Barclaycard and fraud

[Paul]

Yesterday I had cause to query 3 charges on my Barclaycard. In short, when trying to buy a ticket on the CalMac ferry app, the transaction failed 3 times so I bought on board. Seems however that the app purchases all went through.
So 4 charges for a single trip, no biggie it happens and a couple of clicks, a paragraph of explanation and all solved……. Except this is Barclaycard.

The disputed transaction showed as red, all good and I get on with my day. My wife calls, card repeatedly declined, mine similarly declined. I called but customer service only works 8-5 Monday to Friday so went through to Fraud dep. seems that when disputing the charge it was recorded as fraud so Barclaycard blocked all the cards!

Utterly stupid , frustrating that there was no email, no contact from them, they simply put new cards in the post. It was entirely possible that the first we’d have known about this would have been when new cards arrived. Equally not knowing they were coming could easily have led to larger fraud had we never received them.

Quite bizarre system!

[SamG]

Did CalMac refuse to refund you?

But otherwise sounds about right for Barclaycard , their IT seems absolutely useless !

[Anna]

I’ve never been notified by a cc company when they’ve frozen a card, it’s beyond frustrating! Amex used to be pretty bad but have improved with the introduction of extra security checks. No rhyme or reason with the Virgin MC, though. They don’t quibble £5k payments of school fees, but viewed my OH trying to pay his car insurance as suspicious and blocked both our cards. It took 3 very long calls to Virgin CS to get both unblocked 😡

[RV]

Barclaycard is definitely the worst for Fraud. Horror story from today:

I was expecting a new card from Barclaycard (I downgraded from the Avios Plus card to the free one).

The card was taking too long to arrive. I contacted Barclaycard this morning and they said they didn’t have tracking for cards (!!!!!), but that it was still within the time frame so no action needed.

Later today I spotted two cash withdrawals from the credit card (that I didn’t receive!). Called them and had the card cancelled, fraud reported etc.

Around 1h later I got an email saying “Welcome to your Barclays app”, and an SMS saying my device was removed from the Barclays online banking. So it seems like the fraudsters accessed the app and kicked me out. I called again to find out that the fraudsters managed to access my current account and withdraw £2k from a Barclays branch! Again, fraud reported, debit card blocked and all money transferred to another bank account until this is resolved.

This evening I called again to go in more detail with the fraud team about how on earth this happened, provide a crime reference number etc… To find out that someone called Barclaycard with my card details and the Barclaycard representative helped that person to login to the app (!!!!!!). I said I wanted the recording from that call but I’m not sure that will be provided unless this goes to court (hopefully not!)

How on earth their security processes are so weak? I am genuinely baffled, even makes me think that it might be some scam involving people internal to Barclays.

Anyway I’m sure it will be sorted and I’ll get the money back, but such an unnecessary hassle!

Btw: if you have a Barclays Premier account, make sure you go to your debit card setting and set a withdrawal limit! It comes with a standard £2K limit, which I never really bothered to change. Can save you same hassle in the future!

[MF176]

Sorry to hear that @RV, sounds a real nightmare. Hope the money is back with you soon, along with a suitable explanation and apology from Barclays!

[John]

RV wrote:

The card was taking too long to arrive. I contacted Barclaycard this morning and they said they didn’t have tracking for cards (!!!!!)

I have cards with 25 financial institutions in 4 countries and the only one which has ever sent a card by a tracked method is Tesco Bank, but my most recent card from them was also sent by ordinary post. I recall earlier Tesco credit cards arriving by Special Delivery with the tracking labels you get from the post office, which would indicate that they were manually stuck on… they paid more to send me the card (at least £5) than the total I spent on it card in the 3-4 years of its validity. I should probably just cancel them but I have a grudge against Tesco and want them to lose money

[CarpalTravel]

@RV – What a total nightmare, that is beyond incompetent, it feels wilfully negligent to me.

From what you have said, it sounds like they have assisted the fraudster with getting access to your account via the app. I have just looked at mine and that readily reveals sensitive information in the profile section: Name, DOB, address, income, profession, email, phone numbers. Worth bearing in mind that thanks to Barclays, this is now out in the wild.

Make sure you keep a log of each and every interaction you have Barclays, including date and time, and I would lodge a formal complaint. Besides refunding you your money and compensating you for the risk they have now put you at, I would also expect them to do all they can to protect you as a result of the data they have helped share. https://www.cifas.org.uk/pr registration would be a good start. If you haven’t already seen: https://ico.org.uk/for-the-public/identity-theft/ is worth a read through too.I would also keep the police updated too, as this does not seem the work of an opportunist, rather a professional group.

It is now important to be very vigilant and if it were me, I would be changing as much as I can: email address and all associated websites/passwords it is linked to, phone numbers etc.. Also, be sure to setup 2FA wherever possible.

Nightmare, so sorry for you.

[NorthernLass]

Not much seems to have changed since the initial debacle when all the cards arrived with the envelopes ripped open and the card details visible to all!

[CarpalTravel]

I still have mine! Not quite sure why, guess I’m either a hoarder, or treat it as a useful reminder of other people’s capacity for incompetence.

It’s not like it’s an integral part of their core business or anything….

[RV]

CarpalTravel wrote:

@RV – What a total nightmare, that is beyond incompetent, it feels wilfully negligent to me.

Make sure you keep a log of each and every interaction you have Barclays, including date and time, and I would lodge a formal complaint. Besides refunding you your money and compensating you for the risk they have now put you at, I would also expect them to do all they can to protect you as a result of the data they have helped share. https://www.cifas.org.uk/pr registration would be a good start. If you haven’t already seen: https://ico.org.uk/for-the-public/identity-theft/ is worth a read through too.I would also keep the police updated too, as this does not seem the work of an opportunist, rather a professional group.

Thank you very much, very helpful information. I logged an action fraud report yesterday, but I wasn’t even thinking about the volume of data available on the mobile app until I read your comment.

I wasn’t thinking about a complaint either, but now will definitely be putting one through given my details were exposed.

Yesterday I already changed my email passwords. I already have 2FA in both my emails and they don’t seem to be compromised as I didn’t have any alerts.

After this incident I realised how relaxed Barclaycard are about data security. You can pretty much do anything in the app once you login, without 2FA or any other ID confirmation.

Also, having called both Barclaycard and Barclays fraud teams yesterday, it was visible that the Credit Card representatives are much less professional and seem clearly unprepared vs the Account team. I had to answer some 8 security questions to access the Account team without validation (as I was kicked out of the app), and for Barclaycard all it took was the card number, my full name and the additional cardholder name… all of which were readily available in the letter that was intercepted – as they send both cards together!!

There’s so much new technology today to deal with this: voice recognition, one time passcodes, Apple passcodes… it’s insane that the largest UK bank has none of it!!

[RV]

Update on this:

One week in and Barclays/Barclaycard have now completed their initial investigation and refunded me all the money stolen from the accounts and spent on the credit card.

On the call just now they also confirmed that someone called Barclaycard impersonating me, and provided the long card number and some “basic details” (prob Name, DOB and Postcode), and the Barclaycard representative assisted that person to gain access to the App.
-> First massive process flaw here, as access to the app needs to go via 2FA with a telephone code, unless they found a way of bypassing that, or if Barclaycard has different rules;
-> When I asked how they managed to withdraw funds from a Barclays ATM if the fraudsters only had access to the credit card, they mentioned that the Credit Card can be used to withdraw funds from the account as well (that’s new info to me!);

The overall thing was a sh*t show with loads of process flaws, mainly from Barclaycard:
– I had to point out to them in three different calls that the old card (Premium plus-downgraded) was still working even 9 days after it should have been cancelled;
– The delivery of the replacement card was also problematic. It was supposed to be signed for, but it was handled to my neighbour instead (and I was at home at the time the delivery was “attempted”!!);
– I even had to stop Barclaycard from refunding me twice for the same claim, as they called me to “discuss the case before issuing a refund”… after I was already refunded!!
– The mobile banking passcode was resent to me. It arrived today via post in a Barclays branded envelope, with “Private and Confidential” written on it. Even a 5th Grader would know that you shouldn’t send passwords/account details in branded envelopes!!

As I wrote a letter with a formal complaint last week, they said that an independent team is investigating how these events took place and would report back to me in 5 working days.

I have now registered for CIFAS protection, and I’ve double checked with all Credit/Dark web monitoring apps that my email address/telephones were not compromised. However I do have quite an unusual name of latin origins, so I guess if my full name and DOB was leaked on a list on the dark web it would be very easy to match with the details available on the Barclaycard card letter that was intercepted by the fraudsters.

Overall a quite stressful and eye-opening experience. Please keep your details safe folks!

[Lady London]

What compensation have they offered you, additional to reinstatement of monies fraudulently diverted from your account, for the important thing memtioned by @carpaltravel, that thanks to Barclays’s negligence your personal details and not just your Barclaycard nunber, is now out in the wild due to Barclays disclosure of them (via facilitating app access) to professional criminals?

The effects can take 18 months or even longer to appear.

[RV]

No compensation offered so far. I queried about this on the call with the fraud team today, and their response was that any compensation would be managed by the complaints team.

On my complaint letter I listed all the implications of what their process flaws have led to, and attached the ombudsman’s guidelines for compensation based on what they’ve done. I also added my time lost equivalent to almost to a day rate of work + the CIFAS registration costs for 10 years. Let’s see what they come back with.

If they don’t take the complaint seriously I will definitely be escalating it.

[CarpalTravel]

Good luck @RV and thank you for the detailed updates, it is appreciated. As well as feeding our natural curiosity about how they handle things, it may also be helpful to others in the future. 👍

[Lady London]

RV wrote:

No compensation offered so far. I queried about this on the call with the fraud team today, and their response was that any compensation would be managed by the complaints team.

On my complaint letter I listed all the implications of what their process flaws have led to, and attached the ombudsman’s guidelines for compensation based on what they’ve done. I also added my time lost equivalent to almost to a day rate of work + the CIFAS registration costs for 10 years. Let’s see what they come back with.

If they don’t take the complaint seriously I will definitely be escalating it.

Good. Please report back.