Correct 'Authority' to investigate Identity Theft?

fiscoking

Hi,

I recently found out someone was operating a gambling account in my name & address.

While looking ta my credit file, I noticed that SkyBet were running 'Gambling Affordability Checks' on me, which was odd as I don't have an account with them. So I sent an email over and raised a complaint. Asked them to look into it. They eventually got back to me and said, 'yes, you have an account with us, so we've closed it down..'. They won't go into any further detail on the matter though - with me. Extract from their response below:

-------------------
...  however, due to you claiming to have not created the account and in line with GDPR, we are not able to discuss account-specific information with you and will not be able to disclose details of this account to you, we can do so to the relevant authorities however as part of their lawful investigation should you wish to report this further.
-------------------

Issue is, I need to know what other information they've been using of mine, like bank accounts & credit cards - which might also not have been opened by me - so checking my own statements will be of no use.

So, who are the 'relevant authorities' that they speak of?

It's not Action Fraud. I've spoken to them. They just hand out a crime reference number and add your complaint to a database. Great for govt. stats but not much else.

Can't get hold of anyone at Trading Standards. No one picks up the phone. Been trying for days.

CIFAS won't investigate SkyBet. They'll just add a fraud marker to my file, if I pay for membership.

Spoke to the UK Gambling Commission, who told me I have to go through the SkyBet complaints procedure - which I have and that generated the response above.

Many Thanks.

Brie

A pain in the posterior but I suggest you contact all your banks and credit cards to notify them of  the identity fraud that has taken place so they can keep an eye on things for you.  

fiscoking

Brie said:

.. so they can keep an eye on things for you.  

I've already been. They just told me to report any suspicious transactions. None of them has offered anything else in terms of fraud prevention other than their standard procedure that applies to everyone.

eskbanker

fiscoking said:

...  however, due to you claiming to have not created the account and in line with GDPR, we are not able to discuss account-specific information with you and will not be able to disclose details of this account to you, we can do so to the relevant authorities however as part of their lawful investigation should you wish to report this further.

[...]

So, who are the 'relevant authorities' that they speak of?

The police (the real ones, not Action Fraud), to whom data controllers can divulge data via exemptions within data protection legislation.  However, it's academic here, as the police won't act on something like this....

In terms of proactive checks, you can register for the CIFAS protective registration:

Protective Registration | Identity Protection Service | Cifas

and/or simply check your credit files regularly to validate that there aren't any unexpected loans or accounts appearing:

Check your credit rating & report for free – MSE (moneysavingexpert.com)

fiscoking

eskbanker said:

However, it's academic here, as the police won't act on something like this....

Agreed. I've been referred to Action Fraud before by the police. Not my first ID theft. Seems to be a thing with UK regulators that they now do **** all other than give lip service, or write the odd letter if you're really lucky. I don't even know why they still exist. They nearly all just redirect you to an arbitration service that has no govt mandated authority to do anything.

eskbanker said:
In terms of proactive checks, you can register for the CIFAS protective registration:

I've had that before as well. Didn't do any good. Still ended up with fraudulent DDs. CIFAS seems to be optional. Companies handing out credit don't have to look at it, although many do. All it seemed to do was make my life harder when opening new accounts. It just makes everything take longer as they ask for more ID and your application goes into another queue. Of course if a company isn't looking at CIFAS then is makes no difference at all.

and/or simply check your credit files regularly to validate that there aren't any unexpected loans or accounts appearing:

I'm doing that already, but it doesn't get my reduced credit limits back. The only reason I found out about this is when my cc and bank emailed to let me know they were reducing my credit limits. Even if I get my credit score back, that's no guarantee I'll get the same limits back. I have to apply for the higher limits all over again. Que income and affordability checks...
---

If what you're saying is true, then what happens from here on in. SkyBet gets to sail of into the sunset as if nothing happened? If there's no way for me to find out what they've done in my name, the there's no way I can put it right.

eskbanker

fiscoking said:

eskbanker said:

However, it's academic here, as the police won't act on something like this....

Agreed. I've been referred to Action Fraud before by the police. Not my first ID theft. Seems to be a thing with UK regulators that they now do **** all other than give lip service, or write the odd letter if you're really lucky. I don't even know why they still exist. They nearly all just redirect you to an arbitration service that has no govt mandated authority to do anything.

Ultimately the government-mandated authority, as above, comprises the police and the courts, but realistically they're never going to get involved in something of this scale - it would be prohibitively expensive to staff up with enough resources to throw at this sort of issue, frustrating though that'll undoubtedly be.

eskbanker said:
In terms of proactive checks, you can register for the CIFAS protective registration:

I've had that before as well. Didn't do any good. Still ended up with fraudulent DDs. CIFAS seems to be optional. Companies handing out credit don't have to look at it, although many do. All it seemed to do was make my life harder when opening new accounts. It just makes everything take longer as they ask for more ID and your application goes into another queue. Of course if a company isn't looking at CIFAS then is makes no difference at all.

CIFAS PR puts obstacles in the way of anyone trying to open new accounts (which has to include the correct applicant too of course, by design), so won't affect setting up of DDs, but the Direct Debit Guarantee should assist those who have had erroneous DDs taken out in their name.

and/or simply check your credit files regularly to validate that there aren't any unexpected loans or accounts appearing:

I'm doing that already, but it doesn't get my reduced credit limits back. The only reason I found out about this is when my cc and bank emailed to let me know they were reducing my credit limits. Even if I get my credit score back, that's no guarantee I'll get the same limits back. I have to apply for the higher limits all over again. Que income and affordability checks...

Have your CC and bank confirmed that they reduced limits specifically because of a gambling account in your name?

---

If what you're saying is true, then what happens from here on in. SkyBet gets to sail of into the sunset as if nothing happened? If there's no way for me to find out what they've done in my name, the there's no way I can put it right.

I'm not sure what else you expect to happen?  Surely it's self-evident that the fraudster succeeded in opening an account with SkyBet, but SkyBet are hardly going to quote chapter and verse about how their security setup permitted that to happen, and even if they did, how would that help you?

Comments inline above....

p00hsticks

fiscoking said:

If what you're saying is true, then what happens from here on in. SkyBet gets to sail of into the sunset as if nothing happened? If there's no way for me to find out what they've done in my name, the there's no way I can put it right.

Basically I think the position is that you can't have it both ways.
Either the account is nothing to do with you and set up by a fraudster, in which case Skybet are forbidden under GDPR rules from talking to you about it, or it was set up by you in which case you're liable for the account. 

Skybet will be doing their own investigation in the background but they won't be sharing their findings with you. 

fiscoking

p00hsticks said:

Skybet will be doing their own investigation in the background but they won't be sharing their findings with you. 

I'm fine with that provided they put all the credit info on me right. The last bank that was ripped off with a fraudulent account in my name offered to do this. I had to sign a document confirming the account wasn't set up by me and they then went to work correcting data with credit agencies. SkyBet haven't bothered, although I am in dialogue with them and I'll see where that goes.

eskbanker said:
Ultimately the government-mandated authority, as above, comprises the police and the courts, but realistically they're never going to get involved in something of this scale - it would be prohibitively expensive to staff up with enough resources to throw at this sort of issue, frustrating though that'll undoubtedly be.

Any individual can bring a private criminal prosecution where the CPS haven't agreed to, and once it's accepted by the courts the case proceeds in the same way as a CPS case but using your own legal team. The issue is it costs North of 5K to bring one, which is why many don't, and I won't either.

eskbanker said:
CIFAS PR puts obstacles in the way of anyone trying to open new accounts (which has to include the correct applicant too of course, by design), so won't affect setting up of DDs, but the Direct Debit Guarantee should assist those who have had erroneous DDs taken out in their name.

It works if you don't go overdrawn as a result of the fraud. If you do and other legit DDs bounce then that's all *your* problem to sort out. There's also nothing stopping the company that made the DD from re-instating it to collect the money they think you owe them if you haven't proved the account attached to the DD is being operated by a fraudster. This is why many banks tell customers to contact the company issuing the DD first to sort out any 'misunderstanding'. The DD system is a mess. It was set up decades ago when there was a lot more trust.

BTW, I'll say it again. Looking at CIFAS is optional. It's not the law from a companies perspective. Big banks look at it, but smaller half-baked operations don't, and even if they do, the action they take is entirely up to them. They're in charge of their own fraud prevention process and what goes into it. I can now see why they don't really bother. The fines are non-existent, and no authority investigates. Any mess that's created has to be dealt with by the victim and at their cost. No different to being burgled if you don't have insurance I suppose...

eskbanker said:
I'm not sure what else you expect to happen?  ...

I would like SkyBet to put right the crap they've fed into my credit history. ATM that doesn't appear to be an option as they want a 'correct authority' to confirm a crime has been committed.

Thanks for all your replies. If I get any further with this I'll post back and update.

eskbanker

fiscoking said:

eskbanker said:
Ultimately the government-mandated authority, as above, comprises the police and the courts, but realistically they're never going to get involved in something of this scale - it would be prohibitively expensive to staff up with enough resources to throw at this sort of issue, frustrating though that'll undoubtedly be.

Any individual can bring a private criminal prosecution where the CPS haven't agreed to, and once it's accepted by the courts the case proceeds in the same way as a CPS case but using your own legal team. The issue is it costs North of 5K to bring one, which is why many don't, and I won't either.

I think you're missing the point - mine was that SkyBet will only relay detailed data to an investigation being conducted by a mandated authority, so I don't see where private prosecution comes into it when you don't know who the fraudster is, or are you meaning that you'd envisage prosecuting SkyBet, and if so, on what grounds?

fiscoking said:

eskbanker said:
CIFAS PR puts obstacles in the way of anyone trying to open new accounts (which has to include the correct applicant too of course, by design), so won't affect setting up of DDs, but the Direct Debit Guarantee should assist those who have had erroneous DDs taken out in their name.

It works if you don't go overdrawn as a result of the fraud. If you do and other legit DDs bounce then that's all *your* problem to sort out. There's also nothing stopping the company that made the DD from re-instating it to collect the money they think you owe them if you haven't proved the account attached to the DD is being operated by a fraudster. This is why many banks tell customers to contact the company issuing the DD first to sort out any 'misunderstanding'. The DD system is a mess. It was set up decades ago when there was a lot more trust.

Again, I think you missed the point, which was that enhanced controls over opening accounts have nothing to do with companies or individuals setting up unauthorised DDs - I'm certainly not claiming that the DD system is perfect, but was just challenging the apparent implication that they're connected ("I've had that before as well. Didn't do any good. Still ended up with fraudulent DDs").

fiscoking said:

BTW, I'll say it again. Looking at CIFAS is optional. It's not the law from a companies perspective. Big banks look at it, but smaller half-baked operations don't, and even if they do, the action they take is entirely up to them. They're in charge of their own fraud prevention process and what goes into it. I can now see why they don't really bother. The fines are non-existent, and no authority investigates. Any mess that's created has to be dealt with by the victim and at their cost. No different to being burgled if you don't have insurance I suppose...

Banks check with CIFAS to help manage their own risk - it's not for the customer's benefit!  As you say, there's no obligation for any business to refer to it, so the CIFAS PR product isn't a universal fix, but nothing is....

fiscoking said:

eskbanker said:
I'm not sure what else you expect to happen?  ...

I would like SkyBet to put right the crap they've fed into my credit history. ATM that doesn't appear to be an option as they want a 'correct authority' to confirm a crime has been committed.

It's not an unreasonable expectation that they'd correct data that they fed to credit agencies - are they saying they won't do that?  The context of that truncated quote was your desire to find out details of what had happened, rather than simply to correct its known consequences, so their reference to relevant authorities only appeared to relate to disclosure of protected personal data to you, rather than using it as an excuse not to correct credit file data?

fiscoking

Rang Action Fraud this afternoon and had a constructive conversation with one of the people there. Cleared quite a few misconceptions up. Posted below in case it's of help to others.

The 'correct authority' is ActionFraud. They're a branch of the police which is why they can issue crime reference numbers. They don't investigate themselves, but they do review cases and refer them onto other police for investigation if the case is serious enough in their opinion, like loss of life savings.

There's no point in contacting the regular police after Action Fraud issue a crime number as Action Fraud is the division that deals with fraud.

Once I have the crime number I have to pass that onto SkyBet (as proof of a crime) and ask them to correct all data held by them on me, using their internal process which they must have as UK GDPR (law) includes a right for individuals to have inaccurate personal data rectified. This is how my credit file is corrected as only SkyBet have a contract with the credit agency they use.

The requirement for a 'proper authority to investigate' is a little misleading here. Their investigation essentially ends for simple fraud cases when they issue a crime number. After that it's up to the company that wronged you to complete their own investigation and correct any incorrect credit file data they have (in line with GDPR obligations), and pass that onto any agencies/3rd parties they've used. The only way an individual could know they've done this properly (as internal process isn't revealed) is to look at their credit file and watch for the fraudulent entries to disappear, which can take weeks to months depending on the agency.

If the company doesn't correct the credit file then I can apply to the ICO and make a complaint under GDPR obligations, who should force them to act, or bypass them and go straight to the credit agencies.

My case has another angle in that SkyBet is regulated by the Gambling Commission (GC), and so if SkyBet's internal procedure doesn't remedy the problem I can also raise a complaint to the GC, but I have to wait for SkyBet to complete their own internal procedure first.

eskbanker

fiscoking said:

Rang Action Fraud this afternoon and had a constructive conversation with one of the people there. Cleared quite a few misconceptions up. Posted below in case it's of help to others.

The 'correct authority' is ActionFraud. They're a branch of the police which is why they can issue crime reference numbers. They don't investigate themselves, but they do review cases and refer them onto other police for investigation if the case is serious enough in their opinion, like loss of life savings.

There's no point in contacting the regular police after Action Fraud issue a crime number as Action Fraud is the division that deals with fraud.

Yes, Action Fraud don't investigate but if a case is deemed worthy of follow-up then they refer it to the relevant police force, but it has to go via AF in the first place - SkyBet will then recognise the investigating police force as a law enforcement body to whom personal data can legitimately be divulged as part of any that investigation.

fiscoking said:

Once I have the crime number I have to pass that onto SkyBet (as proof of a crime) and ask them to correct all data held by them on me, using their internal process which they must have as UK GDPR (law) includes a right for individuals to have inaccurate personal data rectified. This is how my credit file is corrected as only SkyBet have a contract with the credit agency they use.

The requirement for a 'proper authority to investigate' is a little misleading here. Their investigation essentially ends for simple fraud cases when they issue a crime number. After that it's up to the company that wronged you to complete their own investigation and correct any incorrect credit file data they have (in line with GDPR obligations), and pass that onto any agencies/3rd parties they've used. The only way an individual could know they've done this properly (as internal process isn't revealed) is to look at their credit file and watch for the fraudulent entries to disappear, which can take weeks to months depending on the agency.

If the company doesn't correct the credit file then I can apply to the ICO and make a complaint under GDPR obligations, who should force them to act, or bypass them and go straight to the credit agencies.

I don't believe that SkyBet should insist on corroborative evidence of a crime if they've already accepted that an account was opened by someone using another party's detail, as their GDPR obligations require them to correct personal data known to be inaccurate regardless of whether or not there's been a crime, but that's perhaps academic if an AF reference has already been supplied.  As you say, the ICO can enforce this if necessary.