Nandos using wrong customers cards for food purchases

wesleyad

Hi guys,

Just wanted thought on whether you thought this was a  breach of GDPR and worth reporting?

I got 3 emails on Monday night from nandos, which were receipts for food totalling £100. The 3 orders were for completely different nandos across the country. Initially I though card had been hacked and blocked immediately. Whilst on phone to bank I had a look on twitter and noticed lots of other people posting same issue. We (bank and I) decided it looked like this was actually a nandos error, somehow stored card details from one customer are being used to pay for others.

Nandos lines were closed so I emailed and tweeted. I emailed again Tuesday. Couldn't get through on phone but got a response from tweet saying they had received email and would get back to me in 7-10 days. Now I appreciate slow customer service in times like this, but we aren't talking about a complaint over poorly cooked chicken, to me this is a serious error. It doesn't appear fixed, someone on twitter had it happen multiple times on different days, so I cannot unblock card in case it happens again. I'm stuck in limbo until they respond.

Logging into nandos and there is no way to remove stored card details. 

And before you ask, no I dont want comp (although I'd take a black nandos card if offered  ), it just seems that no one is taking what is surely a very big error seriously.

Cheers

preables

Just cancel your card and get a new one then the old one won’t work?

Lip_Stick

On my banking app I can block the card from being used then unblock it again at will. You could do that until the problem gets sorted, if it gets sorted that is. You will obviously have to unblock your card on each purchase you make which might be more hassle than it is worth if it carries on for much longer.

wesleyad

Yeah I've blocked it, its was more that this seems a really odd thing to happen where a company has taken payments from random cards. I thought the security number (the last 3 digits on the back) was not stored with the card for this reason? 

Probably should have put in rants, just very frustrating as the dont seem to be taking it seriously. Seems to have happened to a load of people so a pretty big screw up on their end

born_again

wesleyad said:

Yeah I've blocked it, its was more that this seems a really odd thing to happen where a company has taken payments from random cards. I thought the security number (the last 3 digits on the back) was not stored with the card for this reason? 

Probably should have put in rants, just very frustrating as the dont seem to be taking it seriously. Seems to have happened to a load of people so a pretty big screw up on their end

They do not use the CVV for payments where you store the card details.
Many people think you can not do a online transaction without it being entered.
Sadly that is wrong.
But you are correct that they are not allowed to store the CVV

So you do not have any actual debits/authorisation's on your bank account? Just getting emails saying Someone else has made a purchase? 

wesleyad

born_again said:

They do not use the CVV for payments where you store the card details.
Many people think you can not do a online transaction without it being entered.
Sadly that is wrong.
But you are correct that they are not allowed to store the CVV

So you do not have any actual debits/authorisation's on your bank account? Just getting emails saying Someone else has made a purchase? 

Yeah three actual transactions have gone through and my account number is on the emails (last 4 digits). 

As I said, probably not a consumer rights issue, more of a rant. I know I'll get the money back, either eventually from nandos or the bank.

What's more annoying is it's still happening. Searching twitter for nandos UK and there's still people who have tweeted at nandos with that same problem from last night. So they've been informed this is happening since at least Sunday, it's now Friday and it's not fixed. That's what I mean by not taking it seriously, to me this is unacceptable from such a big chain.

born_again

wesleyad said:

born_again said:

They do not use the CVV for payments where you store the card details.
Many people think you can not do a online transaction without it being entered.
Sadly that is wrong.
But you are correct that they are not allowed to store the CVV

So you do not have any actual debits/authorisation's on your bank account? Just getting emails saying Someone else has made a purchase? 

Yeah three actual transactions have gone through and my account number is on the emails (last 4 digits). 

As I said, probably not a consumer rights issue, more of a rant. I know I'll get the money back, either eventually from nandos or the bank.

What's more annoying is it's still happening. Searching twitter for nandos UK and there's still people who have tweeted at nandos with that same problem from last night. So they've been informed this is happening since at least Sunday, it's now Friday and it's not fixed. That's what I mean by not taking it seriously, to me this is unacceptable from such a big chain.

So it's plain & simple card fraud.
Somehow your's & other Nados accounts have been hacked.
Get your bank to stop the card and get the refunds processed. In fact if the transactions were showing when you spoke to the bank they should have dealt with it at that point.
Forget trying to get Nandos to sort it out.

wesleyad

They've not been hacked though, these are genuine orders being made by other customers,  the wrong card details are being used by the database. My 3 orders were for Manchester, Nottingham and London, all genuine orders (I have the emails with what they ordered) so MBNA are saying that as there is no malicious fraud they wont go to fraud team, however they will cover me in the event nandos dont refund.

Also some people have changed login details and are still being used to pay for others. Crazy situation. I'll go back to bank again, but I dont see how nandos can wash their hands of it (and it's still ongoing).

Sandtree

wesleyad said:

They've not been hacked though, these are genuine orders being made by other customers,  the wrong card details are being used by the database. My 3 orders were for Manchester, Nottingham and London, all genuine orders (I have the emails with what they ordered) so MBNA are saying that as there is no malicious fraud they wont go to fraud team, however they will cover me in the event nandos dont refund.

Also some people have changed login details and are still being used to pay for others. Crazy situation. I'll go back to bank again, but I dont see how nandos can wash their hands of it (and it's still ongoing).

Why do you think that is the case?

People hack your nandos account (or they get your email/username combination some other way and realise you’ve used that combination for Nandos as well as whatever method they used to get it), they then sell the log in details online for £5 and so people pay £5 and order food from your account and get £40 of food delivered for the £5 they’ve paid the hacker. The hacker doesnt just sell it to one person but as many people as they can.

If it was a database error with mixed up card numbers then the genuine customer would be receiving the email not you. It’d be a further mess up if an IT problem was not only mixing up card numbers but also mixing up email addresses but conveniently bring back matched pairs still.

If you went into your account you’d see the full order because the person who ordered it ordered it from your account.

born_again

wesleyad said:

They've not been hacked though, these are genuine orders being made by other customers,  the wrong card details are being used by the database. My 3 orders were for Manchester, Nottingham and London, all genuine orders (I have the emails with what they ordered) so MBNA are saying that as there is no malicious fraud they wont go to fraud team, however they will cover me in the event nandos dont refund.

Also some people have changed login details and are still being used to pay for others. Crazy situation. I'll go back to bank again, but I dont see how nandos can wash their hands of it (and it's still ongoing).

Go back to MBNA and say that the transactions were not made by you and are fraud.
As such you want the card stopped and a full refund as per the PAYMENT SERVICES DIRECTIVE. If they still say no, you need to raise a complaint there and then on the phone. Ask to speak to the fraud team no matter what.
Do not let the front line fob you off.
Even if it is a genuine error? by Nandos. MBNA need to deal with the fall out and refund you for the transaction you did not make.