Three Mobile contract

macman

It's simply not feasible for mobile operators to run a call centre system that offers different levels of access to different authorised users (i.e. one user can only discuss 'technical'matters, another can also discuss billing...). Apart from anything else, each authorised user would then have to pass a different security process, as there would be no other way of distinguishing them.

davethorp

Actually threes website suggests that it is possible to set up different access levels for authorised users rather than setting up full access as has happened with the OP

http://ask3.three.co.uk/srvs/cgi-bin/webisapi.dll/,/?new,kb=mobile,ts=mobile,t=casedoc.tem.tem,case=obj(1311),varset_username=Mobile:mobileUser

Hooloovoo

macman wrote: »

Which part of 'authorised user' did you not understand?

I should imagine that they did not expect the "authorisation" to persist past the length of the telephone call.

If I phone up a company and pass security, and then say "I'm now going to pass you over to someone else who is going to deal with this issue", that is in no way the same as asking for that person to have permanent authorisation.

If, however, the son in this case knows the answers to the security questions and can pose as the account holder, then that's an issue between the OP and their son. I don't see how any company can be expected to protect against abuse in that case. It's like giving someone the PIN for your credit card.

grumbler

Hooloovoo wrote: »

I don't see how any company can be expected to protect against abuse in that case. It's like giving someone the PIN for your credit card.

See the post #13 above?
I can imagine at least two levels of access, e.g. 'technical issues' and 'everything, including financial issues'.

Hooloovoo

grumbler wrote: »

See the post #13 above?
I can imagine at least two levels of access, e.g. 'technical issues' and 'everything, including financial issues'.

Yes, but did the OP ask for either of them? If they didn't ask, was it explained fully as to what was being set up?

Or did the OP just say "Now I'm going to pass you over to my son to discuss this problem"?

If it's the latter, then to me at least that clearly refers to one-time access for the duration of this call. At no point have they asked for any permanent authorisation.

We'll never know without more details, and I suspect this is going to be one of those threads where the OP never comes back.

grumbler

Hooloovoo wrote: »

Yes, but did the OP ask for either of them? If they didn't ask, was it explained fully as to what was being set up?

I guess it wasn't, and in this case it wasn't the OP's fault.
And I merely replied to your comment "I don't see how any company can be expected to protect against abuse".

Or did the OP just say "Now I'm going to pass you over to my son to discuss this problem"?

If it's the latter, then to me at least that clearly refers to one-time access for the duration of this call. At no point have they asked for any permanent authorisation.

Absolutely. This isn't how an authorised user is added to the account. Typically the full name is recorded and a separate password / memorable word.

Hooloovoo

grumbler wrote: »

And I merely replied to your comment "I don't see how any company can be expected to protect against abuse".

But even post #13 doesn't protect against someone who knows the answer to security questions phoning up and pretending to be the account holder.

You've quoted me out of context and given a reply that doesn't apply.

To be specific, I said I don't see how any company can be expected to protect against abuse in the case where someone knows the security details.

For all we know, Three made a marketing call to the phone number and the child answered the security questions that they had heard their parent provide.

The bit about the child having been given authorisation might just be a red herring, especially given as you say ...

... Typically the full name is recorded and a separate password / memorable word.

And if a separate password was set up then it ought to have been obvious to the OP what was happening and they could have questioned it.

grumbler

Hooloovoo wrote: »

...
To be specific, I said I don't see how any company can be expected to protect against abuse in the case where someone knows the security details.

I misunderstood you then. My apologies.

For all we know, Three made a marketing call to the phone number and the child answered the security questions that they had heard their parent provide.

Do we really know this?

And if a separate password was set up then it ought to have been obvious to the OP what was happening and they could have questioned it.

What is obvious to you isn't necessarily obvious to everyone. Especially when dealing with some idiot from an overseas call center.

Hooloovoo

grumbler wrote: »

Do we really know this?

No, which is why I said "for all we know", a common turn of phrase to indicate uncertainty.

What is obvious to you isn't necessarily obvious to everyone. Especially when dealing with some idiot from an overseas call center.

Fair enough.