Direct Debit Security / Fraud Advice

Samwell94

Murmansk said:

There was an item on Direct Debit fraud on Moneybox on Radio 4 at noon, might be of interest, repeated Sunday 9pm

Thank you! I shall have a listen.
I'm sure I can't be the only person to go through this.

bubieyehyeh

I think you can divulge your account details by sending someone a faster payments. Most banks don't show the senders details, but I believe some do.

Perhaps the person doing it works at one of the six companies you have a valid direct debit with, and that is how they got the new details. You could open 6 new accounts, and manually put one DD with each. Your bank maybe willing to assist.

Perhaps they are using the open banking APIs to get the account details, I'm not sure on how that is secured, but something to look into.

Samwell94

quirkydeptless said:

Possibly there is mail of yours still going to your old address that is giving the occupants information to commit the identity theft.

Have you checked all your accounts/bill payees to confirm they have the correct contact details, especially the address?

Interestingly this old address is actually my parents' address, so they do inform me if I receive any post - which is how we have caught all of this fraud so quickly because any letter that turns up is one of these fraudulent accounts.

I am confident that all current payees / accounts have my new address details.

Samwell94

bubieyehyeh said:

I think you can divulge your account details by sending someone a faster payments. Most banks don't show the senders details, but I believe some do.

Perhaps the person doing it works at one of the six companies you have a valid direct debit with, and that is how they got the new details. You could open 6 new accounts, and manually put one DD with each. Your bank maybe willing to assist.

Perhaps they are using the open banking APIs to get the account details, I'm not sure on how that is secured, but something to look into.

This is exactly what I am thinking, and one particular company comes to mind with the timings, so I'm tempted to try a new account and slowly move things over one by one until the fraud moves to the new account.

This could be a great line of enquiry - thank you!

flo22

Samwell94 said:

My bank do not have a way of blocking DD or verifying them before they come through - not sure if this is standard practice,

Are you sure?  The bigger (older) banks can do this, not online but in branch or on the phone.  An unspecified cancellation will block any new Direct Debits when the instruction to add the mandate comes into the bank (this is always prior to a payment being collected).

Penelopa.Pitstop

Samwell94 said:

bubieyehyeh said:

I think you can divulge your account details by sending someone a faster payments. Most banks don't show the senders details, but I believe some do.

Perhaps the person doing it works at one of the six companies you have a valid direct debit with, and that is how they got the new details. You could open 6 new accounts, and manually put one DD with each. Your bank maybe willing to assist.

Perhaps they are using the open banking APIs to get the account details, I'm not sure on how that is secured, but something to look into.

This is exactly what I am thinking, and one particular company comes to mind with the timings, so I'm tempted to try a new account and slowly move things over one by one until the fraud moves to the new account.

This could be a great line of enquiry - thank you!

That was my first thought, that one of the company with DD must leaking the data. How else someone could get your new account details?
Opening 6 accounts and move one DD per account is a bit extreme, but maybe just move 1 DD to new account, wait a month or two and then next one and see if something is happening.

Samwell94

Samwell94 said:

First time poster - I hope I have put this in the correct place 

Over the last 6 months I have had numerous direct debits set up without my knowledge on my bank account.
These have consisted of: Phone Contracts, Utility Bills, Broadband, Home Insurance.

After some digging with the individual companies involved, it appears my identity has been stolen, as somebody has set them all up with my Name, Date of Birth, my Bank Account and Sort Code, and my Old Address.
Interestingly, they have managed to switch Energy and Broadband providers at my old address, without the current owners' consent, and at my cost!
All money has been returned (due to Direct Debit laws).

I have since changed my Bank Account, and have not provided my Bank Account Details to anybody other than the remaining 6 direct debits I have on my account. (I haven't even given the details to my partner or family!)
Strangely enough, the Fraud has started again within a month of closing the old bank account and more Direct Debits have been set up and the companies have confirmed my details have been used fraudulently again! 

My Bank has no power to act any further.
The companies responsible for the direct debits will not investigate because they are nominal amounts of money, and the cost to investigate would be greater than the money lost to the Direct Debit indemnity.
Having spoken to the Police and Action Fraud UK, the following law applies:
"The use of another person's identification details (or the use of false identification details), often referred to as 'identity theft', is not an offence in law. We can only record a crime report on behalf of companies or organisations which incur a loss as a result of the misuse of your identity."
So I am powerless to push for further investigation without the support of these companies.

I'm relatively clued up on personal security (currently working for a large tech company, where security is a huge part of what we do), and I can say confidently that I have not exposed my Bank Details knowingly since the new account was set up.

At face value, it seems impossible that the fraudster could be benefiting enough from just me to make this worthwhile (especially given that I always claim the money back and close the accounts), so I'm wondering if anybody else has experienced this before?

I've been given 2 options:
Sign up for CIFAS (which will stop new credit applications without my approval, but cannot stop new Direct Debits - this will also make it more time-consuming for me to get credit)
Wait for the fraudster to do something bigger that costs a company enough to fully investigate (I'd rather not have a huge debt racked up in my name!)

Has anybody heard of this before? And does anybody have any opinions on next steps? (Perhaps even who I could write to, to warn others of the lack of protection in law!)

I appreciate any reads, opinions and responses, as I'm being driven round the bend by this 

For those playing along at home, I carried out an experiment.

I took out a direct debit with the old bank details and it turned up in the new bank account which means I have been misinformed by the bank,

This makes sense now, and means my new details weren't compromised as they thought. 

Case closed!

Zanderman

That suggests you either did switch accounts using CASS.
Or you have otherwise advised your old bank your new details.
Otherwise how would the old bank know which new bank, and which account, to pass the DD instruction on to?
Which bank are you suggesting has misinformed you?  Old or new? It's the old one that's passing instructions on.

Samwell94

Zanderman said:

That suggests you either did switch accounts using CASS.
Or you have otherwise advised your old bank your new details.
Otherwise how would the old bank know which new bank, and which account, to pass the DD instruction on to?

I remained with the same bank, with their guarantee that the two accounts wouldn't be linked - I guess I was naive by believing them

Zanderman

Samwell94 said:

Zanderman said:

That suggests you either did switch accounts using CASS.
Or you have otherwise advised your old bank your new details.
Otherwise how would the old bank know which new bank, and which account, to pass the DD instruction on to?

I remained with the same bank, with their guarantee that the two accounts wouldn't be linked - I guess I was naive by believing them

So, in all this saga, you were with the same bank?? 
That would explain a lot. 
I assumed, as I suspect others did, that you had changed bank.