Help please!!! transferred £300 into the wrong account.

JuicyJesus

matttye wrote: »

He just said the payee's e-mail account was compromised and the sort code and account number replaced.

That could have meant amending a draft e-mail that contained account details, or a man in the middle attack, whereby the data would go through a third party and said third party would amend the data, before forwarding it onto the rightful recipient.

Which is an awfully long length to go to - to use a man-in-the-middle attack go into one particular person's email account and amend the sort code and account number which they may or may not have in an email containing payment details which they may or may not have in the hopes that one day they'll send some money to it. As opposed to just hacking the person's bank account or harvesting other personal information.

You do realise how ludicrous an idea that is, right?

matttye

JuicyJesus wrote: »

Which is an awfully long length to go to - to use a man-in-the-middle attack go into one particular person's email account and amend the sort code and account number which they may or may not have in an email containing payment details which they may or may not have in the hopes that one day they'll send some money to it. As opposed to just hacking the person's bank account or harvesting other personal information.

You do realise how ludicrous an idea that is, right?

You know bot nets sometimes consist of thousands or even millions of infected PCs, right? This could just be one of many victims; it just so happens the poster has only mentioned this one.

Replacing a sort code and account number in an outgoing e-mail wouldn't be that hard, even I could do it. They could just match dddddddd and dd-dd-dd and replace it with their own information. Even if those matches aren't actually meant to be an account number and sort code, who cares? Such a match will also replace an account number and sort code. It's like phishing e-mails; the majority of people won't be caught out, but it's worthwhile simply because many will.

noelphobic

matttye wrote: »

Simple solution to this problem: SEND A £1 TEST PAYMENT.

I know, I know. I'm a genius.

I did this recently but it caused me problems. If you send a £1 payment to a new payee and then send a higher value payment very soon afterwards this is flagged as suspicious and the 2nd payment may be delayed or failed.

matttye

noelphobic wrote: »

I did this recently but it caused me problems. If you send a £1 payment to a new payee and then send a higher value payment very soon afterwards this is flagged as suspicious and the 2nd payment may be delayed or failed.

Indeed, the same thing happened to me. I'd rather that than send it to the wrong account though. Seems the lesser of two evils to me.

If I needed the money quickly that might have been a different matter; in my case I was just moving savings around.

John1993_2

pqrdef wrote: »

In any case, this sort of issue is indeed the fault of the banks, because if the system were properly designed, it would be much harder to make this kind of mistake.

Basic incompetence.

Your first point is wrong, your second one is right, it's basic incompetence by people not checking that they are typing in the numbers correctly.

People need to take some responsibility for their actions, instead if looking to blame others for their own mistakes.

It's attitudes like yours that are leading us into a nanny state where we aren't allowed to do anything any more. You want to be treated like an infant, not an adult, and have someone else fix your screw-ups, probably while patting you on the head and telling you you're not really at fault.

For those of us who've learned to be accountable for our own actions, attitudes such as yours are incomprehensible. They are self-harming, too. You'll never get far in life unless you understand and take blame for what you do.

matttye

John1993 wrote: »

Your first point is wrong, your second one is right, it's basic incompetence by people not checking that they are typing in the numbers correctly.

People need to take some responsibility for their actions, instead if looking to blame others for their own mistakes.

It's attitudes like yours that are leading us into a nanny state where we aren't allowed to do anything any more. You want to be treated like an infant, not an adult, and have someone else fix your screw-ups, probably while patting you on the head and telling you you're not really at fault.

For those of us who've learned to be accountable for our own actions, attitudes such as yours are incomprehensible. They are self-harming, too. You'll never get far in life unless you understand and take blame for what you do.

Banks need to be make it clear that the account name is not part of the equation, like Lloyds does:

Please check you have entered the sort code and account number correctly to avoid lost payments. Our payment systems use both of these details and they are not checked against the name. If correct please click on ‘Confirm’ below.

Santander asks you to check details but says nothing about not using the account name:

Before we carry out your request, please check that the following details are correct.

Otherwise, it is a reasonable assumption that the bank will take all of that information into account and will throw out an error if it doesn't all match.

John1993_2

matttye wrote: »

Banks need to be make it clear that the account name is not part of the equation.

Of course they don't need to do this. You might like them to, but this doesn't make it a need.

Fortunately most people have the sense to check before hitting send. Those that don't are likely the same people who need labels on shirts saying "don't iron while wearing".

Sadly, with the best will in the world, there are some people who should always ask for a friend's help when dealing with money (or irons), and the rest of us prefer that systems not be designed with this small minority in mind at a cost to everyone else in times of extra time or complexity.

matttye

John1993 wrote: »

Of course they don't need to do this. You might like them to, but this doesn't make it a need.

Fortunately most people have the sense to check before hitting send. Those that don't are likely the same people who need labels on shirts saying "don't iron while wearing".

Sadly, with the best will in the world, there are some people who should always ask for a friend's help when dealing with money (or irons), and the rest of us prefer that systems not be designed with this small minority in mind at a cost to everyone else in times of extra time or complexity.

Why ask for the information if its not going to be used? Seems redundant at best and misleading at worst.

In any event, you took what I said too literally. I, of course, meant they should display such a notice.

There will always be stupid people, but banks should still try to assist in whatever way they can. If that means displaying an alert to the effect of, 'hey stupid, make sure you're entering the right account details here otherwise you'll be giving your money away to the wrong person. Oh, and by the way, the account name doesn't mean jack' then what's the harm?

robatwork

I have just check the Santander Set Up a New Payment page.

It looks like this:
(*) Payee name:
Enter recipient´s account details here:
(*) Their sort code: - -
(*) Their account number:
(*) Payment reference:

If you would like to make a payment please complete the details below and click "Continue". If you only want to save the payment details then click "Continue" now.


There is nothing to say that the account number and sort code are the only things that are actually used in the transfer - indeed the "payee name" is the first (hence most important?) item, and all are starred, meaning obligatory fields. It's not at all obvious that the payee name isn't checked when setting up a faster payment.



Santander could and should be a lot clearer on this page - putting account number and sort code first and some clear text on the lines of "These are the only data actually used in identifying the recipient account. Ensure you have double checked as we can't refund in the event of a mistake in these two fields".


Then their dismissive attitude to a typo would be more understandable.

~Chameleon~

I'm struggling to understand why some people are struggling to understand that the bank can only process the information input by YOU :wall:

If YOU make a mistake, then it is YOUR fault if the funds go astray!

When you type in a phone number to make a call, the phone company only processes that number which you input. It doesn't check the name you stored it under in your phone equals that of the account holder you are attempting to call.

How can the bank cross reference a name? Do you know exactly how they present their name on their account? The only constants are the account number and sort code and this is what is used to identify the account.