Letter from Very.co.uk saying I have been impersonated, should I complain?

NibblyPig

I got this letter saying I've been impersonated and someone has opened an account in my name, ordered some items (to my house) and had them redirected at the last minute.

I phoned them, and they've set me up on some fraud database. But how did they allow this to happen? They're like great, thanks, bye, washed their hands of it.

I am wondering if I should open a complaint. It should not be possible to open a credit account in my name, their checks are obviously not sufficient and they should not allow the delivery company to redirect orders either (or especially not the first order), I've certainly bought items in the past where the delivery company demands a signature and gives no option to change the delivery address.

As a company director my name, dob and address are publicly available on companies house. It's unclear what else they would need.

Should I be raising holy hell over this? I feel like they are just shrugging it off but now I'm going to have to dig around trying to get a credit report and try to get to the bottom of what's going on, and I've been registered on some system that will presumably make getting further normal credit more difficult, all because this company didn't check properly.

I'm very cross!!! Any advice welcome.

Aylesbury_Duck

NibblyPig said:

I got this letter saying I've been impersonated and someone has opened an account in my name, ordered some items (to my house) and had them redirected at the last minute.

I phoned them, and they've set me up on some fraud database. But how did they allow this to happen? They're like great, thanks, bye, washed their hands of it.

I am wondering if I should open a complaint. It should not be possible to open a credit account in my name, their checks are obviously not sufficient and they should not allow the delivery company to redirect orders either (or especially not the first order), I've certainly bought items in the past where the delivery company demands a signature and gives no option to change the delivery address.

As a company director my name, dob and address are publicly available on companies house. It's unclear what else they would need.

Should I be raising holy hell over this? I feel like they are just shrugging it off but now I'm going to have to dig around trying to get a credit report and try to get to the bottom of what's going on, and I've been registered on some system that will presumably make getting further normal credit more difficult, all because this company didn't check properly.

I'm very cross!!! Any advice welcome.

The first thing to check is that you haven't unwittingly walked into a scam.  Are you sure the letter was genuine and the number you called was an official one?  And what is "some fraud database"? Have you done any checks on any of this?

On the basis of what you've said here, it's possible that none of the impersonation and account stuff happened and that it's the letter and phone call that are the means to capture your information.

Ectophile

Somebody attempted to defraud Very.  And you want Very to pay you compensation for it?

Plus, you're complaining that it's too easy for fraudsters to open credit in your name, and also complaining because it's now going to be more difficult to obtain credit.  Which do you want?

born_again

So they checked the opening of a account & realised it was fraudulent. Sounds like they have done all the checks that are required in this instance.
They have added you to the CIFAS database at no cost to you. Yes it can make life harder, but far better than debt collectors chasing you for debts you have no idea about.

Checks can only be done after a account has been applied for, they can not preempt  & check before a application.

Sadly ID theft is very common, & these types of retailers are often targets.

NibblyPig

This is not a scam; I verified the number on their website. They have registered me with CIFAS.

I'm not seeking monetary compensation, but rather appropriate corrective action for what seems to be negligence in allowing this to happen.

These issues are not mutually exclusive. If a company allows someone to open a credit account and make purchases by simply claiming to be 'John Major' at '10 Downing Street' and requesting delivery to a different address, then the responsibility lies with the company. While they may use a third-party fraud service, it’s ultimately up to them to determine the level of checks they perform. Consequently, companies that already conduct thorough checks are likely to adopt even stricter measures, which Very could and should have implemented from the start.

I don't believe it’s acceptable for a company to fail in this way without facing any consequences. It’s frustrating that their insufficient measures leave me to deal with the aftermath. Imagine if this happened in other industries—such as ordering a car, only to find out someone else drove it away two weeks ago, simply by claiming to be you. You’d be understandably upset that they didn’t check properly. Instead of defending the company, it’s important to recognise that they failed to perform adequate checks before allowing someone to incur debt in another person's name.

That's why I wanted to open a complaint, to ensure that the regulatory body is aware that they're letting this happen.

Phoenix72

NibblyPig said:

This is not a scam; I verified the number on their website. They have registered me with CIFAS.

I'm not seeking monetary compensation, but rather appropriate corrective action for what seems to be negligence in allowing this to happen.

These issues are not mutually exclusive. If a company allows someone to open a credit account and make purchases by simply claiming to be 'John Major' at '10 Downing Street' and requesting delivery to a different address, then the responsibility lies with the company. While they may use a third-party fraud service, it’s ultimately up to them to determine the level of checks they perform. Consequently, companies that already conduct thorough checks are likely to adopt even stricter measures, which Very could and should have implemented from the start.

I don't believe it’s acceptable for a company to fail in this way without facing any consequences. It’s frustrating that their insufficient measures leave me to deal with the aftermath. Imagine if this happened in other industries—such as ordering a car, only to find out someone else drove it away two weeks ago, simply by claiming to be you. You’d be understandably upset that they didn’t check properly. Instead of defending the company, it’s important to recognise that they failed to perform adequate checks before allowing someone to incur debt in another person's name.

That's why I wanted to open a complaint, to ensure that the regulatory body is aware that they're letting this happen.

So what checks could they have done to show it wasn't you if the impersonator had all your details correct at the time of application?

born_again

NibblyPig said:

This is not a scam; I verified the number on their website. They have registered me with CIFAS.

I'm not seeking monetary compensation, but rather appropriate corrective action for what seems to be negligence in allowing this to happen.

These issues are not mutually exclusive. If a company allows someone to open a credit account and make purchases by simply claiming to be 'John Major' at '10 Downing Street' and requesting delivery to a different address, then the responsibility lies with the company. While they may use a third-party fraud service, it’s ultimately up to them to determine the level of checks they perform. Consequently, companies that already conduct thorough checks are likely to adopt even stricter measures, which Very could and should have implemented from the start.

I don't believe it’s acceptable for a company to fail in this way without facing any consequences. It’s frustrating that their insufficient measures leave me to deal with the aftermath. Imagine if this happened in other industries—such as ordering a car, only to find out someone else drove it away two weeks ago, simply by claiming to be you. You’d be understandably upset that they didn’t check properly. Instead of defending the company, it’s important to recognise that they failed to perform adequate checks before allowing someone to incur debt in another person's name.

That's why I wanted to open a complaint, to ensure that the regulatory body is aware that they're letting this happen.

This is exactly why Very have done what they have. As a credit provider they follow the FCA regulations. 

You made no mention of any purchases. 
Like banks, electronic checks are made via CRA's & other sources & if OK a account will be opened. That is then followed up by physical checks, which often pick up cases such as yours.

All credit providers do all they can to stop this from happening. It is in their interest. But so many people post on social media etc stuff that makes life so easy for these people to pick up details...

Who's ever posted 40 today or had a friend wish you happy XX birthday. Easy to get DOB from that then onto genealogy sites to find other details.

NibblyPig

> So what checks could they have done to show it wasn't you if the impersonator had all your details correct at the time of application?

Good question. What are they going to do now that I'm on the fraud database? I'm worried that being flagged as a fraud risk is going to make life harder.

What they could have done was require a copy of my ID, e.g. driving license, which they verify with the DVLA. They could also have prevented the shipping company from being permitted to redirect post until after the first delivery was made. 

You have to ask, why is this the only company to which I have been defrauded? The answer must be that they're not being rigorous enough with their checks or processes.

> This is exactly why Very have done what they have. As a credit provider they follow the FCA regulations. 

That's fine then, if this has been reported to the FCA that's all I really wanted. Although I don't know if they just said 'shrug, it happens' and the FCA is like 'well ok what a tragic tale of events' when really Very have not really put any effort into making sure I don't get defrauded. From what I can see they have no obligation to report it to the FCA provided they follow their own internal processes.

According to the very person, someone ordered £200 of goods to my house, and then just before delivery got the shipping company to redirect it elsewhere.

I haven't posted any details online that could have allowed this. When I go to very to register an account I can see that it just appears to ask for name, address, and DOB, which is the same details they asked for when I phoned them. All of these details are publicly available on the companies house director search. There's no way they could get my personal ID documents though like passport or driving license, but it doesn't look like they care about these.

Hoenir

NibblyPig said:

Good question. What are they going to do now that I'm on the fraud database? I'm worried that being flagged as a fraud risk is going to make life harder.

So you'd prefer not to be on the register, be protected, mean while the fraudster makes other attempts to use your personal information for thie benefit? The fact they detected something suggests that their systems are robust and working well. . 

NibblyPig

As I mentioned above, I don't feel that I am protected. Very should have done further checks. I feel the fraud register should be if there was a massive data breach and my NI number and other private information was leaked which would necessitate additional protection. Not to make up for the company playing fast and loose with the protection.

Now I have concerns that other lenders will see me as a fraud risk and it will impact my lending, because Very have not done an adequate job of verifying my identity.

May I ask why you are so aggressively defending a company that has permitted me to be defrauded?

Okell

NibblyPig said:

... What they could have done was require a copy of my ID, e.g. driving license, which they verify with the DVLA... 

How would the DVLA verify your identity?  Wouldn't that be a breach of GDPR?

(I know private parking companies can get identity info from DVLA, but my understanding is that this is a statutory exception - is it POFA?)