TSB internet banking fraud

tram73

I find myself in a very strange situation and I have been in touch with the Financial Ombudsman about the situation but thought putting a post up on here may help with your collective knowledge.
It's a bit complicated. 20th of April I was in France during half term and checked my bank account with my Iphone using thumb print recognition. I noticed an amount of £1 had gone out of my account with the name Yahya next to the transaction. I googled the name on my phone and it looked like some sort of ticket agency. But, unfortunatly, I didn't take much notice of it because I hadn't bought any tickets and it was just a pound.
Fast forward ten days and it's my payday. I check my acount first thing in the morning and three amounts of money have come out of my acount, all under £500, with the same name Yahya. I ring up TSB and they put the account on hold and give me a case number.
Someone calls me up from TSB and the phone conversation was pretty intense. Had I bought tickets? No. Had anyone used my internet banking?No. Has your wife? No. We've traced the IP address and it's come back to your phone. And she kept repeating a phrase You have no point of comprise. I had to ask what that meant and i'm still not sure. This started on Monday.
Yesterday, I was told I've been refused the refund and I have 60 days to find a new bank account. When I told her to close the account now she told me I was in arrears due to my direct debits not being met.
They're sending me a letter about the cancelled bank account but not the refund so I've sent a complaint to TSB and once that gets a response the Financial Ombudsman will be able to help.
So, I'm a bit dazed and confused. Any advice would be greatly received.

[Deleted User]

To be fair, you did leave it 10 days after the initial transaction before acting on it.
You should have reported it as soon as you noticed it

eskbanker

tram73 wrote: »

We've traced the IP address and it's come back to your phone. And she kept repeating a phrase You have no point of comprise. I had to ask what that meant and i'm still not sure.

Sounds like they're saying that there is evidence that the transactions were made from your phone and that therefore there is no indication that your account has been compromised, i.e. accessed from elsewhere? The fact that they're terminating the banking relationship would also imply that they believe you're complicit in some way.

Not sure there's much you can do other than await the outcome of the complaint and then escalating to FOS if not resolved to your satisfaction....

18cc

Do you mean you used the TSB banking app on your iPhone from France - or did you log on via the iPhone browser (Safari I believe)?

Tracing the IP address makes no sense. What would have made sense is if they said the unique banking app ID was used - that would definitely mean your app bought the tickets.

You need to find out more about what info they have about the device that was used to buy the tickets - was it a bank transfer using internet banking? A browser, TSB App, a desktop, a phone, an iPhone...?? Or was it a debit card? Or did they set up a direct debit and use that? What was the payment method?

Don't let them fob you off with IP Address rubbish - that is by no means concrete evidence to say the least.

AnotherJoe

is there someone esle - child, student, partner, who had or could have had access to your phone during that period?
Also, I'm not sure how the IP address comes back to a specific phone. Did they say MAC address or IP address?
If they did say IP address, fund out what it was. Was it a French one? Could someone at your home have be using your home wifi to access TSB whilst you were away?

tram73

Thanks for the replies. I only got in touch with the bank when my wages disappeared out of my account. I wish I had got in touch when I saw the pound go out. I wouldn’t be in the situation I am now in.
I use the TSB app on my iPhone using the fingerprint to sign in. I’ve forgotten the password so if I had to sign in manually I would have to answer my security questions. My phone is with me all the time. No one has access to it.

TadleyBaggie

I'm not sure what the TSB app has to do with any of this, purchasing of tickets would have been done through a browser or possibly a ticket purchasing app.

However to do that the debit card details would be needed.

Zanderman

TadleyBaggie wrote: »

I'm not sure what the TSB app has to do with any of this, purchasing of tickets would have been done through a browser or possibly a ticket purchasing app.

However to do that the debit card details would be needed.

Indeed. The £1 initial payment is the sort of thing done when testing a debit card.

The question I'd be asking TSB (and checking on my online banking) was how payment was made - by online banking (i.e a bank transfer - someone using OP's login), by direct debit (who set it up?) or by debit card (which might have nothing to do with OP's phone - indeed where was OP's debit card when they were in France?)

Ben8282

Zanderman wrote: »

Indeed. The £1 initial payment is the sort of thing done when testing a debit card.

The question I'd be asking TSB (and checking on my online banking) was how payment was made - by online banking (i.e a bank transfer - someone using OP's login), by direct debit (who set it up?) or by debit card (which might have nothing to do with OP's phone - indeed where was OP's debit card when they were in France?)

My question exactly. HOW was this money taken from the account? I would assume debit card yet the words 'debit card appear nowhere in the OP.
I have also googled the name Yahya but nothing comes up about a ticket agency so wondering why it did for you (and presumably TSB as well).

Terry_Towelling

Doesn't sound complicated like OP suggests and I'm not sure how the thumbprint sign-in in France has any bearing.

Presumably the purchases were made by debit card. Barring direct debits (which these shouldn't have been) that's the most likely reason why the retailer's name would appear next to the transactions.

So, if what we are being told is true, someone has access to OP's debit card details (incl CVV2) and made some transactions. Something else that doesn't quite add up is the fact that the 'wages disappeared' - that suggests someone actually being in the current account and transferring them out by Faster Payment but OP still talks of transactions with a retailer name.

As for the IP address being the same, I could understand that being the case with a home set-up because your system usually stays powered on and connected all the time, so the IP address won't change unless your ISP does some fancy stuff for you or you have some protection device that constantly changes your IP address. Under normal circumstances you're most likely to get a change of IP address if you power-off your router for a while.

I don't know but I would have thought that a phone would not stay connected to the net all the time and so the IP address would be likely to change quite frequently. Can anyone confirm or contradict that because I have a very old phone and am just guessing?

Finally, how would TSB be able to contend that an IP address points to an Iphone? Do Iphone IP addresses have particular characteristics that identify them, or is an IP address an IP address?

So, OP can you iron out these inconsistencies for us please so that we can make our minds up about how to approach this thread?

Uxb1

If the iphone was at home and connecting though the home router via wifi then the IP address will stay mostly the same subject to the router not being switched off and on again which often results in a new IP adresss with some ISP's though not with others.
If the iphone was connecting via 3G/4g mobile data then it all depends how the mobile company handle IP addresses on mobile connections. I understood that due to the numbers and constantly moving phones the mobile companies use GCNAT which is a complex type of IP address sharing where the real external IP address stops at the mobile company and then they use internal sub-addresss to connect to the mobiles such that several mobiles are time-sharing in real time one external IP address. Goodness knows how this affects the traceability of which mobile was connecting to which IP address at any one millisecond or whatever time slice so the law enforcements agencies don't like it.
Edit
Here is a recent post about CGNAT usage on EE's network
https://community.ee.co.uk/t5/4GEE-WiFi/Port-Forwarding-and-Carrier-Grade-NAT-CGNAT/td-p/754850
Lack of traceability of end users on mobile connections
https://www.theregister.co.uk/2017/10/18/europol_cgnat/