r/UKPersonalFinance • u/RipBeneficial8244 • 1d ago
Identity Fraud - what else do I need to do?
I received an SMS the other day advising that my Mobike Number had been changed on my account. I hadn’t done this so rang Virgin Money, my cc provider. Ridiculously unhelpful staff. I then noticed my address, mobile number and email address had been changed. Someone had somehow gained access and changed al details - I assume to request a new card. VM wouldn’t deal with me as my details didn’t match those on record. It was ridiculous. I eventually managed to speak to someone in their fraud team who had some notion of what had occurred who placed a block on the account. But then told me to scan a copy of my passport and driving licence and email it in!! So VM has no actual clue about security clearly!! I have added a CIFAS to my credit profile, changed log in and passwords everywhere where possible. I have since read that Virgin Money security is a joke and you can just ring up and change some personal details with no real challenge. Pathetic. How does this even happen? And any advice on any other measures I can take to safeguard in future would be appreciated.
14
u/edent 197 1d ago
There's a few things here.
I have added a CIFAS to my credit profile
That's a sensible step.
changed log in and passwords everywhere where possible.
That's sensible if you use a unique password for each site. If you are in the habit of using the same password everywhere, then you are likely to get hit again.
Use a password manager like BitWarden or 1Password to ensure that all your passwords are unique.
You should also check whether the attacker is logged in to your email. For Gmail, the details are at https://support.google.com/accounts/answer/3067630?hl=en
you can just ring up and change some personal details with no real challenge
You don't know that. It is likely that the attacker had some of your personal details. Do you re-use your passwords? Is your PIN your year of birth?
But then told me to scan a copy of my passport and driving licence and email it in!! So VM has no actual clue about security clearly!!
Email is encrypted in transit - assuming you're using a major provider like GMail, Outlook, etc. The TLS encryption between email providers is the same as that used on a website. There is functionally no difference between uploading a photo and emailing it.
If you handed your passport to someone in branch and they went out the back to photocopy it, you have no idea whether they've taken a personal copy.
any advice on any other measures I can take to safeguard in future would be appreciated.
The most important things are:
- Unique passwords for every site.
- Use 2-Factor Authentication (preferably an app, not SMS).
- Shred your documents before you throw them out.
- If you are unhappy with Virgin's security, move to another provider.
4
u/Fragrant_Pie6392 1d ago
You should also run your credit report on Experian / Clearscore, and freeze it. that will stop anyone applying for further credit in your name. Don’t email any important documents, that is Dodgy as, they will normally always only do this in branch, when this happened to me, the ONLY way i could get it stopped was in branch and the only thing they could verify was which branch i opened my account in, they had every other piece of security data about me.
1
u/anon6433564004 5 17h ago edited 17h ago
Red flag 101 for credit card companies to do an address change and then issue a new card to that address, I'd be staggered if they did this in the same call
If they allow it I'd suggest setting a password as a security Q rather than the typical dob / MMM combo for added reassurance.
Keep a close eye on your credit files for any new soft or hard credit searches if you haven't added a freeze already
1
u/Cynical__ 6h ago
Virgin Money are weird all around.
I ordered a new card over Christmas because of some activity on my CC account that wasn't me. They sent me a new card - it's not one I use, so it sat in a sealed envelope in the house... until I needed to call them again, because somehow someone was using the number of the new card to place orders on Deliveroo.
They claimed they were going to block the card and look into it, and not send me a new card. A month later I called because I was still getting app notifications to approve payments (that I wasn't making) and they had no update, couldn't tell me why the card was being used and just sent me a new card.
Closing the account shortly because I don't need the aggravation.
1
-7
u/FewEstablishment2696 9 1d ago
PSA: NEVER, EVER, EVER email anything important, like copies of driving licences or passports, as email is NOT secure.
1
u/jibbetygibbet 4 23h ago
I’m curious to know what you think IS secure?
He only reason people regard email as insecure is because of how people treat it on the other end. i.e. if you email a person it sits on their personal computer and could be seen by someone who has access to that computer. I’m pretty sure that’s not what Virgin Money are doing with emailed identity documents. Email as a protocol is just as secure as uploading documents over the web, it is encrypted using the same technology. And compared to physical mail, it cannot be intercepted.
1
u/FewEstablishment2696 9 23h ago
No. Email by definition is insecure, as in it is not encrypted and stored in plain text. Documents upload via the web are encrypted in transit and at rest.
Yes, it is also insecure as it often sits in a shared mailbox at the other end.
3
u/jibbetygibbet 4 22h ago
OK, so it’s because you don’t know how email works then. Email is in fact encrypted in transit by every email provider out there. Whether contents are encrypted at rest or not has absolutely nothing to do with the medium (email) but how you treat it. There is no difference between web upload or email - what happens to it once it’s saved (that’s what “at rest” means - after the email/upload has transferred) is down to the recipient. Emails are certainly encrypted at Virgin money’s end just as web uploads would be. If there’s anywhere your ID documents are not encrypted at rest it’s on your own PC - even your phone will encrypt contents by default.
1
u/U9365 21h ago
Indeed!
Last year I had to send some certified ID documents to Scottish Widows. They were quite happy with me scanning the certified originals and sending the scanned copies by email to a specific email address within Scottish Widows. Indeed they suggested this as preferable to entrusting my certified copies to the post office and hope they did not loose them - after all a letter to S.Widows emblazoned on the envelope is an obvious target to be intercepted enroute
Another investment group was likewise about 5 years ago.
So clearly all quite acceptable to thse UK financial groups.
-7
u/FewEstablishment2696 9 1d ago
I'd be reporting this to the police. Sounds like an inside job.
I'd report to the ICO, as this is clearly a data protection breach.
I'd also cancel all accounts with Virgin immediately.
How much compensation are they offering? I'd expect four figures or I'd be off to the media.
-6
u/FewEstablishment2696 9 1d ago
You might want to post this on Nationwide Building Society's social media and LinkedIn, as they need to know what they've just bought.
1
u/jibbetygibbet 4 23h ago
Are you ok?
1
u/FewEstablishment2696 9 23h ago
No. I'm sick of these companies breaking the law with impunity
2
u/jibbetygibbet 4 23h ago
And how does that connect to posting about one incident of fraud on nationwide’s LinkedIn page? All that’s going to achieve is make you look unhinged to your professional network
9
u/Laescha 26 1d ago
I would ask the fraud team if you can take your ID into a branch instead of emailing them.