Ecotricity refused to set up an account without my date of birth — is this allowed?

WiserMiser

https://forums.moneysavingexpert.com/discussion/comment/81949045#Comment_81949045

There are all sorts of personal things and memories that can be used, the older and more obscure the better because they're unlikely to exist online. If they were part of your upbringing the chances are that you won't forget them. You can keep a hard copy of the organisation names along with the clues.

Who lived next door to Auntie Mabel? What was the number plate of your first car? At which airport did your first flight land? What was the nickname of the geography teacher? Who was hit on the head by a cricket ball? Which acquaintance did you bump into when you were far from home, and where?

Two golden rules of passwords are that they shouldn't be shared and must be changeable. DoB fails spectacularly on both counts.

QrizB

You say “that’s a credit account”. No, legally, it’s not.

All domestic energy accounts which aren't PAYG (prepayment) are credit accounts.

If it were, the invoices I give clients would also be extending them credit

If you're invoicing after delivering the goods or services, those are credit terms. You run the risk that your client won't pay you.

flaneurs_lobster

https://forums.moneysavingexpert.com/discussion/comment/81949150#Comment_81949150

It is a credit agreement if you extend terms like "pay within x days of invoice date" (rather than exchanging goods /service for payment at the point of supply). Or a utility company supplies you with gas and you pay them for what you've used later (rather than using a prepayment meter).

Because you are not offering finance (as in "I'll lend you the money to buy the thing then you pay me back") you are not a "lender" and do not need to be authorised by the FCA.

OutragedofHX

https://forums.moneysavingexpert.com/discussion/comment/81949168#Comment_81949168

Again, no, though it seems ‘in practice’ they are made to be, largely through the Terms and Conditions imposed. Post-paid billing (typical of sole traders and utility companies) is not the same as “credit” in the legal/regulatory sense but, on its own, it doesn’t actually constitute a credit-agreement legally. For an individual who pays immediately upon invoicing (at which time only the payment is due), especially by direct debit, there is actually no credit lent; some utility-companies require this and yet still claim to be lending credit. Further, there is no credit because if you don’t pay, you are in arrears and there are often no terms provided for accruing interest, etc., which would bring into the perimeter of true consumer-credit. For this reason, the Financial Conduct Authority specifies post-paid accounts with utility-companies as a 'borderline’ product in terms of lending credit. It would be a great help if you could point to why you believe differently in reference to, say, the Consumer Credit Act.

I think the answer to my actual question is that credit-reference agencies aren’t just about credit but identity-verification. In the UK, this has been outsourced to private companies, possibly because there was a lot of resistance to government IDs.

MWT

https://forums.moneysavingexpert.com/discussion/comment/81949150#Comment_81949150

These are standard terms that you will find in pretty much every energy suppliers contract, and you agree to them when you first use energy supplied by them: (from Octopus)

• "We agree that we will use any personal data that you provide to us in accordance with our Privacy Policy, which is available on our website at octopus.energy/policies/privacy-policy/. We may run checks on you (and anyone else also responsible for payment) at Credit Reference and Fraud Prevention agencies, initially and periodically to help us assess your ability to pay for your Energy bills. When we run this check, the credit reference agency will record the fact that a check was made (even in the event that you do not become an Octopus Energy customer).

• If you have an account with us, we will routinely share information about your payment record with credit reference agencies. If we consider that your account is in default (i.e. you have not paid us and are in breach of your Contract) we will notify you and if you do not pay us, we will report the unpaid debt to credit reference agencies who will record that default on your credit file."

born_again

https://forums.moneysavingexpert.com/discussion/comment/81948878#Comment_81948878

I'm lost as to how a birthday card or bit of birthday cake can compromise your details?

EssexHebridean

Are you saying that you pay on receipt of bill? If so, that is something you may wish to revisit allowing it is already going to be costing you substantially more than a well managed DD!

WiserMiser

@born_again

If someone sends you a birthday card they must know your day and month of birthday, and perhaps the year as well. If not, it's often guessable by how old you look, when you started uni, your first job, etc.

In many offices it's the tradition to buy treats on your birthday for everyone to share, so if someone says "Have a cupcake and a Jammie Dodger, it's Fred Bloggs' birthday" then the info that supposedly known by Fred Bloggs and absolutely no-one else in the world has been compromised.

Get the DoB right and a fraudster is halfway there. Much the same for the Maiden Name, that's often widely known or can be found. "Mr Frederick Bloggs married Miss Mavis Smith at St. Peter's Church Neasden...".

Those two pieces of info act like master keys into the victim's accounts. No responsible organisation should allow their use as passwords.

Ildhund

@WiserMiser Do you also lie about your age to HMRC? The DWP? Your doctor, or the wider NHS? Your bank? How do they know you are who you say you are when you contact them? Or don't you regard them as 'responsible organizations?

Swipe

Anyone who was a Coop member offered their DOB and other personal details to a hacking group last year.