Solarplicity debt collection - - SCAM??

FreeBear

ZackMSE said:  Still nothing from BSB or ICO. BSB have had nearly 2 months to reply to me with my request for what data they hold on me but they have still not sent me anything. And I am beginning to wonder why we have the ICO. 

Lodge another complaint with the ICO pointing out that BSB have failed to comply with their GDPR obligations.

wincler

Had a very informative chat with a member of BSB this morning who told me where things are at.
He also said we would be getting contacted regarding this issue.
I also received another email demand last week from the other debt agency , so I contacted the actual company that exists and spoke to the CEO who told me he had reported the matter to the fraud squad and police having received many phone calls. The guy from BSB said they had also spoken to this CEO. BSB have involved the police.

ZackMSE

Finally received this from BSB, but it's all rubbish as I will detail below:
Security Report – Potential Fraud Case – Brilliant Energy (in administration)

We were made aware that some of our previous accounts had been contacted by a third party company claiming to represent the administrators of the company.

Upon being aware of this we have sent communications via email where possible to our previous account holders to make them aware of the threat and to not engage with the company.

We attempted to contact the collections company using the details on the email but each occasion drew a blank as the telephone numbers and emails were not connected.

We investigated the company names and although they were similarly named to existing companies they were not the real entities. They had been incorporated just days or weeks prior to the report of the emails being received.

We engaged with Action Fraud, the Administrators and the ICO where relevant to ensure that the process was actioned.

We contacted the banks with the account numbers stated on the letters to inform them of the attempted fraud/s and they were closed down almost immediately. The banks then initiated their own policies including KYC (know your customer) to track down the person/s.

A full interrogation of our storage servers showed that there were no external accesses attempted to access our data and there was no data removed at any time to a device/s not operated by BSB.

Following this examination of our servers all passwords were changed and all existing connections were severed to connected devices.

Subject to our investigation and subsequent attempts at fraud made we have determined that the person/organisation responsible for these frauds is the same entity for all names as they follow the same process and seem to have the identical data set. The data that the fraudulent company have obtained is very fuzzy and does not contain many data points and in many cases the figures requested were completely different to the actual amounts placed initially with ourselves. We are unsure where this person/s has obtained the data as all companies have been set up using third party web developers so we cannot track the entity down. We have requested further information but have never received any replies from the web domain companies that sold and/or set up the domains.

Names of companies/entities attempted by this person/s are as follows:
C Power Energy trading as Power Collections
ABD Debt Recovery
Debts Solved Limited

ZackMSE

My response to Ryan at BSB:

Upon being aware of this we have sent communications via email where possible to our
previous account holders to make them aware of the threat and to not engage with the
company.

This did not happen in my case and I also know of a number of others where this also did not happen.

We attempted to contact the collections company using the details on the email but each occasion drew a blank as the telephone numbers and emails were not connected.

Correct, but the bank account details were real as I contacted them to warn them of the fraud (Prepay Technologies Ltd, Phone Number: 01793744011)

We contacted the banks with the account numbers stated on the letters to inform them of the attempted fraud/s and they were closed down almost immediately. The banks then initiated their own policies including KYC (know your customer) to track down the person/s.  

Having done some checks on this it would appear based on the Sort Code: 236972 and Account Number: 25300777 that the back account is still valid

We investigated the company names and although they were similarly named to existing companies they were not the real entities. They had been incorporated just days or weeks prior to the report of the emails being received. 

So they were real companies, I'm not aware of fake companies being incorporated. I also looked into the name of the company that contacted me and followed up and they were indeed incorporated with Companies House.

ABD Dept Recovery Ltd Company Number: 12143059

 A full interrogation of our storage servers showed that there were no external accesses attempted to access our data and there was no data removed at any time to a device/s not operated by BSB.   

This does not mean a crime was not committed and does not mean data was not stolen. To me this implies that it could have been an ex or current employee that had access to this sensitive data. Has this been investigated?

Subject to our investigation and subsequent attempts at fraud made we have determined that the person/organisation responsible for these frauds is the same entity for all names as they follow the same process and seem to have the identical data set. The data that the fraudulent company have obtained is very fuzzy and does not contain many data points and in many cases the figures requested were completely different to the actual amounts placed initially with ourselves. We are unsure where this person/s has obtained the data as all companies have been set up using third party web developers so we cannot track the entity down. We have requested further information but have never received any replies from the web domain companies that sold and/or set up the domains.

This was not the case for me and also I know of a number of others on a forum we have created to track this scam. The amounts, name and emails were identical to those that were held by your company. As far as chasing down the web companies this is something that the ICO and Action Fraud should be aware of as they have the powers to request that information.

In conclusion we have determined that the leak of data did not come from within our organisation. We acted swiftly to inform potential victims of these attempts and liaised with the relevant organisations to close down these organisations rapidly. 

In my opinion I don't believe this is the case, I received very little if any communication from you despite my best efforts in requesting it on a number of occasions and how can you confidently say that this leak did not come from one of your current or ex employees.

Names of companies/entities attempted by this person/s are as follows:
C Power Energy trading as Power Collections - These do not exist as far as I can see on companies house so how can you say 'we have determined that the person/organisation responsible for these frauds is the same entity for all names'

ABD Debt Recovery - Company Number: 12143059
Debts Solved Limited - Company Number: 06391280

Both ABD Debt Recovery and Debts Solved Limited have different registered address and none of the registered people match between the two so again how can you say 'we have determined that the person/organisation responsible for these frauds is the same entity for all names'

Also I have still not recieved what information they hold on me (Article 15 GDPR) despite requesting it on a number of occasions. I have reported this to the ICO.

MAN_UK

ZackMSE said:

My response to Ryan at BSB:

Upon being aware of this we have sent communications via email where possible to our
previous account holders to make them aware of the threat and to not engage with the
company.

This did not happen in my case and I also know of a number of others where this also did not happen.

We attempted to contact the collections company using the details on the email but each occasion drew a blank as the telephone numbers and emails were not connected.

Correct, but the bank account details were real as I contacted them to warn them of the fraud (Prepay Technologies Ltd, Phone Number: 01793744011)

We contacted the banks with the account numbers stated on the letters to inform them of the attempted fraud/s and they were closed down almost immediately. The banks then initiated their own policies including KYC (know your customer) to track down the person/s.  

Having done some checks on this it would appear based on the Sort Code: 236972 and Account Number: 25300777 that the back account is still valid

We investigated the company names and although they were similarly named to existing companies they were not the real entities. They had been incorporated just days or weeks prior to the report of the emails being received. 

So they were real companies, I'm not aware of fake companies being incorporated. I also looked into the name of the company that contacted me and followed up and they were indeed incorporated with Companies House.

ABD Dept Recovery Ltd Company Number: 12143059

 A full interrogation of our storage servers showed that there were no external accesses attempted to access our data and there was no data removed at any time to a device/s not operated by BSB.   

This does not mean a crime was not committed and does not mean data was not stolen. To me this implies that it could have been an ex or current employee that had access to this sensitive data. Has this been investigated?

Subject to our investigation and subsequent attempts at fraud made we have determined that the person/organisation responsible for these frauds is the same entity for all names as they follow the same process and seem to have the identical data set. The data that the fraudulent company have obtained is very fuzzy and does not contain many data points and in many cases the figures requested were completely different to the actual amounts placed initially with ourselves. We are unsure where this person/s has obtained the data as all companies have been set up using third party web developers so we cannot track the entity down. We have requested further information but have never received any replies from the web domain companies that sold and/or set up the domains.

This was not the case for me and also I know of a number of others on a forum we have created to track this scam. The amounts, name and emails were identical to those that were held by your company. As far as chasing down the web companies this is something that the ICO and Action Fraud should be aware of as they have the powers to request that information.

In conclusion we have determined that the leak of data did not come from within our organisation. We acted swiftly to inform potential victims of these attempts and liaised with the relevant organisations to close down these organisations rapidly. 

In my opinion I don't believe this is the case, I received very little if any communication from you despite my best efforts in requesting it on a number of occasions and how can you confidently say that this leak did not come from one of your current or ex employees.

Names of companies/entities attempted by this person/s are as follows:
C Power Energy trading as Power Collections - These do not exist as far as I can see on companies house so how can you say 'we have determined that the person/organisation responsible for these frauds is the same entity for all names'

ABD Debt Recovery - Company Number: 12143059
Debts Solved Limited - Company Number: 06391280

Both ABD Debt Recovery and Debts Solved Limited have different registered address and none of the registered people match between the two so again how can you say 'we have determined that the person/organisation responsible for these frauds is the same entity for all names'

Also I have still not recieved what information they hold on me (Article 15 GDPR) despite requesting it on a number of occasions. I have reported this to the ICO.

thanks for the update, still waiting to hear from them

interestingly the one point that response from BSB appears to be ignoring in their response is the fact that all breaches reported here have been from 3 different energy providers (Solarplicity, Northumbria Energy, Brilliant Energy) who BSB was assigned as the collection agency

who or what the scammers do is a matter for the police what matters to us is how our private and personally identifiable data has been compromised which BSB as the data handler has a legal obligation to protect under GDPR and ICO mandates

God only knows how the data that has been breached could be used in the future to steal identities or addversely impact credit worthiness of the individuals impacted with the breach