New M&S terms and conditions - hmm!

cookie365

Just been notified that M&S are adding - amongst others - the follow T&Cs:

What we'll do if payments are made into your account by mistake

We're clarifying what we'll do when a payment has been made into your account by mistake and we're introducing changes to reflect new industry standards that help customers who have used incorrect payment details to send a payment. If you tell us a payment made from another bank was intended for you but the payer says it was made into your account by mistake, we’re legally required to share all relevant information including your name and address and transaction information with the bank the payment came from, if they ask us, so that the payer may contact you directly. We’re including a term to make this clear.

Now people aren't in the habit of sending me payments by mistake, and if they did I'm sure I'd know and agree to reversing.

But it does strike me that a canny ID thief might be able to use this, maybe with a bit of social engineering, to get personal details from just an account number.

What do people reckon? Other banks don't seem to have similar T&Cs about releasing name and address details.

scoobydoothedog

I think this just reflects the revised banking industry practice. I have had the same thing from two other banks.

colsten

Sounds to me that if you agree you weren't the rightful recipient, all you need to do is agree to return the money, and none of your data will be shared with the originator.

If you ARE the rightful recipient of the money, the originator of the payment would surely know at least your name, and possibly also your address, already?

.......If you tell us a payment made from another bank was intended for you but the payer says it was made into your account by mistake we’re legally required to share all relevant information..............

Presumably you'd also be grateful to have the name and address of someone you sent money to by mistake, and who refuses to return it? At least you could then take them to Court, which presently is not an option as banks won't give you the information.

I think that amendment was long overdue.

cjmillsnun

I think the idea is that the information is given to the bank from where the payment came from, so that they know that the payment was made to Joe Bloggs, of 1 The Street, Anytown. They then can go back to the customer and ask, who was the payment intended to go to? without giving details to the originator. If the two match, then you keep the money, if not then it leaves your account and is returned to the originator's. At no time does your information go anywhere other than the other bank (that would be a DPA/GDPR breach) unless deliberate fraud or money laundering is suspected.

colsten

cjmillsnun wrote: »

I think the idea is that the information is given to the bank from where the payment came from, so that they know that the payment was made to Joe Bloggs, of 1 The Street, Anytown. They then can go back to the customer and ask, who was the payment intended to go to? without giving details to the originator. If the two match, then you keep the money, if not then it leaves your account and is returned to the originator's. At no time does your information go anywhere other than the other bank (that would be a DPA/GDPR breach) unless deliberate fraud or money laundering is suspected.

You have overlooked these words in the M&S T&Cs:

.....so that the payer may contact you directly.

This would clearly not be possible under your theory, which is therefore incorrect.

soulsaver

colsten wrote: »

Sounds to me that if you agree you weren't the rightful recipient, all you need to do is agree to return the money, and none of your data will be shared with the originator.

.

I hope that is the case. If so, shouldn't it to be included in the communication?

colsten

soulsaver wrote: »

I hope that is the case. If so, shouldn't it to be included in the communication?

You mean: included in the T&Cs? Would be helpful, I agree. CBA to write to M&S about it though. Will you?

Bobblehat

Similar to this ..... Santander have changed their wording for the "What we'll do if payments are made into your account by mistake". This arrived in an email on 09/10/17 ......

"Payments received in error: We can already return money sent by Faster Payments into your account by mistake and we don’t need your permission to do so. Our terms will be updated so that if a payment is made into your account by mistake, you agree that we may share all relevant information with the sending bank so that the payer can trace the money."

I didn't like the sound of this and was not aware that ...... "We can already return money sent by Faster Payments into your account by mistake and we don’t need your permission to do so". It looked to me like a scammer could buy something off you, on say .... Gumtree ...... pay for it by Faster Payment, receive the goods and then claim that they paid the amount by mistake ..... and Santander "could" pay the buyer's payment back without letting you know they had done so!

I rang Santander up and queried this and they said .... "Yes, that could happen! That would be an issue between you and the Buyer!". They made a much bigger emphasis on answering my query about the "sharing information" bit than the "without your permission" bit. I pushed them on the permission issue and got a run around answer. I then requested that this was raised as an official complaint and pointed out that they could be risking thousands of their customers being open to scamming.

Up to today, I have not had any reply other than an automatic "We are dealing ....." letter. Until I get a satisfactory answer, I will not use Santander for Faster Payments coming in from individuals.

JuicyJesus

I'd be worried about the following sequence of events:

1) Customer flees abusive spouse, hiding new address specifically from abusive spouse.
2) Customer receives £100 out of the blue from abusive spouse.
3) Abusive spouse requests contact details of "mistaken" credited person and receives same to "pursue recovery of the monies".
4) Abusive spouse finds and beats the sh*t out of customer.

Rinse and repeat for any number of other scenarios where keeping someone's address from other people is extremely important. And in case you think the above is far fetched, I just changed the circumstances in the scenario from a FOS case (45/2 in that link) from one where the bank accidentally divulged the customer's address to deliberately doing so, with the force of their own T&Cs behind them.

Personally I think this is an absolutely idiotic change for this reason and an actual danger to M&S' (and by extension the HSBC Group's) own customers.

cookie365

JuicyJesus wrote: »

I'd be worried about the following sequence of events:

1) Customer flees abusive spouse, hiding new address specifically from abusive spouse.
2) Customer receives £100 out of the blue from abusive spouse.
3) Abusive spouse requests contact details of "mistaken" credited person and receives same to "pursue recovery of the monies".
4) Abusive spouse finds and beats the sh*t out of customer.

Rinse and repeat for any number of other scenarios where keeping someone's address from other people is extremely important. And in case you think the above is far fetched, I just changed the circumstances in the scenario from a FOS case (45/2 in that link) from one where the bank accidentally divulged the customer's address to deliberately doing so, with the force of their own T&Cs behind them.

Personally I think this is an absolutely idiotic change for this reason and an actual danger to M&S' (and by extension the HSBC Group's) own customers.

This is a perfect example of what I was thinking of but didn't have the wit to articulate myself.

cookie365

colsten wrote: »

If you ARE the rightful recipient of the money, the originator of the payment would surely know at least your name, and possibly also your address, already?

Not neccessarily.

colsten wrote: »

Presumably you'd also be grateful to have the name and address of someone you sent money to by mistake, and who refuses to return it? At least you could then take them to Court, which presently is not an option as banks won't give you the information.

I think that amendment was long overdue.

I actually take care when making direct transfers, and don't really understand why banks should risk helping scammers and domestic abusers in order to cushion people from taking responsibility for their own actions.