Laybuy hacked, fraudulent spending, no response from laybuy

normster

Please advise if this needs to go to another thread. 

Last week my laybuy account was hacked and used on a number of retailer sites in a short space of time. By the time I realised, £1200 of transactions had occurred.

I immediately contacted the credit card company attached to the account who put a block on any further transactions (laybuy have attempted to take the next round of payments since). CC company advised I needed to contact laybuy before any dispute could be raised.

Laybuy customer service is thin on the ground to say the least. No telephone number, the link to the fraud 'form' is actually a link to a general faq section with no fraud form at all. I therefor left a message on the chat, which after 7 days remains unread. As a last resort I've emailed the help and support email addresses. Still no response.

The CC company are now, thankfully, disputing the charges. In the meantime though I'm now getting emails telling me late charges will be applied on transactions that are completely fraudulent. My very real worry is that this is now going to end up on my credit file through absolutely no fault of my own and despite my best efforts to get the attention of laybuy. 

What the hell should I do here? 

MattMattMattUK

normster said:

Please advise if this needs to go to another thread. 

Last week my laybuy account was hacked and used on a number of retailer sites in a short space of time. By the time I realised, £1200 of transactions had occurred.

I immediately contacted the credit card company attached to the account who put a block on any further transactions (laybuy have attempted to take the next round of payments since). CC company advised I needed to contact laybuy before any dispute could be raised.

Laybuy customer service is thin on the ground to say the least. No telephone number, the link to the fraud 'form' is actually a link to a general faq section with no fraud form at all. I therefor left a message on the chat, which after 7 days remains unread. As a last resort I've emailed the help and support email addresses. Still no response.

It is very unlikely that the account has been hacked, it is much more likely that it has been compromised by a third party obtaining the password, if it is a password you reuse on multiple sites then you need to change those passwords and they should all be different. Do you have two factor authentication turned on? Can you access the account again by resetting the password? I would chase them again, by email and by writing to them at their registered address. 

normster said:

The CC company are now, thankfully, disputing the charges. In the meantime though I'm now getting emails telling me late charges will be applied on transactions that are completely fraudulent. My very real worry is that this is now going to end up on my credit file through absolutely no fault of my own and despite my best efforts to get the attention of laybuy. 

What the hell should I do here? 

The credit card company disputing the charges may trigger a response/contact from LayBuy. LayBuy are not subject to the FOS so you do not have that route, but if you got really stuck there would be other options. Finally these might get reported on your credit file until they are revised, but unless you are planning on taking out a mortgage in the next few months that is unlikely to be an issue and ultimately you could dispute them with the CRA as well. 

You should also report this to Action Fraud, they will not actually do anything, but they will generate a reference number which the card provider and/or LayBuy might want.
https://www.actionfraud.police.uk/

normster

Reported to action fraud already, rejected. Agree this is likely a compromise but the transactions are still not mine. Unfortunately remortgage is looming. It's unfathomable that the ability to contact them is so constrained. I can't be the only person to have encountered this. 

MattMattMattUK

normster said:

Reported to action fraud already, rejected. 

Fair enough, I thought that might be the case as technically the party ultimately defrauded is going to be LayBuy.

normster said:

Agree this is likely a compromise

Have you dealt with that compromise though, changed your passwords, made sure you are not reusing them, enabled 2FA?

normster said:

but the transactions are still not mine.

I am not actually sure where the direct liability sits here if they deem you to have allowed your account to be compromised. They are not under the FOS so that would somewhat complicate matters as well. Have you contacted the retailers and cancelled any orders that had not shipped and informed them as well? Did you have any app verifications, 2FA codes or requests for your LayBuy PIN?

normster said:

It's unfathomable that the ability to contact them is so constrained.

It is far from great, but they, the same as all other BNPL companies operate a very lean business model, it is not great, but it is also what it is. You are likely going to require some persistence. 

normster said:

I can't be the only person to have encountered this. 

You probably are not, but that makes no difference to your current situation. They are from what I can see a very small player in the market, their Confirmation Statement with Companies House is overdue which is never a good sign.
https://find-and-update.company-information.service.gov.uk/company/11156956

normster

Password was changed immediately - this was already unique to Laybuy but I guess good luck proving that. There is no 2FA option on Laybuy from what I can see. I also can't see how they'd actually prove I allowed my account to be compromised, I guess that's where the battle will be. I have contacted the retailers but only have the details of the amount and the laybuy ID - guess I'll wait see what happens there.

I'll update on this as it progresses.

Loubylou7hyinbhh

I’ve had the same last week, two orders placed on my laybuy account for j d sports that are fraudulent! Cannot get hold of laybuy for love nor money!! Did you see the announcement on their website stating a security breach and peoples details have been leaked, I’m now facing the late fees and then repeatedly trying to take the payments 😭

HazyBaby

This has happened to me too and if you go on to Trust Pilot loads of others in the UK.  I have reported to the Police, Citizens Advice, Experian and Information Commissioners.  The Citizens Advice is going to report it to the Trading Standards.  Laybuy is not responding to three emails that I sent to help@laybuy.com starting on Tuesday 13 February 2024.  I was sent an email from Laybuy about a purchase from FootAsylum.  They took a payment from my bank account of £39.32 and there is six scheduled payments due.  I cannot close my Laybuy account; they said because I owe them money.  I DID NOT MAKE THIS PURCHASE.  Never received an email from FootAsylum either.  I will inform FootAsylum of the order number in the email but it might be fraudulent I don't know.  If you go on to Trust Pilot Reviews there are loads of the same.  Credit files are being impacted.

normster

Just a quick update. I'm now ramping up the Trustpilot campaign on this. Every response on trust pilot is a canned response. No response to online chat or the emails to the help and support email addresses (I assume they use both those terms ironically). I've disputed all transactions with AMEX, all money currently under dispute so not accruing interest at least. I've contacted CAB who are drafting a letter for me to send directly to their registered office. The registered office has a phone number BTW if you search for it but seems to be a residential number. What a shambles.

I contacted all of the retailers affected. 2 of them recognised the fraud (Kershkicks (2 orders) and Staytech (2 orders) - Staytech fulfilled one order but caught the second one, Kershkicks recognised both as fraud and halted the order). WH Smiths tracked down the 3 transactions using the Laybuy transaction IDs and have said they are refunding, but that seems to be taking a while to seep through. The Fragrance Shop and Perfume Direct have not been as responsive but I'm trying.

FYI here's the trustpilot link - https://uk.trustpilot.com/review/laybuy.com. Top 3 reviews are mine. This will now become a daily thing.

Here's hoping this becomes a class action!

MattMattMattUK

normster said:

Just a quick update. I'm now ramping up the Trustpilot campaign on this. Every response on trust pilot is a canned response. No response to online chat or the emails to the help and support email addresses (I assume they use both those terms ironically). I've disputed all transactions with AMEX, all money currently under dispute so not accruing interest at least. I've contacted CAB who are drafting a letter for me to send directly to their registered office. The registered office has a phone number BTW if you search for it but seems to be a residential number. What a shambles.

I contacted all of the retailers affected. 2 of them recognised the fraud (Kershkicks (2 orders) and Staytech (2 orders) - Staytech fulfilled one order but caught the second one, Kershkicks recognised both as fraud and halted the order). WH Smiths tracked down the 3 transactions using the Laybuy transaction IDs and have said they are refunding, but that seems to be taking a while to seep through. The Fragrance Shop and Perfume Direct have not been as responsive but I'm trying.

FYI here's the trustpilot link - https://uk.trustpilot.com/review/laybuy.com. Top 3 reviews are mine. This will now become a daily thing.

Here's hoping this becomes a class action!

Thanks for the update. A quick note that there is no such thing as a class action in the UK, it is an American thing. There is Group Litigation which is somewhat similar, but also has substantial differences. 

Mrwebb88

The same has happened to me weekly payments emails txt messages from Laybuy my bank is refunding the payments yet Laybuy don’t care to respond, how can I possibly put an end to it?