Breach of customer data (bank details)

haines81

Hi - I’ve recently discovered that my bank details have been used to pay for someone else’s insurance cover (for the last 3 years!). I am with said insurance provider and the bank details that have been being used are a different account to my usual direct debit. What are my rights for this breach? They will repay the £500 payments and put it down to human error but I don’t feel that cuts it!

Browntoa

Your negligence as well for not checking your bank statements for 3 years

You are , at best, likely to get a "Goodwill" offer of £20-50 if you are lucky.

Aylesbury_Duck

How much are you after?

davidmcn

Whose human error and what "breach" exactly? If somebody else submitted your account details (I presume we are talking about a paperless direct debit?), how would your bank know that wasn't with your knowledge? 

finalfantasist

Given you haven't noticed it in 3 years, it doesn't seem like you've been affected by it at all so I don't see why they need to compensate you.

eddddy

If you suffered a loss as a result of the error - such as loss of interest or extra overdraft fees - you might have a case for claiming those back from whoever made the error. 

If you make a complaint to the Financial Ombudsman, they have the power to order compensation for distress and inconvenience.  How much distress and inconvenience were you caused? If you just had to make a couple of phone calls - if you're lucky they might award £25.



(FWIW, almost the same thing happened to me. A credit card company set up 2 direct debits against my bank account, one for my card and one for the card of another random customer of theirs. They very quickly agreed it was their error, and told me to do a DD indemnity claim, which they said they would not challenge. It was sorted in 2 or 3 phone calls. I didn't bother asking for compensation.)

born_again

haines81 said:

Hi - I’ve recently discovered that my bank details have been used to pay for someone else’s insurance cover (for the last 3 years!). I am with said insurance provider and the bank details that have been being used are a different account to my usual direct debit. What are my rights for this breach? They will repay the £500 payments and put it down to human error but I don’t feel that cuts it!

https://cleardirectdebit.co.uk/direct-debit-indemnity-claims

But in reality the Ins co should be paying you back.... As well as advising you that you need to check your bank statements.

Sandtree

haines81 said:

I am with said insurance provider and the bank details that have been being used are a different account to my usual direct debit. What are my rights for this breach? They will repay the £500 payments and put it down to human error but I don’t feel that cuts it!

Have you actually spoken to the insurer in question given you have an existing relationship with them? 

Ex used to work in counter fraud for insurance and the number of people that phone up saying their payment details have been compromised and it turns out they forgot they had travel or pet insurance with us as well as their car just isnt funny. Followed closely by parents who bought their kid insurance when they first started out and never cancelled it so they've been paying their kids insurance for several years.

Assuming the payments are being made for a policy that isnt in your name then your bank will refund the monies under the guarantee though why its taken you so long to see it may come up. Bank account numbers are not exactly secure and dont even have a check digit so its very possible that someone randomly misskeys an account number and chances upon a valid sort code/account number combination. 

born_again

Sandtree said:

Have you actually spoken to the insurer in question given you have an existing relationship with them? 

Ex used to work in counter fraud for insurance and the number of people that phone up saying their payment details have been compromised and it turns out they forgot they had travel or pet insurance with us as well as their car just isnt funny. Followed closely by parents who bought their kid insurance when they first started out and never cancelled it so they've been paying their kids insurance for several years.

Assuming the payments are being made for a policy that isnt in your name then your bank will refund the monies under the guarantee though why its taken you so long to see it may come up. Bank account numbers are not exactly secure and dont even have a check digit so its very possible that someone randomly misskeys an account number and chances upon a valid sort code/account number combination. 

https://www.sortcodes.co.uk/modulus-checking

The odds of a simple miss key are very slim.

Totally agree with the bit about family or forgetting about other policies taken out, but on auto renew.

Sandtree

born_again said:
https://www.sortcodes.co.uk/modulus-checking

The odds of a simple miss key are very slim.

Totally agree with the bit about family or forgetting about other policies taken out, but on auto renew.

Have to say that is a terribly written website, that or I'm just not in the right mood for reading.

It effectively states that some banks do have a checksum value and others either a) dont or b) dont publish the logic as they say their software gives three main responses:

Valid bank account number structure. 
Account number does not pass the modulus check. 
Modulus checking cannot be carried out. 

They claim their software has the widest coverage in the UK but that doesnt say if its 5% or 95%

So yes, if its a bank that does have a checksum value then a random miskey is unlikely but if its one that doesnt then its moderately likely.

Mickey666

Imagine two scenarios:
1 - bank/someone makes an error and a customer's account is wrongly debited.  Customer notices within days, notifies bank, bank immediately refunds the money and fixes the problem.  
2 - bank/someone makes an error and a customer's account is wrongly debited.  Customer notices after THREE YEARS, notifies bank, bank immediately refunds the money and fixes the problem.  

Which scenario deserves what compensation?