hsbc customer service and fraud department

nzj

I need some legal expert advice and would like to know if this has happened to anybody else.

Last year June/July my partner and I joined HSBC so we could have two separate but joint accounts. This was all done by phone and email. The pin pad and details took long and the mandates were only received and sent in December 2012. In the meantime my partner used his debit card and I would use his online log in details to transfer monies between my account and his. It was not the most correct thing to do but we thought we had a joint account anyway and it was working.

My partner travels to and from London on a regular basis. Almost a month ago £500 was taken from his account. I immediately alerted our account manager and my partner who was abroad at the time. He failed some of the security questions and was told that I was not supposed to have access to the account as it was not a joint account.

A couple of minutes later our account manager phones me and apologises saying that a form was missing on our mandates and so it was made in error. We then had to wait till my partner came back to the uk two weeks later to do the passport check. After much chasing, we finally got a meeting booked. We filled in their missing form and asked about our money from this unauthorised transaction after we had both confirmed that it had not been either of us. They told us that they would not take responsibility and should phone the action fraud team, 20 days later after the act. We told them this was unacceptable and after much insisting the are now looking into it.

I am quite desperate and unhappy as it looks as if their fraud department did not bother to look into the transaction when it was reported almost a month ago. They just told us to report it, 20 days later. We have reported it and this week I have looked at some details that are on the transaction. We only got this a few days ago as the account was blocked.

They said they would let us know this week but now we feel they are not investigating and all our money is gone.

I have read that the usual procedure is a reverse transaction while the bank investigates. The bank then has 10 days to get back to the client with answers. I know we need to work this out with the bank and wait for a final decision before we can go to the ombudsman.

Is this right? I acknowledge that my partner and I should not be using each others log ins. That said, HSBC did not send us anything else and according to written proof, we have had a joint account since December, which should have been since July/August last year anyway.

My conclusions: it has taken a year to get a joint account and now £500 has been stolen online and they seem to want to blame us without being accountable for their mistakes or offer any sort of compensation as I have been doing a lot of homework and traveling to and fro to see if I can get an answer to this unauthorised transaction. This last part should be the fraud department, right?

innovate

what proof did you offer HSBC and/or the Police that the money has been stolen?

nzj

The transaction was made to someone neither of us know. I did tell them to check the IP address. I had just made a transaction 3 minutes before, which I can confirm is mine. This one is for someone that was added to the payments, to an unknown name and exactly 3 minutes after I had done my transfer.

Also, if you look at the history, the only online transfers are between my partner and I, so this one definitely stands out. Proof will be if they check the IP address and the originating location, which is not my home which is where I was

pmduk

If you completed the documentation for both accounts as joint accounts, but HSBC has mucked up the account opening. I'd make a formal complaint.

Perhaps someone can clarify does each joint holder of an HSBC account use the same login data? If so their response that you shouldn't have shared this is irrelevant.

rb10

pmduk wrote: »

Perhaps someone can clarify does each joint holder of an HSBC account use the same login data? If so their response that you shouldn't have shared this is irrelevant.

No. Each party will use their own login details.

nzj

Well, they told us we had to have Separate log in details. However, to date nothing had been sent to me to use although we did send them all the mandates requested in December 2012. Obviously, they have made an error by missing a form which we have now signed on Friday. They did not send us separate log in details to my partner or i.

However, they are now saying this is breach of contract as my partner had given me his details. If I understood correctly, that's why they did not even bother looking into it.

I did not even receive a call confirming if it was me or not. They can easily follow ip address and look at originating location but they have not done that.

I'm going to complain as it was their error which made this whole process longer. Should I wait till a final decision or just make a separate complaint regarding the joint account error?

Thank you so much for all info

innovate

How do you prove that the transaction was made to someone neither you nor your partner know? Why do you think that a first payment to someone is proof that it's a fraudulent payment? Why do you think that a transaction within 3 minutes of when you made a transaction you acknowledge as valid should be invalid?

Do you realise that none of your explanations so far sound like proof that your account has been used by someone without your permission?

Did you forget to log out after the transaction you acknowledge was valid? Could someone else have used your account within 3 minutes?

Have you scanned your computer for viruses and keyloggers?

If you were your bank, what proof would you expect from you that it wasn't you (or your partner, your mum, dad, uncle, cat etc) that used your account?

nzj

Thank you for your feedback. You have asked a lot of useful questions and a new perspective. So I will answer as follows:

The name on the transaction is unknown to both of us. Neither of us had heard of him before. Also the reference that was used was for a supermarket store that we do not have near our home here in the uk or abroad. I have visited their head office and they have investigated and sent me an email with a formal letter confirming that the transfer couldn't have been done by them or any of their employees.

We are saying that the payment is fraudulent add they actually set him up add a payee when there had only ever been one payee, which is my account. Along the history of payments, it has always been between my partner and I.

It is an invalid transaction as I did not make that transaction not did my partner. I did make the one before that that had originated from my other account.

I can guarantee that I did not give anybody permission to make this transfer and that i was at home when this took place and the originating location on the fraudulent transaction is not my home address. It's a research facility.

I always log out of my accounts online, and this includes this forum. I worked in offices so I know how important it is to always log out. They had a three minute window where I could have been working out our accounts. However, when I logged out, this transaction was not on the statement.

I have scanned my computer and try do that regularly with the anti virus installed. If there had been a virus, the bank account would not have opened, right? The banks have that security too?

I would like to prove the IP addresses used to show that this was not from my partner or I. I can get the IP address from my computer and take it to the bank. That I can prove. Regarding family etc, neither of us have ever written down or given out those details to anyone as it is our account only.

If I could find the originating IP address, that would prove that it was someone else at another location. How could I go about that? I have been to the bank the transfer was made to but they can't help because of data protection and it should be HSBC investigating.

Anymore suggestions?

rb10

nzj wrote: »

I can guarantee that I did not give anybody permission to make this transfer and that i was at home when this took place and the originating location on the fraudulent transaction is not my home address. It's a research facility.

Could you please explain what you mean by this part - what is the 'originating location on the fraudulent transaction'?

Is this a debit card payment, rather than an internet banking payment?

innovate

Look at it from the bank's side. Your assertions look quite thin.

nzj wrote: »

The name on the transaction is unknown to both of us.

what proof you you have for this?

nzj wrote: »

I have visited their head office and they have investigated and sent me an email with a formal letter confirming that the transfer couldn't have been done by them or any of their employees.

what did the bank say when you presented that letter?

nzj wrote: »

Along the history of payments, it has always been between my partner and I.

a transaction to a new payee is not proof that the transaction is fraudulent

nzj wrote: »

It is an invalid transaction as I did not make that transaction not did my partner. I did make the one before that that had originated from my other account.

the fact that you agree to a valid transaction 3 or so minutes before the alleged fraudulent transaction does not work in your favour.

nzj wrote: »

I can guarantee that I did not give anybody permission to make this transfer and that i was at home when this took place and the originating location on the fraudulent transaction is not my home address. It's a research facility.

you can say you guarantee it - -- - but how do you prove it? Valid financial transactions can be made from research facilities. How do you know where the allegedly fraudulent transaction was made from? Did the bank give you the IP address that they recorded against the transactions? How do you prove it wasn't you / your partner / someone you know who used the IP address at the time of the alleged fraud?

nzj wrote: »

I always log out of my accounts online, and this includes this forum. I worked in offices so I know how important it is to always log out. They had a three minute window where I could have been working out our accounts. However, when I logged out, this transaction was not on the statement.

Again, what proof do you have?

nzj wrote: »

I have scanned my computer and try do that regularly with the anti virus installed. If there had been a virus, the bank account would not have opened, right? The banks have that security too?

It's not just viruses you have to fear Not sure what you mean by "the bank account woul not have opened if it was a virus" - - - can you explain further please?. Keyloggers are the more likely culprit, and AVs don't usually spot it. Have you run Malwarebytes?

nzj wrote: »

I would like to prove the IP addresses used to show that this was not from my partner or I. I can get the IP address from my computer and take it to the bank.

This will be very hard to prove because IP addresses can usually be changed at will. And in any case, just because you might be able to prove (are you?) that you were only able to use IP address A yourself (really hard to do), it doesn't mean that you didn't know that someone at IP address B accessed your account. But in any case, didn't you say the originating location of the fraudulent transaction was a research facility? How do you know, what proof do you have for it?

nzj wrote: »

If I could find the originating IP address, that would prove that it was someone else at another location. How could I go about that?

Your bank will most likely have a record of the IP address the transaction was made from (assuming it was an online transaction - -- how do you know it was?). They will also be most unlikely to tell you what that IP address was. More importantly though, what would you do with the IP address if you knew it? How would you prove it wasn't you / your partner / anyone you know that used that IP address?

nzj wrote: »

If I could find the originating IP address......

didn't you say the transaction was made from a research facility? How did you identify that research facility if not by IP address? Loads more questions about this....................

Scarpacci

Don't online payments to new people generally require a code to be generated by the pin pad? If this was the done, it would make it difficult to see how it could be fraudulent. That would certainly weigh strongly on the bank's suspicions.

Also, though I'm not an expert on banks' security systems, I'd be surprised if it's possible for an on-line banking session to work from another IP address. As soon as any page was requested or action submitted with a different IP address, I should think it would terminate the session. I've worked with less important online services and that security policy has often been present. For banking, it would seem prudent to require a user to re-authenticate if their IP happens to change. So for this to be fraudulent, I'd expect it would have to be done through your PC and thus it would be your IP on record for both transactions.