Scam? - Octopus Energy compomised?

clivep

Just received an interesting email from [EMAIL="tej.singh@octopus-energy.intercom-mail.com"]tej.singh@octopus-energy.intercom-mail.com [/EMAIL]...


"I have noticed that we do not have an active Direct Debit on your account."...


Followed by instructions with link to set up DD at https://octopus.energy/dashboard/accounts/A-640029D1/direct-debit/bank-account/


However, hovering over the link shows that it would take me to an octopus-energy.intercom-mail.com site.


I've never had Octopus Energy supply my fuel but did have to set up an a/c in order to get back my outstanding Iresa credit balance (I'd already completed my switch away from Iresa just before Octopus took over).


The worrying thing was that this email had my correct first name in the greeting!


I've spoken to Octopus and they say that they have not sent me the email. They do have an Tej Singh working for them but the email for him is at octopus.energy.


Octopus say they will investigate further but I would suggest that their customers should be extra vigilant as the scammer seems to have acquired some actual customer data.

JohnB47

clivep wrote: »

Just received an interesting email from [EMAIL="tej.singh@octopus-energy.intercom-mail.com"]tej.singh@octopus-energy.intercom-mail.com [/EMAIL]...


"I have noticed that we do not have an active Direct Debit on your account."...


Followed by instructions with link to set up DD at https://octopus.energy/dashboard/accounts/A-640029D1/direct-debit/bank-account/


However, hovering over the link shows that it would take me to an octopus-energy.intercom-mail.com site.


I've never had Octopus Energy supply my fuel but did have to set up an a/c in order to get back my outstanding Iresa credit balance (I'd already completed my switch away from Iresa just before Octopus took over).


The worrying thing was that this email had my correct first name in the greeting!


I've spoken to Octopus and they say that they have not sent me the email. They do have an Tej Singh working for them but the email for him is at octopus.energy.


Octopus say they will investigate further but I would suggest that their customers should be extra vigilant as the scammer seems to have acquired some actual customer data.

Presumably you've copied them the suspect email? Did Octopus reply by email, so that you have it written down that they will investigate? Octopus are pretty good, from my experience, but I'm always suspicious of a company simply saying, verbally, that they'll 'investigate'.

System

I have been exchanging emails with Octopus for the past couple of days re a meter issue. The lady that is dealing with the issue has an email address of xxxxx.xxxx@octopus-energy.intercom-mail.com

I have no reason to believe that it isn’t a genuine address.

Streaky_Bacon

It could also be that the email address is spoofed. The fact that the link refers to the intercom-mail.com domain is strange, but it could be that they provide hosting that could be misused.

OP - what is the whole URL it refers to?

There's a tool to analyze emails headers here, but not sure of OP's technical ability - https://mxtoolbox.com/EmailHeaders.aspx

System

This might be the reason:

https://www.intercom.com

The company offers messaging and email services to some well know large companies. Looking through old emails from Octopus, CS staff have been using intercom-mail.com for some time.

t0rt0ise

Can't you just go to the octopus site yourself and set up a DD. You'll need to do it if they need to refund you.

Pete99

A Direct Debit isn't needed for a refund it's only used to take money from your bank, they should already have your bank details if you've been a customer and switched.

clivep

JohnB47 wrote: »

Presumably you've copied them the suspect email? Did Octopus reply by email, so that you have it written down that they will investigate? Octopus are pretty good, from my experience, but I'm always suspicious of a company simply saying, verbally, that they'll 'investigate'.

I've not had any confirmation from Octopus that they are investigating but they didn't say they'd send one and also I didn't ask for one. I was not after any compensation but just wanted Octopus to be aware of the situation. They didn't ask for a copy of the email so I just marked it as "Phishing" in Outlook.

clivep

Hengus wrote: »

I have been exchanging emails with Octopus for the past couple of days re a meter issue. The lady that is dealing with the issue has an email address of [EMAIL="xxxxx.xxxx@octopus-energy.intercom-mail.com"]xxxxx.xxxx@octopus-energy.intercom-mail.com[/EMAIL]

I have no reason to believe that it isn’t a genuine address.

Chances are it was genuine then. However, no reason for them to be sending me an email prompting for me to set up a DD when they've never been my energy supplier + not having any record of sending the email?

clivep

t0rt0ise wrote: »

Can't you just go to the octopus site yourself and set up a DD. You'll need to do it if they need to refund you.

I finally got refunded at the end of October so then cancelled the DD I had set up although it was not actually needed anyway...


Left Iresa July 25th a couple of days before the announcement. Correct final bill received showing approx. £120 credit.


1st Aug. - received Octopus email about their appointment. Emailed them to ask who was dealing with the refund.


2nd August - email reply to say they will be making the refund once they receive all the account and billing details through.


29th Sept. - I emailled asking when I would be getting the refund (giving my Iresa a/c no. & my address).


3rd Oct. - email from them to say they can't find my Iresa final bill and asked to confirm my address! Replied pointing out it was in my email that they were responding to.


8th Oct. - received email saying they didn't receive the final meter readings through the official flows and to contact my new supplier and let them know that they should send those meter readings through official channels once again with the code for old supplier being MRCY. I replied pointing out that MRCY refers to them, Octopus, and was this correct as they had not actually ever been my supplier. I pointed out that he final bill from Iresa was correct and in accordance with the final read I gave the new supplier.


11th Oct. - email recd. to say credit from Iresa will be transferred to my Octopus account and then they will issue a refund. Also, "Unfortunately, because of the way Iresa set up their direct debits using GoCardless platform, we're not able to do this through the current direct debit that you have set up with Iresa. In order to initiate a refund, you should cancel Iresa Direct Debit with your bank and set up new with ourselves using this link".



Note: The hyperlink goes to octopus.energy and not the octopus-energy.intercom-mail.com site that the link in this latest email points to.


So I cancelled my Iresa DD, set up my Octopus Energy a/c & DD details then on 13th Oct. informed them I had done this.


16th Oct. email recd. - Thank you for getting in touch and for setting up your direct debit. Sorry for the delayed response. Once your final bill with Iresa is issued you have an option to either "agree" with it or "dispute" it. Replied pointing out that the correct final bill WAS issued but by Iresa in July.


23rd Oct. email recd. - says Iresa final bill was not necessarily correct and they will be producing a correct one within the next few days.



25th Oct. email recd. - offer to accept final credit. No actual final bill provided but the figure was more or less correct. "To accept a final credit of £117.99 and transfer it to your bank account, we'll just need your bank details. We'll only use these details to process your refund, after which we'll delete them from our system".


I accepted the offer, provided bank details and received the refund a few days later.


So setting up a Direct Debit with them was actually never needed!

brewerdave

The whole SOLR process is flawed - Octopus have not yet issued me a final bill following my enforced transfer from Iresa last July. I agreed the small credit carried forward from Iresa on 20th August and subsequently switched away. The closing meter read has passed verification and can be viewed on the Octopus site. HOWEVER, as I was informed ~ 3 weeks ago, they haven't issued a final bill because they are still resolving Iresa balances!!

Wonder if the 12 month ruling applies if they don't get their act together by next September??