Fraudulent Activity on EE account

boiler-questions

Had a text on both phones this morning (linked together on one EE account) to say that the password had been changed, a few seconds later another to say the address had been changed.

I phoned 150 straight away and was able to change them back. The person who changed them a few minutes before was there so they went to talk to them. When they came back they said that it was someone who said they were my name and they knew the password. They said they were phoning from an 0845 number though. I told them that the password is only used for EE and isn't written down anywhere and nobody else knows it so unless it was an inside job that would be impossible. He then said that they didn't know the password, they answered the security questions.

I spoke to the line manager who tells me that they didn't say they were me - they gave a different name altogether but they answered two out of 4 questions correctly so were allowed to change the password and address.

The 4 questions they could have been asked were:

Last Bill amount (within £5)
Last 4 digits of card
When was last payment made
Where did I get current contact from

So I'm a bit worried that someone who didn't know my name and didn't phone from the phone in question was able to phone up and give one of our mobile phone numbers and then supposedly answer 2 of the above questions and manage to change my details.

I asked why they would do this and the manager said normally it was to apply for a contract (which would then get billed to me but sent to them)

I asked which questions they answered correctly and they are going to get the recording and phone me back.

I've checked my online banking etc and there is no unusual activity.

If they did know the last 4 digits of the payment card then that would have been from a while ago because the card I used when I started the contract expired and I've never told EE the new card number.

Should I be worried about anything else with it?

Should I inform the police in any way?

Ian011

I would speak with the Information Commissioners Office (ICO). Something seems terribly amiss.

A chat with ActionFraud may also be worthwhile.

grumbler

boiler-questions wrote: »

....
I spoke to the line manager who tells me that they didn't say they were me - they gave a different name altogether but they answered two out of 4 questions correctly so were allowed to change the password and address.

Complain to EE. This manager seems to be incapable of managing anything if this is a norm in his team.

That said, it makes no sense that the fraudster that knew a lot of information about you gave a different name.

AndyPK

well on the plus side, it doesn't seam like EE have been hacked and details leaked.

It's just poor performance from EE, to allow obvious details to be changed, when only answering 2 out of 4 questions. And some of these can be guesses.

On the plus side, the TXT service did the job

boiler-questions

AndyPK wrote: »

well on the plus side, it doesn't seam like EE have been hacked and details leaked.

It's just poor performance from EE, to allow obvious details to be changed, when only answering 2 out of 4 questions. And some of these can be guesses.

On the plus side, the TXT service did the job

That seemed to be their attitude, they agreed that their security was a bit poor but said that the text service is there to protect against that. Not great if you don't check your phone often.

boiler-questions

Well they did phone back as promised,

The person knew how much my last bill was within £5 and where I purchased my contract from.

Both of these are guessable items, so I'm hoping they were simply guessed.

Not happy with it though - I asked them to send it to their fraud team to investigate but they won't because I was too quick in alerting them. If I'd left it longer until they had purchased something then it would have been passed but they view it as nothing fraudulent happened. I disagreed with this as to me pretending to be able to manage someone's account and changing their address and password if fraudulent but they wouldn't agree that it was!

Threewheeler

Do you normally get paper bills? If yes, do you just bin them without shredding? Just a thought as to where the details could have come from.

boiler-questions

No paper bills, just emails.

Threewheeler

Looks like intercepted email then, or perhaps inside loss of details. Is there a chance that some of your original agreement may have been thrown out. Somehow I think there were too many details known to have been by chance, I hope they are investigating this for you. My thought were that someone has found some thrown out rubbish and discovered that they or by passing it on. You say that a different named person tried to use your details, presume false name, do you know?

boiler-questions

It was made slightly worse this morning!

Received a text on both phones again to say that I had ordered an Iphone 6s plus gold for £54.99/month.

I phoned again straight away and the order was cancelled.

I asked how this was possible as my account had heightened security and could only be accessed if they phoned from my number and if they knew my password (security questions couldn't be used).

However somehow someone was allowed to order an iphone contract and have it sent to an address in London.

They haven't changed my address or password this time but have made the order and had it sent to another address.

I have spoken to a manager and they are apparently conducting an internal investigation. They put it down to one of two scenarios.

Either a) The person phoning is someone with internal access.

or b) The person who put the order through didn't follow the instructions on the account regarding heightened security.

Either way the failure is internal. They said as it is an internal issue they will deal with it internally and I won't find out what happened.

I have demanded that at the very least they listen to the call and tell me which it is - will see if I actually find out or not.

So I'm a little confused at how this can happen.

I stated that I didn't feel their security was good enough and they said that it was - the text message did its job. I just don't think that relying on me seeing a text message is sufficient. They often send junk messages and it could easily have been missed.

With regard to old letters, I am quite bad for keeping everything - I have piles of letters etc. Once every so often I sort through them and end up with a bin bag full of old letters I don't think I'll need again and these get burnt.


Anyway my question today...

If they applied for the iphone 6 on my account would that have gone through a credit check? Will that have put another credit check against my account? Any potential problems if it has?

d123

boiler-questions wrote: »

Anyway my question today...

If they applied for the iphone 6 on my account would that have gone through a credit check? Will that have put another credit check against my account? Any potential problems if it has?

no, unless things have changed recently, if you are an existing customer it is done with an internal check, no actual credit check is carried out.