Has someone setup a fraudulent direct debit on your account?
LINKS MARKED * ARE AFFILIATE LINKS.
Although in recent weeks my Monday blog has often been filled by one of my other writers or with a guest post, this week I wanted to share something that I heard on the news over the weekend because I feel as many people as possible need to be warned about a scam that has been hitting the bank accounts of several individuals.
What is the scam?
The scam basically involves people very easily being able to setup up a direct debit on your account to pay for goods or services that they have purchased or subscribed to and here’s the kicker, they can even do it using their own name and address.
How?
When someone sets up a direct debit – which I’m sure you’ve done many times yourself – you are asked to hand over certain personal details which usually include the following:
- Your name
- Your bank account number
- Your sort code
- The address of your bank (Easily accessible online)
Firstly you’ll notice one very important piece of information missing from this list the makes the direct debit scheme so vulnerable to fraud, your address. Let’s imagine that a fraudster walks into a store to purchase a mobile phone on contract. They pay for the mobile phone in cash but they are then asked to setup a direct debit to cover the monthly contract payments. They fill out the direct debit mandate but instead of using their own account details they use yours instead, remember they have paid in cash for the phone so may not have had to show any further proof of identification. When the bank receives these details electronically, they appear to be correct and so the bank treats them as a legitimate request and automatically sets up a direct debit on your account to pay for the fraudsters contract.
It gets worse
If you’re feeling outraged by how easy it is for someone to setup a direct debit on your account using your name, how might you feel to discover that they are even able to do it using their own name? Well that’s exactly what is happening today due to the widespread use of electronic direct debit mandates.
Back in the good old days of human banking, when a bank clerk received a request to authorise a payment from the account, they would very easily have been able to verify that the identification details being presented on the mandate actually matched the details on the account. Now that most direct debits are set up automatically though, it transpires that BACS (The people who run the Direct Debit System) actually have no way of checking whether the name that is used to setup a direct debit matches the name of the bank account holder. So what are we saying here?
We are effectively saying that a fraudster can very easily setup a direct debit to come out of your account to pay for goods or services that they have bought or subscribed to and they can do so using their own name and their own address. All they need is your bank account number and sort code which very handily sits on the front of many debit cards.
Check your statements regularly
For the time being there is absolutely no system in place to prevent this kind of fraud from taking place and it doesn’t seem that there will be one implemented any time soon. So what can you do to protect yourself from this kind of direct debit fraud?
The only thing you can realistically do to protect yourself is to check your statement every month – or if you bank online as frequently as possible – to try and catch any unauthorised direct debits and then cancel them as soon as possible. You may think that you have things pretty much covered but most of us have so many small amounts regularly leaving our accounts these days that it is easy to become complacent. Remember though that it’s small amounts that are usually targeted by fraudsters to take your money because they are so easily missed.
Have you been a victim of direct debit fraud or do you know someone who has?
I’ve never heard of this. It’s crazy how easy it direct debit can be set up. I always make it a point to look over my statements. I never trust that it is right and question many things. I live by the motto that no one cares about my money as much as me.
Wow, Adam, I was not aware of this! I’m usually pretty good about keeping an eye on the bank accounts, but I’ll be extra careful now. Thanks for sharing this!
I’m ashamed to say I wasn’t either Laurie because I’m usually on the ball with this sort of thing. I’ll be a lot more careful who I hand my details over to in future.
We have a club account and have had this problem several times this year. In all cases, the fraudulent “recipient” was an insurance company name. The bank (who shall be nameless) seem to be unable to stop it and their only suggestion was to change the account number. Instead, I shall transfer the account to another bank.
I have been the victim of two fraudulent Direct Debits the two companies involved & my bank are currently investigating the fraud & further direct debits have been cancelled. Should I cancel my debit card now or wait until the investigations have been completed.
Very worried that further attempts will be made on my account.
I left TalkTalk after the hack in 2015 and cancelled my direct debit and went over to Sky. On 18/05/17 there was an attempt to take £25.22 by TalkTalkLimited via direct debit from my account. I called my bank and this was refunded to me and I cancelled my direct debit. Since then a direct debit from TalkTalkLimited has shown up on my account on 19/06/17 and 11/08/17. I was able to cancel the direct debit before any money was taken as I check my direct debits every day since the first attempt was made. I have contacted TalkTalk by phone and customer relations by mail. They don’t even acknowledge that there is an issue!
My elderly Mother had her oven cleaned by a company who claimed to be a national oven cleaning brand and she paid by cheque after the work (poorly done) was done. She was given a receipt but this had no company heading on it. It later transpired that a Direct Debit appeared on Mother’s statement in respect of a breakdown insurance policy on the oven. This was for £30.00 a month. Given that Mother has a counter top oven with two boiling rings which cost £65.00 years ago, apart from the fraud aspect, protecting the oven is ludicrous! Called the bank who gave me the full details of the applicant from the mandate. Cancelled the Direct Debit and called the company for an explanation. They said my mother had set up the arrangement but they would call me back. They never called back. Watch your statements carefully! Always use reputable companies and never agree to having work done from cold calls. Get companies who contact you prospecting to send their details to you by post.
Hello
This has happened to me and I am ashamed to say I failed to notice until a year had passed! I will be checking DD mandates on a weekly basis from now on. I am shocked that it is so easy.
I just discovered that I had a DD set up electronically on my account in oct 17 that stated PayPal (has nothing to do with PayPal) and have only just noticed it. Many debits mirrored my legit transactions and embarrassed to say I have lost £6180 ? until now I never took much notice! Believe me that has now changed. When I googled the name attached to this DD…… wow I came across a deluge of messages from people on different sites, staying same had happened to them. The name my bank gave me that is attached to theses direct debit is MAUREEN WHITTMARSH JPMC BANK! A scam indeed! My bank would not do anything about is and nor would other peoples banks who have gone through the same as me. Apparently the banks state we authorised DD as 01p went through our account at start of DD and as we didn’t query the 01p we accepted it. ?
Thanks for sharing Vanessa, hope this helps some people!
Hi Vanessa, I am going through this right now. I have never authorised this direct debit though so I am praying that I will get my money back. I have never authorised this payment so I hope that under the direct debit guarantee this will get me my funds back.
This has been on-going on my Santander 123 account for probably three years. All have been car insurance frauds. Sometimes I get speeding tickets, since the police check the insurance register not the list of registered keepers. Once I got three, and was able to track the joy rider as he passed through several counties in the middle of the night! Police, insurance companies, and banks are all aware of how easy it is. Most banks and insurance companies tell me that they simply write off the losses on a routine basis and make no attempt to investigate. Same applies to the Action Fraud hotline. No action is taken because the sums are always less than £50, usually less than £30. To change the account number by closing one account and opening another is going to open up another can of worms so I live with the situation, and hope that one of the many possible solutions will soon become mandatory. Like having a direct debit password that is part of the information you give when setting up a direct debit. Can be encrypted/decrypted so that even the insurance company and bank do not know what it is.
A password sounds an excellent idea-or even checking that the direct debit name is the same as the account name in the bank records. Surely they could design an algorithm for that.
This has happened four times recently. I have reported the fraud to the bank but they say the only thing I can do is close the account (with all the inconvenience of transferring debits etc. The bank has refunded the amounts but I have had to sit an hour at a time in the bank while the helpful counter assistant rings one department after another at Head Office trying to find out what to do. Centralisation by the bank and the withdrawal of any autonomy from branches is also in large part responsible for this travesty. It could even be funding terrorism. This requires legislation, leaving it to customers is passing the buck big time.
Other things that could be done would be: to confirm by letter that the targeted individual really did set up the direct debit; to use some kind of OTP verification; for the banks to automatically send an SMS or email alert to the account holder whenever a direct debit is set up (that should be mandatory); and to always wait for, say, four days, before a first payment is taken, to give a targeted person time to discover and cancel a fraudulent direct debit.
Thought you might be interested in an insider’s view on this. I was working as a programmer for a a major UK bank when the ADDACS system was implemented, which was the point at which it was no longer the duty of the bank to keep copies of signed direct debit agreements and generate payments according to the agreement. With the new system, BACS had a list of authorised direct debit merchants who could sendd a request at any time to set up a direct debit or take a payment – even if the customer had requested that the bank cancel the agreement, the payment request would cause the direct debit to be reinstated – only the merchant could actually cancel the agreement. Obviously this may have changed since I left the job, but the ADDACS specification was very clear that this was how the system was intended to work. Some of the more senior analysts were gravely concerned about the potential for fraud, but their concerns were overruled by upper management, who were terrified of the consequences if the bank was no longer able to process direct debits. As you said, there are no checks in place to verify that requests are legitimate – if a merchant registered with BACS requests a direct debit payment with just the customer’s account number and sort code it goes through based purely on trust.
It’s absurd that if we miss one payment on a direct debit, it gets cancelled (though as far as we the customer are concerned, our mandate to the bank still stands), while with the ADDACS system they can’t cancel it if we ask them to. See Kathleen Daly’s post, above.
Just noticed a new Direct Debit to “Debit Finance” with no further details other than a reference number.
I will print a copy, cancel it and inform the bank.
Glad to know I’m not the only one, but hope more people be see this post + become aware of this scam so they don’t get stung.
There should be stricter regulations on direct debit forms online or completed in shops, so banks reject them if they don’t give evidence of i.d.
I want to tell people that it’s not only random lone amateur fraudsters that exploit the Direct Debit system to steal large amounts of money from vulnerable, unsuspecting people. It is also minor and even major companies such as telecoms companies, such as THREE and solicitors’ firms.
In my case, I have recently discovered that THREE, who I have been with for around 9 years on and off, are crooks and fraudsters, who have set up an automated scam that has enabled them to steal 5 years of £7 monthly payments from my account via Direct Debit without my knowledge AFTER I HAD CANCELLED MY CONTRACT, WHICH HAD ENDED! I know it’s a deliberate scam because they have refused to pay me back. They had the gall to tell me there was “nothing they can do” and didn’t even tell me I could claim the money back from my banks via Direct Debit Indemnity.
4 years Direct Debits payments were given to them via Santander. The rest via Nationwide after I switched my current account. DO NOT TRUST SANTANDER WITH YOUR DIRECT DEBITS. THEY HAVE REFUSED TO HONOUR THE DIRECT DEBIT GUARANTEE. They and other banks give flimsy, dishonest excuses not to refund you, (like insurance companies do) even though if they did they can recover the money from THREE. They have been appalling, but Nationwide quickly and honourably refunded me like they are supposed to. Santander actually had the gall to tell me to go to court or to Citizens Advice Bureau.
I may have to go to the Financial Ombudsman but I think all or most of these Ombudsman organisations (like the Legal Ombudsman) are corrupt and crooks. I am half way through another 2 year contract with Three, so I have cancelled my Direct Debit for that and told them if they don’t return my money I am finished with them. Even if they returned all my money I wouldn’t want to continue doing business with a company that has stolen my money over 5 years. During those years they never sent me a single bill or informed me they hadn’t cancelled my contract. To date I have only received £56 out of £420 and that was solely via Nationwide. THREE has only offered a token refund of £75.
Be careful with DDs because companies like Three are using them to steal from vulnerable customers. Anytime you cancel a contract, don’t wait for the company to cancel DDs, do it yourself through your bank or via the app.
You are so right, I was a programmer for Abbey National shortly before Santander bought them, I was part of the team that implemented the new direct debit rules. All the developers on the team had grave concerns about the potential for fraud by merchants. The whole system runs on the assumption that any organisation registered as a direct debit merchant is absolutely trustworthy. Clearly this is a false assumption. The only punishment for a merchant which commits fraud is to be taken off the list of direct debit merchants, a sanction which is only used very rarely in cases of massive fraud. Some merchants, such as the student loan company, retained their merchant status despite massive amounts of fraudulent activity. The whole system needs to be redesigned to put control back in the hands of the customer/account holder, and prevent merchants from taking any arbitrary amount they feel like from anyone with an active direct debit. There is no security whatsoever built into the system to prevent abuse by fraudulent customers or merchants
What happens If you know the person that set up direct debit ,and do not want
to report it as crime .I have cancelled direct debit ,but now they are chasing
the debt K.