's case it was an 'approved originator' too that in fact not only passed the power to set DDs on their behalf to virtually everyone, but also allowed doing this anonymously.

But Jeremy did flash his account number to the public saying "You can't do anything with this", so he was kinda asking for it.

grumbler

Luckily I don't have any enemies wanting to make my life harder than it actually is.

My bank accounts details are available on all my cheques and are stored by many companies that handle them with far less care than if it was card details. No need to flash in public.
And I have never been warned by any bank that I have to keep my account number secret.

Hominu

grumbler wrote: »

[*]I am expecting this correspondence and activate the DD as soon as I receive it. In online banking it's simply ticking a tickbox.

and if you don't have online banking like millions of people? Are you expected to make an appointment with your bank so you can go in and ask the DD to be activated?

Sure, I think your method would solve the "unauthorised DD" issue, but it would cause many other issues, and considering the rarity of an unauthorised DD and the DD guarantee, its not really worth spending the money it would cost to implement it.

Hominu

grumbler wrote: »

My bank accounts details are available on all my cheques and are stored by many companies that handle them with far less care than if it was card details. No need to flash in public.

Your missing the point:

Show your account number to the public and they'll go "meh".

Show your account number to the public and say "This is proof that you can't do anything with this information" and people will prove you wrong.

grumbler

Hominu wrote: »

Show your account number to the public and say "This is proof that you can't do anything with this information" and people will prove you wrong.

No, I have not missed the point. BTW they have proved that the system was wrong as well.
Any well designed financial system can't rely on people being good.

grumbler

Hominu wrote: »

and if you don't have online banking like millions of people? Are you expected to make an appointment with your bank so you can go in and ask the DD to be activated?

grumbler wrote: »

....via online banking, over a phone or in branch...

I don't see why for a DD it has to be simpler than for a single payment or a SO. I think it has to be more secure/protected actually.

its not really worth spending the money it would cost to implement it.

I don't see much costs associated with adding one extra parameter (activated/not) to the databases - especially if this was done gradually over time when paper DD mandates were abolished and replaced with a flawed electronic system.

innovate

grumbler wrote: »

Don't make this more complicated than it actually can be.

Exactly.

Then why are you asking for making things complicated? How many "bogus" DDs do actually get set up? I don't have the figures, and I reckon neither do you. But there are very few I have heard of, and I feel that it would be complete overkill to ask everybody to go through an additional confirmation step, for the sake of making life easier for the handful of people who fall victim to fraudulent DD set ups.

Aside from that, I don't think the banks should sink millions into developing, launching and maintaining the add-on you are suggesting. There are many more pressing issues they should spend their development resources on, e.g. making it straight forward to see what interest rates you are getting/paying.

innovate

antrobus wrote: »

Not quite 'anybody'. You have to be an approved originator to do it.

I think it's worth re-iterating that point. It's quite an involved process to get approved, and the Collector will not be some random Joe Bloggs but an organisation that has been vetted, and has invested significant money in getting approved. Moreover, they are known entities who will have absolutely zero incentive to use Direct Debits for fraudulent collection of money.

http://www.bacs.co.uk/Bacs/Businesses/DirectDebit/Collecting/Pages/GettingStarted.aspx

Gromitt

grumbler wrote: »

I don't see much costs associated with adding one extra parameter (activated/not) to the databases -

Then you've obviously never worked at a bank and don't know how long that would take and how many people it would involve, and every bank adding it would be mammoth task. Then all the companies who use DDs will have to update there systems as well so when they setup a DD they could recognise when the bank had processed it so they could ask you to activate it.

I'd estimate that simple change could easily run into millions of pounds spent, for the few people who have had bogus DDs setup.

How much fraud can you actually generate with setting up DDs? Pay someones credit card bill? Pay a charity? Order a subscription? All can be reversed. The only downside I see is if a bogus DD occurs that causes other payments to bounce which may cause a small amount of hassle (the bank would refund the money and any charges)