Direct Debit Security Issue?

vienly

Hi All,

Not sure if this has been discussed before however this seems like a potential security issue.
I was talking to my wife about direct debits and how I could take money out of her account without her knowing and she didn't believe me, so I ran a test and set up a DD from my Tesco Internet Save pulling £1 from her Natwest current account.

It took 10 days before the £1 was taken however she had no notifications/letters or anything telling her a DD was set up.

So does this mean if anyone had your sort code/account number they could set up a DD to your account and pull £1000's out without you knowing until it's too late?

agrinnall

Very well known (see Jeremy Clarkson and IIRC Greenpeace), but the account owner is always covered by the DD Guarantee.

But it can only be done if the person taking the money is a DD originator, and as far as I know Tesco is one of the few organisations that allow retail account customers to do this. And if you did it with nefarious aims I would expect that your account would be shut down tout suite.

vienly

Thanks for the reassurance, didn't know about the DD Guarantee

radoslaff

That's funny. I've tried that several times with my wife because we needed direct debits and Tesco would never let me set up the direct debit if I was not the account holder of the target account.

agrinnall

radoslaff wrote: »

That's funny. I've tried that several times with my wife because we needed direct debits and Tesco would never let me set up the direct debit if I was not the account holder of the target account.

How would they know? As stated, all you need to set up a DD is the sortcode and account number.

soulsaver

Tesco tell you the debited account must be in your name while you're setting the DD up - but it doesn't stop you if it isn't.

Your wife would be able to see it in her DD listing on her ac - and cancel it if she wished, but the bank doesn't draw your attention to it's new existence.

I think banks should tell ac holders that a new DD has been set up on their account, but AFAIK I know none of them do... and I have a LOT of DDs.

Kim_13

Tesco have also been increasingly asking for a bank statement for the account the DD is to be pulled from, according to posters on here. It may be that it is a random check and not everyone, but it may discourage people from trying to pull from an account that is not theirs.

Anyone who is asked to send in a statement (which would have to be processed by a human) presumably can't then pull from a spouse's account, even with their permission.

Ed-1

Kim_13 wrote: »

Tesco have also been increasingly asking for a bank statement for the account the DD is to be pulled from, according to posters on here. It may be that it is a random check and not everyone, but it may discourage people from trying to pull from an account that is not theirs.

Anyone who is asked to send in a statement (which would have to be processed by a human) presumably can't then pull from a spouse's account, even with their permission.

Their system electronically verifies the account details provided match the customer's through credit reference agencies. However some may slip through the net e.g. for recently opened accounts which aren't yet reported to CRAs.

If the system can't verify the account, a statement is requested.