PDA

View Full Version : Serious security risk?


TwistedPsycho
04-08-2006, 11:44 PM
Evening all,

I have spent a little time talking to Vodafone, after one of their "customer service" agents decided to block my account because I refused to read out the sort code and account number I use for my Direct Debit over a mobile phone in a very public place.

Now I would have thought that the security of something like a clients bank details is high on everyones list, but the agent assured me that its a standard procedure to use it as a security clearance. I know that Vodafone (obviously) outsources work, and 99.9% of its staff and contractors are genuinely honest, but surely there is sufficient reason not to have that sort of information available to anyone who does not directly need it?


Below is the very nice e-mail I sent after giving up on the phone.

Good Morning,

It is with great regret that I have to make a complaint regarding one of your call centre agents, in relation to a phone call I made to 191 at 10:51am on 02 August 2006.

I contacted 191 in order to change my bundled messeges yesterday morning and the call followed its usual routine of giving my details, and confirming my identity. After giving my address, postcode and method of payment as usual, your call centre agent asked me for my PIN number. I replied to the agent that I have never been asked to set up a PIN, although I did use to have a password many years ago, which I later had removed. Her reply was that a 4 digit PIN had been set up because someone had reported opening up my mail to the customer service centre, which I know is untrue, because I reported that suspicion many years ago and had my original password set up for that reason PIN numbers were not an option back then. At the same time she asked for my home telephone number, which apparently did not match and said that the only way for me to verify the account was to read out my bank details for the direct debit over the phone to her.

I am sure that as you are aware, reading my bank details over a mobile phone in a public place is kinda dangerous, and to be honest, I would refuse to read my details over a cordless or mobile phone to ANYONE, let alone a customer service agent from a company that I have NEVER had to do that before with (in the 82 months I have been a contract customer). When I refused this, as any logical person would do, she informed me that she would have to suspend my account, and block my phone until I went to a Vodafone store with two forms of ID, and REFUSED to pass my call to any supervisor or manager which would "escalate the situation".

This brings me to a second point. This conversation would mean that any service representative would be able to see my bank details if I called you? Is this not kinda dangerous? With news reports of staff selling on bank details to illegitimate sources, surely you should not be presenting this information for every person in the company to see and do what they like with! With such a high number of staff that Vodafone must employ either directly or through outsourcing, I am sure it is easy for you to understand my concerns that not even the best of security will stop information being passed where it shouldn't. With all due respect, if this is the way that you want to verify my details over the phone, then you can remove my direct debit details forthwith, and I will manually make payments on a monthly basis.

As it was, I had to make a 30 mile round trip to get my phone unblocked, a PIN set (By the way, your Portsmouth Store said that no PIN had EVER been set), and the telephone number updated.

This unfortunate farce of both securing the most important of my details, and the fact that by my refusal to ignore basic bank account security recommendations, led to the loss of my mobile phone means that I will not be renewing my contract, and will be leaving Vodafone at the first available opportunity. Had one of your other customer service agents not convinced me to extend my contract by 6 months, I would already be cancelling my contract.

SHOULD a senior member of the customer service team want to contact me, I am always available on my Vodafone, 24/7 and you can call to talk me out of it. If I do not get contact in 24 hours, then I will assume you do not want my business and take matters into my own hands. Be assured that I have already taken this matter up with my bank, HSBC, regarding Vodafone's obvious lack of basic security with their customers details, and I am sure that they will also be discussing this with you in due course.

Yours in faith

HiT Ur Azzz
05-08-2006, 08:26 PM
hi there u seem like a mature man.., But sorry to say u act like 9 yrs lil boy who robbed from some guy on NewYork Streets. comon they r doing there job to secure people accounts. either take it or leave it. dont Shout:(

pav
05-08-2006, 08:35 PM
When I contacted c/s some time ago and I had not set up my pin code and security details. One of the first things they asked me was I in a puplic place, and if I was in a public place could I call back later.

TwistedPsycho
06-08-2006, 03:06 AM
hi there u seem like a mature man.., But sorry to say u act like 9 yrs lil boy who robbed from some guy on NewYork Streets. comon they r doing there job to secure people accounts. either take it or leave it. dont Shout:(

Hi there.

Sure, I can understand all the security and stuff, but there are two very concerning points involved:

a> Mobile phones are not 100% secure. On two or three occasions in the last twelve months, I have connected to let th phone dial a call, and been listening to other peoples conversations.

b> If a rogue operator was able to get your bank details by typing in your mobile number, that a serious data protection issue.

I may sound like a 9 year old throwing my dummy out of a pram, but I also value the security of my bank account. Knowing that anyone at the c/s centre can just type in my mobile number and get my bank details to "verify me" is worrying... what could they do even if the user was not there.

Phantom
06-08-2006, 03:28 AM
Anybody who accesses your account is logged. We need to see your bank details to do our jobs. Just like your bank knows your bank details, have you made a complain to your bank because they wuld be able to see you bank account?

So... What's your mobile numner? :D

TwistedPsycho
06-08-2006, 10:04 AM
Anybody who accesses your account is logged. We need to see your bank details to do our jobs. Just like your bank knows your bank details, have you made a complain to your bank because they wuld be able to see you bank account?

I can appreciate that everyone who accesses my account is logged, but with all due respect, I can not see why someone who I want to talk to about.... for example, helping me deal with a physical handset fault, would ask the same question ( as they did less than 24 hours later )

When I am seconded to an internal position where I work, I am dealing with staff calling into an office on a regular basis, but I don't have to verify them by asking them what account number they have their wages paid into each month!

So... What's your mobile numner? :D

Yeah its 09065......

solo12002
06-08-2006, 10:52 AM
" But sorry to say u act like 9 yrs lil boy who robbed from some guy on NewYork Streets. comon they r doing there job to secure people accounts. either take it or leave it. dont Shout"

The points he raised were very good points. One would of thought by confirming mobile number, address date of birth etc there was no need to ask for bank details. I for one would also of refused on security grounds.

DarthDarko
06-08-2006, 09:02 PM
I thought they set "pin" numbers up these days to stop just that very thing?

chaos77
07-08-2006, 09:21 AM
hi there u seem like a mature man.., But sorry to say u act like 9 yrs lil boy who robbed from some guy on NewYork Streets. comon they r doing there job to secure people accounts. either take it or leave it. dont Shout:()

I find your comment racist!

biohead12
07-08-2006, 11:15 AM
The points raised are valid ones, so it isn't a silly thread.

Personally, if I needed to do anything like that I would always go to a store rather than other the phone. However, thats easy for me as I live next to a train station on the East Coast line, so it doesn't hastle me.
For someone like yourself though it is a decent trek and yes, it is worrying. I think however this is due to Vodafone not teaching there staff properly - it looks like a call agent error than a vodafone security policy error.

Perhaps it was just a one-off? Who knows - and will it happen again?

TwistedPsycho
07-08-2006, 11:24 AM
Hi biohead,

Thanks for your comments, now I know I was not going mad. It has hapened twice in two days with two different agents... the second after I had set up this new PIN system.

Who knows. Maybe they will think about their actions.