This seems dodgy- should I report it?

DH51

I booked an online course Jan 21 and paid in December 20.

The salesman basically told lies to get me to book- “the reason this course was one of the best was that I could record the sessions to go back over”- was the main one, 5 mins into the course, the instructor explained this wasn’t even possible on their platform.
As you expect sales people to lie to get business, I was fairly philosophical about this.

Last week I received a request for payment of the overdue invoice for the course. I checked my credit card statement and emailed back immediately with the date the payment was processed.
The salesman immediately responded that his computer had been “hacked” and a virus sent out this email.
I have since asked if the ICO have been contacted as required by GDPR if a breach has occurred and your customer data has been lost. 

Due to this persons history of being more than economical with the truth, here’s what I actually think is going on: he sends out these overdue notices in the hope that people will just pay up (people are stupid), some may. For those who question he backs down immediately with his “hack” story. I don’t know if he is putting his own account details for payment, or if this is a scam sanctioned by the training company.

I would be interested in your view on this, as there appears to be illegal behaviour:
A breach resulting in loss of personal data not being reported to the ICO and to affected customers
Or fraudulent requests for payments already received

Ironically this company does GDPR training and I know to query with ICO, but who would I report a suspected fraud to- if it even is fraud?
thanks

gettingtheresometime

When they said the sessions could be recorded, did they mean that you could use an app to record what was happening on the screen?
As for the reminder invoice, it would be interesting to compare any bank details quoted on the differing invoices; if they do differ then I would want confirmation of the proper bank details before making any further allegations.
However, having said that, because of checks made during the online payment process now, I would imagine it was difficult - if not impossible - for the account details not to match to that of the company's.