Mobile phone - identity theft - fake bank account scam

usignuolo

There is already a long thread here about what happened to me but I wanted to update it in a new thread just to make people aware of this scam and how it works.

Basically there is a scam doing the rounds involving mobile phones being bought on stolen identities with fake bank accounts. In my case the phone was delivered by courier, addressed to me, only of course I had not ordered it. (I did not sign for it someone else in my house did.)

Five minutes later my landline rang - it was someone claiming to be a courier, saying sorry the phone had been misaddressed and they had been asked to collect it. By then I had been on the phone to Phones4U and knew it was a scam, so I told them it had already been sent back.

Further investigation revealed that the scammers had ordered it online, with a 2 year plan, using my name and address, a valid bank sort code and a bank account number which was valid in terms of self checking in the right format but not valid as a bank account at that branch. (And not for me as I bank somewhere else.). It turns out that the phone companies cannot in fact cross check this information with the banks, so they do a security check on the name and address, and on the bank branch and a verification check on the account number (ie it is right length and format and check digit checks out). They are unable to to do more.

The scammers order a 24 month plan with the phone, presumably to make the order look legit, and the phone company duly sets up a direct debit with BACs. Now here is the reason it works, the phone companies send out the phone to the secure address BEFORE the direct debit has been verified by BACS. So when, as it does, it bounces, they realise they have been had. By then it is too late to get the phone back because the unsupecting recipient has already given it to the fake courier.

This scam has been attempted TWICE using my name in the past week. Once with a phone from Phones4U and an Orange Plan, where I realised what was going on when the phone was delivered. And again with a phone from Tesco and a plan from 02, where something in their verification procedures picked up a discrepancy and the first I knew was a letter telling me it had happened. (It may be this was an attempted in person fraud.)

I suspect the whole thing is automated as there are two different spellings of my christian name in circulation and the computer software running the scam did not realise they are both me.......

I spoke today to NatWest where the fake account is supposed to be (I do not bank there) and the fraud guy said they had no idea why the phone companies kept sending out expensive phones before the BACS direct debit had cleared.

grumbler

What's wrong with the old thread?

And what does "direct debit had cleared" mean?

usignuolo

I want people who have maybe not been following the longer thread to know what happened. That thread was on going as things evolved and at the start I did not know what I do now and can summarise here.

Before a direct debit will be paid out on by the bank, they have to verify that there is a legitimate bank account from which to pay it. This happens through BACs. In the case of this particular scam the fake bank account is a hybrid made up of individual legitimate elements but does not exist in its entirety as a bank account. So it cannot be used to pay out direct debits. As soon as the direct debit is presented via the clearing system in this case, it is rejected.

From the bank's viewpoint, if the phone companies did not jump the gun by sending out phones and setting up plans, BEFORE the direct debit has been verified by BACS as payable from a legit bank account, they are behaving recklessly.

grumbler

usignuolo wrote: »

Before a direct debit will be paid out on by the bank, they have to verify that there is a legitimate bank account from which to pay it. This happens through BACs. In the case of this particular scam the fake bank account is a hybrid made up of individual legitimate elements but does not exist in its entirety as a bank account. So it cannot be used to pay out direct debits. As soon as the direct debit is presented via the clearing system in this case, it is rejected.

From the bank's viewpoint, if the phone companies did not jump the gun by sending out phones and setting up plans, BEFORE the direct debit has been verified by BACS as payable from a legit bank account, they are behaving recklessly.

As I have already said in one of your numerous threads (and before), IMO the entire system of setting DDs was flawed.

However, what you say makes no sense.
Firstly, it's Orange, not P4U who sets the DD.
Secondly, it can be easily set for any legitimate combination of a sort code and an account number, like it was in your case. It is unlikely that the account owner notices the new DD in the account until the money is taken - and normally it takes quite a long time between selling a contract and taking the first payment. And many people don't check their accounts for months if not years: Direct Debits: How to cancel and save money

So, Natwest can hypocritically blame p4u, but the fact remains that the banking industry is the one to blame for creating this ridiculous system when a DD can be set up for any bank account without the account holder consent. Yes, the account holder is protected by the DD guarantee, but this doesn't help P4U and other companies that have to use this inherently flawed system.

Archi_Bald

grumbler wrote: »

this doesn't help P4U and other companies that have to use this inherently flawed system.

They are not forced to use DDs. They could use CPAs if they wanted to.

Though the fact that they use DDs suggest to me that they don't consider the occasional spammer as a prohibitive issue. It's only on MSE where there is a perceived issue with DDs.

grumbler

Archi_Bald wrote: »

They are not forced to use DDs. They could use CPAs if they wanted to.

I am pretty sure CPAs cost more. In fact neither is needed at the time of purchase as generally it's up to the contract holder to decide how to make payments. And cards are routinely used for verification by taking token payments that is no different from a CPA.

However, it was the OP who suggested using a DD for some verification by waiting until it gets 'cleared'.

System

Thanks to the OP for the clear summary of how the scam works. Maybe the thread should be transferred to the MSE mobile phones board? Or to a different forum altogether, about current scams?

I'm in favour of DDs. They save me money: goods and services are cheaper because collecting payment is automated and cheap.

I don't know whether the phone companies are just slipshod, or have taken a considered decision that they will bear a few losses, in order to entice in customers who want a ridiculously expensive phone quick. If the phone companies so chose, they could not despatch a phone (or hand it over in a shop) until (say) a week after they have successfully taken a first payment. They would still get some losses, from a different scam in which a fraudster gave genuine bank details, and the owner of the bank account did not spot the unauthorised payment until later.

usignuolo

Just to clarify, when I phoned p4u to tell them about the unwanted phone, they told me that the phone had been bought with a NatWest account in my name and with a plan from their subcontractor Orange. When I spoke to Orange they said an Orange plan had been set up for the p4u phone with a NatWest account in my name.

I don't know if the scammer ordered a phone from p4u with an Orange plan and then p4u passed on the fake account information to Orange, or if Orange sold the scammer a p4u phone with an Orange plan. Either way the phone was despatched to the apparent customer and the plan set up before the phone companies had checked the account actually existed. The only certain way to do that would be to make the customer wait until the dd has cleared the BACs system, which of course it would not.

But the phone companies are so keen to sell the phones they send them off anyway, I suppose they must factor in the losses which must be pretty large on an annual basis as this appears to be a widespsread and successful scam.

I do agree that it is very lax how dds can be set up and the fact that the banks do not advise people when new dds are set up on their accounts is also an invitation to fraud.

Mikeyorks

usignuolo wrote: »

The only certain way to do that would be to make the customer wait until the dd has cleared the BACs system, which of course it would not.
.

That's simply not the case. I've just set up a couple of 18 month contracts with Three for SIM only. I bought the unlocked phones separately.

The contracts are via DD and were taken a month apart. In both cases they hit the account with a 'refundable validation fee' of £0.10p to prove the account existed before they despatched the SIM. The SIM - in each case - was delivered within 48 hours of order. The only account data provided was Sort Code / Account ...... so they have only utilised that data to test the account. As my Debit Card data wasn't provided.

grumbler

Mikeyorks wrote: »

The contracts are via DD and were taken a month apart. In both cases they hit the account with a 'refundable validation fee' of £0.10p to prove the account existed before they despatched the SIM. The SIM - in each case - was delivered within 48 hours of order. The only account data provided was Sort Code / Account ...... so they have only utilised that data to test the account. As my Debit Card data wasn't provided.

I don't believe you.

Three wrote:

What is the Refundable security charge for?
As part of our credit check process we'll need to verify your card and billing address by charging a verification fee.
We will refund this back to you on your first bill.

Neither a card nor a billing address can be verified by a DD.

Three wrote:

Amount to pay today £0.10

We need to do a credit check before we can complete your order. For this we will require a bit of extra information, such as your current employment and direct debit details plus your address history for the last three years.

Please note that you will also need a debit or credit card with sufficient funds to cover any payment required today.

jonesMUFCforever

Grumbler - I agree with you. They take a token amount by debit/credit card as these transactions will include an address check when processed as a customer not present one.