Lloyds Bank have changed my Username/User ID without informing me

[Deleted User]

Link:

www.gdpreu.org/the-regulation/key-concepts/personal-data/

Here are some examples as to what is considered PII. If a cookie ID can be considered PII I'm pretty sure a personal User ID can be as well.

jonesey1985

Except there's a whole ream of information required in order to get the user ID.  Information that you essentially left "lying around."

That's not a breach. If the bank asks security questions but your information has been compromised, that's not their problem and they're not going to get in trouble for it.

Arguably the only breach is your girlfriend impersonating you.

eskbanker

DeletedUser said:

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

Not sure I'm following the apparent contradiction, but was this being done on the same device you use to log in, i.e. could the retrieval of your user ID have been driven by cookies or similar retained data?  I seem to recall that LBG brands use the concept of 'trusted devices'....

jonesey1985

eskbanker said:

DeletedUser said:

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

Not sure I'm following the apparent contradiction, but was this being done on the same device you use to log in, i.e. could the retrieval of your user ID have been driven by cookies or similar retained data?  I seem to recall that LBG brands use the concept of 'trusted devices'....

The GF appears to have used the sort code and account number of the joint account with the OP's name and DOB to get the User ID.

She essentially impersonated the OP with the information she knew, which as I said is hardly the banks fault.

[Deleted User]

eskbanker said:

DeletedUser said:

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

Not sure I'm following the apparent contradiction, but was this being done on the same device you use to log in, i.e. could the retrieval of your user ID have been driven by cookies or similar retained data?  I seem to recall that LBG brands use the concept of 'trusted devices'....

Nope done on a completely different device. All a trusted device is is a cookie stored in your browser.

xylophone

It now seems that Lloyds didn't inform you about the change of User ID because it appeared that you yourself had changed it.

You can't blame Lloyds for your girlfriend's having "impersonated" you.

Lloyds could close the account on this basis but given that it is a joint account, they probably won't - time for your girlfriend to register for internet banking with her own log-in details.

Daliah

DeletedUser said:

This is what happened.

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

So that's the breach of security and personal information. 

Highly, highly unlikely story, sorry.

There's a lot more that must have happened. 

Also, given that your girlfriend impersonated you, your issue is with your girlfriend, not with Lloyds.

[Deleted User]

Daliah said:

DeletedUser said:

This is what happened.

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

So that's the breach of security and personal information. 

Highly, highly unlikely story, sorry.

There's a lot more that must have happened. 

Also, given that your girlfriend impersonated you, your issue is with your girlfriend, not with Lloyds.

Nope this is 100% what happened

Daliah

DeletedUser said:

Daliah said:

DeletedUser said:

This is what happened.

I have a joint account with my GF, she thought she had internet banking with Lloyds (I do all our accounting, so she has never needed to use it as all her other accounts are not with Lloyds)

she went to this URL:
/online.lloydsbank.co.uk/ib-access/cwa/forgotten-details/index.html#/your-details?_k=95vl8f

Filled in her details, which returned nothing as it turns out she not not setup up internet banking. She then filled in my name and DOB.

This displayed my User ID, I don't know which User ID was displayed but it was this action which changed my User ID.

So that's the breach of security and personal information. 

Highly, highly unlikely story, sorry.

There's a lot more that must have happened. 

Also, given that your girlfriend impersonated you, your issue is with your girlfriend, not with Lloyds.

Nope this is 100% what happened

Yep, based on what you posted, it is 100% correct that your girlfriend impersonated you.

If she did this with your agreement, you could be found in breach of your agreement with Lloyds.

[Deleted User]

Anyway it doesn't matter what you think, Lloyds have apologized for whats happened and compensated me for the inconvenience, they have also acknowledged the security issue and they are looking into the GDPR breach which I was advised by the ICO to raise with them.