London Mint Office scam????

Shortypie

Ok, bit of a long one:

beginning of august I received 2x small parcels in the mail, addressed to me. upon opening I discovered that they were “limited edition Vera Lynn coins” in a presentation pack, both identical. Paperwork included in the parcel indicated that I had ordered them, but not paid for them and that I either had to pay for them or return them, obtaining proof of postage. Now, I wasn’t about to go hanging around in the post office during a pandemic for something I didn’t order, so I emailed them saying it was unsolicited, and as such I wasn’t going to pay for them or return them, and gave them 5 working days to reply or I would dispose of them as is my right under consumer law relating to unsolicited goods. They didn’t reply. I had emailed them from an old web-based email address that was for work, same organisation I still work for but we now have outlook, so I never use that email address. 

I did check with my kids (13 year old twins and a 10 year old) in case they had clicked on something (the boys have phones) but none of them knew about Vera Lynn coins. 

A week or two later I happened to be heading out the door when the postman tried to deliver another one of these parcels, I refused delivery and he said he would refuse all of them in future.

Around a month later I get a phone call from them asking about the coins, which I said “i have never ordered any coins or anything from your company, I don’t want anything, please remove me from your database”.

Last month I received a letter from them stating I owed them £10 (for the first coin, and a further 4 coins! Which I had not received) and would incur a £10 late fee soon. I phoned them and was told that the first coin was ordered on such and such an IP address on 1st August by an email address which is the school email address of one of my boys. He says he didn’t order anything and I believe him as he wasn’t remotely interested in the coin. The woman also said the next 2 coins were ordered by the same email address, during august, but the 4th one was ordered in September, by my old work email address (the one I never use now, but did use to email them to leave me alone). When I told her I’d never received those coins she said “oh yes, I can on my system see they were refused”. She seemed completely blasé about my accusations of a scam, and my repeated requests to remove all my details etc. Not “oh I’m sorry to hear there’s been a mix-up, let me look into it” you would expect from customer services, which leads me to believe they are knowingly scamming. She even asked if I wanted to “close my account” WHICH I DON’T HAVE WITH THEM!   

Weirdly, they had sent it to me addressed by my first name and married name, but I’ve always gone by a double-barrelled surname, literally since 2003, even following my divorce. It was also addressed to [my name] BUNGALOW [my address]. I have the nickname BUNGALOW on my Tesco grocery account, to distinguish it from my friend’s holiday cottage that I stay in once a year].

I’m worried I’ve been victim of some kind of phishing scam.

Today yet another one of these packages arrived, this time addressed to my OTHER son   I wrote return to sender on it, and then to the sender, remove this address and all occupants from your system and cease and desist sending us anything.  

What can I do? They’ve clearly ignored my email. I’m thinking contact Trading Standards? Send them a Freedom of Information request about how they obtained my information? Get them to prove that I actually ordered anything, other than giving me dates and IP addresses of alleged purchases? 

Any advice welcome. 

Aylesbury_Duck

It sounds like it's possible that the email accounts concerned have been compromised, so the first thing to do is to change passwords on those and any other accounts or websites where you use the same password.

davidmcn

Assuming it really is the London Mint Office you've been dealing with, they're long-established and part of a multinational coin empire so it would seem unlikely they've started something as blatantly scammy as inertia selling. Though I'm not sure what the scam would be if perpetrated by a third party.

Any clues from the IP addresses?

born_again

Your son's upset anyone at school, that might have got access to their email account?

Sounds very much like something kids might do.

Shortypie

Aylesbury_Duck said:

It sounds like it's possible that the email accounts concerned have been compromised, so the first thing to do is to change passwords on those and any other accounts or websites where you use the same password.

Ehhhhh got to admit I’m not great at using different passwords for different sites  I’d forget them.

Shortypie

born_again said:

Your son's upset anyone at school, that might have got access to their email account?

Sounds very much like something kids might do.

Doubt it, also wouldn’t explain why the fourth coin was apparently ordered with my email address (the old work one that I never use, and the only time I did use it recently was just to email them to tell them to leave me alone).

Shortypie

davidmcn said:

Assuming it really is the London Mint Office you've been dealing with, they're long-established and part of a multinational coin empire so it would seem unlikely they've started something as blatantly scammy as inertia selling. Though I'm not sure what the scam would be if perpetrated by a third party.

Any clues from the IP addresses?

IP addresses don’t mean anything to me   

I did Google the London Mint office and read very mixed reviews and that they’d been shown in a very poor light on some consumer show. It seems very odd to me if they are a reputable company that I didn’t get a reply to my email (info@thelondonmint.org) and when I phoned them the customer service agent didn’t sound surprised and apologetic as you would expect when a “customer” tells you a mistake has been made. She just tried to prove I’d ordered it by reading out IP addresses. 

Aylesbury_Duck

Shortypie said:

Aylesbury_Duck said:

It sounds like it's possible that the email accounts concerned have been compromised, so the first thing to do is to change passwords on those and any other accounts or websites where you use the same password.

Ehhhhh got to admit I’m not great at using different passwords for different sites  I’d forget them.

You can employ various tactics to generate different passwords for various things, whilst keeping them memorable. Such as using two random words, some capital letters, a number and character, where the words are linked to the site in question.  If you don't want to do that, get into the habit of changing the few passwords you do use frequently, e.g. monthly.

Google tells you if any of your login details have been part of a data breach as well. Click on your profile pic in the address bar, click the key icon and do a scan of saved passwords.

I'm confident these coins are a result of an email breach.

IvanOpinion

It wouldn't surprise me if your son has left something logged in at school or a 'friend' has got hold of their phone and it has been nothing more than a schoolboy prank.

tacpot12

I think you are on safe ground to to continue to ignore demands for payment' you can show that you didn't order the items by the fact that they are using data you would never have provided to them to ship them [Your maiden name, an old email address (which was not provided for the purposes of confirming order, but to complain), and the nickname for your address (Bungalow)]. Someone else has ordered them in you name, and their inadequate controls has led them to ship unsolicited goods to someone who didn't order them. 

You could make a Data Subject Access request for all the data they hold on you. This might help confirm where your data has come from. You can also ask that they delete your data from their systems, but I would expect that they don't have to comply with this while they have a valid reason for keeping it, such as pending legal action.  

I would recommend you use a Password Manager like LastPass or Keeper to generate store secure passwords so that you don't have to remember them.

Pollycat

Shortypie said:

A week or two later I happened to be heading out the door when the postman tried to deliver another one of these parcels, I refused delivery and he said he would refuse all of them in future.

Can a postman actually refuse to deliver mail addressed to someone just because the recipient says they'll refuse to accept future deliveries?