Phone hacked, bank stopped me spenfing online

Roadie

Hi all, this sounds a bit odd and it may be in the wrong section but i'm really struggling to find any help or advice.

My wife received a txt saying 'this is your verification code, use this to authorise payment' from our bank. Understandably concerned as she wasn't online or buying anything. Called the bank who told her that it was a fraudulent attempt and her card has since been cancelled. Normally this would be it but after then checking other spends with her card the bank have said that they have found two other purchases over £100 combined but they will not provide a refund. The reason is that she's been told that the same IP address has purchased legit items that she has bought, but also these two others and one failed attempt using the same IP.

They won't give us any info nor the IP address to check if it is her phone and just say no. They have now blocked her phone completely from any online purchases at all. In this day and age we use our phones to purchase a massive amount and now she cannot do anything.

What and where do we go now, they are saying we cannot prove it wasn't her and they can't prove it was but are adamant that the IP address has been used by my wife with legit purchases and the criminal with fake ones so they are saying it must be you.

What on earth do we do now?

Comms69

Unless im very much mistaken IP addresses on phones are renewed regularly.


So this must be a static address such as a broadband connection.


I'd suggest starting there (the likelihood of a phone getting the same IP address once, yet alone multiple times, is like winning the lotteries (all of them)

AndyPK

Is it PATG?
DIes the phone still have credit ? And make calls?

onomatopoeia99

Comms69 wrote: »

Unless im very much mistaken IP addresses on phones are renewed regularly.

Some mobile networks are implementing "carrier grade NAT" which means that the phone gets an RFC1918 address and multiple customers of the same network present the same real address when connecting to websites etc. Consequently tracking IP addresses of phones is not the most reliable thing a bank an do. It is also being rolled out by some fixed line ISPs, I believe hyperoptic use it, for example. It presents law enforcement problems as multiple users apparently sharing the same address means the police can't match up an IP address to an account holder (port translation is typically not logged).

Roadie

Hi all, the phone is a contract phone and not a PAYG model. The bank is adamant that the payments were made from that phone and not anywhere else. My wife spent two hours on hold with the bank being transferred from pillar to post and their stance is unchanged.
They checked other genuine payments my wife confirmed she made from her phone which apparently identifies the phones IP address. The bank is saying that the three fraudulent (x2 attempts and x1 success) were made from the same IP address. What notified my wife was one evening we were both sat watching TV when her phone receives a MSG from the bank saying this is your authorisation code valid for x10 mins.
She then rang the bank and this problem unfolded. How can it be the same IP address? They are so unhelpful and I've genuinely not sure what item I need to be checking the security of.

onomatopoeia99

If the phone was on wifi then the IP address of your broadband connection providing the wifi.
If the phone was on mobile data then the IP address assigned by the network provider to the phone.

Roadie

But wouldn't that mean that the person making the illegal purchase was using our own WiFi? I find that very hard to believe as our Wi-Fi is locked down with a complex password. The problem with GDPR (i'm ok with it) is that the bank will not release the IP address to us.

onomatopoeia99

Roadie wrote: »

The problem with GDPR (i'm ok with it) is that the bank will not release the IP address to us.

Given they have stated it's the IP address you connected from on legitimate transactions and therefore relates to your account, it's difficult to see whose data they are protecting under GDPR here.

[Deleted User]

What were the purchases? Did anything actually turn up at your address?

Roadie

No they were train tickets that went through the other two were rejected.

DoaM

Is it more likely that either the bank have made an error (associated another account holder's transaction with your account), or the other account holder has inadvertently (and surprisingly) entered your (wife's) card details because they're so close?