Lloyds Bank have changed my Username/User ID without informing me

Ergates

DeletedUser said:

I've been a Lloyds customer  since the early 2000 and have never changed my username/user ID. To my shock I tried to log on this morning and I was unable to do so and I was being told my credentials are wrong. The first thing I though was my account had been hacked so I checked my IOS app and thankfully I was able to login via touchID.

I quickly noticed that my Username/User ID had been changed. This is a major breach of data security so I asked Lloyds CS whats going on and all they could tell me was a change was made in their backend.

As a software developer it is crazy to be changing your customers Authentication without them knowing it or consenting to it. I've raised a compliant asking to know exactly what happened and why/how it happened.

I was wondering if there was anyone in this community who had advice on this subject because I feel this is quite a serious breach of data security and feel some banking codes might have been broken here.

AS ZX81 says - this isn't a breach of data security - your data is just as secure as it was before the change.  Also, as the operators of your online bank account it is their prerogative to change your log in details as and when they see fit.  Which banking codes do you think have been broken?

You're right about it being crazy for them to change it *without telling you* - very poor customer service.

xylophone

You're right about it being crazy for them to change it *without telling you* 

Absolutely right.

very poor customer service.

Therefore absolutely right to make a formal complaint - in these circumstances, I wouldn't hesitate.

MEM62

DeletedUser said:

As a software developer 

DeletedUser said:

I feel this is quite a serious breach of data security and feel some banking codes might have been broken here.

In your professional capacity, what data do you feel has been compromised. Certainly, this may be poor customer service but it's not a data breach.  

 

[Deleted User]

CurryGuy said:

Deleted User said:

Nick_C said:

So complain.  LBG are very generous with compensation in my experience.  They've chucked money at me a couple of times, when that was not what I was looking for!

It's called go away money and the OPs title says it all - 'my username/User ID' when it belongs to the bank and they can change it at their discretion.

I think it's a perfectly reasonable titles because if they said "the banks username/User ID" it wouldn't make any sense and any letter will say this is the customers User ID because it's used to identify that specific customer.

I also agree it's silly to change a User ID without informing the customer when that is what they use to login. At the very least they could have sent an email but a letter may eventually turn up explaining it. 

Never said it was a good customer service but ultimately it's their login details to change.

emmajones1976

Interested into the "data breach" allegation. As far as I can see, Lloyds Banking group held the data before, and LBG still hold the data now, and the process of changing your username wouldnt have involved any unauthorised access into your account, an account anyone from LBG can go in and choose to look at anyway for any legitimate reason, for which this would be one.

mab3000

It’s strange how the OP was still able to access the banking app considering you need to use your internet banking details when you first sign up to the app. Would have thought if the username changed and didn’t exist anymore then the app would have auto logged out and needed to be re registered with the new details. 

Neil49

DeletedUser said:

So it was replaced a 9 digit integer with another a 9 digit integer!?

It makes no sense.

My login id is more than 20 years old and 8 alphanumeric characters long (2 letters and 6 numbers).

It's still working!

Ergates

mab3000 said:

It’s strange how the OP was still able to access the banking app considering you need to use your internet banking details when you first sign up to the app. Would have thought if the username changed and didn’t exist anymore then the app would have auto logged out and needed to be re registered with the new details. 

Not necessarily - many mobile apps connect via a different method than the internet banking.

[Deleted User]

This is what happened.

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

So that's the breach of security and personal information. If I dropped my wallet which contains my drivers license and debit card and my mobile, you can use those details to obtain the accounts User ID.

You could then brute force the password (most people have very weak passwords) the 1st part of login process is complete. You then brute force the second part of the login process and the unique code then gets sent to the phone. Not that difficult to do if you know how.

[Deleted User]

DeletedUser said:

This is what happened.

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

So that's the breach of security and personal information. If I dropped my wallet which contains my drivers license and debit card and my mobile, you can use those details to obtain the accounts User ID.

You could then brute force the password (most people have very weak passwords) the 1st part of login process is complete. You then brute force the second part of the login process and the unique code then gets sent to the phone. Not that difficult to do if you know how.

I forgot to add, when using that link to find out your user ID, it should really be sent to you via email, not displayed in the browser.

Also re getting the unique code on your phone, even if your phone is locked most phones will display text messages on the lock screen.