Tesco Bank - CIFAS Placed 2016 - Advice On How To Handle?

[fkofilee]

Hi L33noa - DX asked me to pop by - I will digest your thread in full and advise next steps during the weekend if possible? Unfortunately I work full time so have to balance helping people with helping people in my job ^_^

As for your CIFAS dilemma - Can I ask quickly. Have you access to your own bank account at this time? 

 

CIFAS is complicated and is a very grey area but I will see what I can do to help.

[fkofilee]

When you say Internet Bank? Monzo / Starling?

[fkofilee]

Good Call - They are full fledged bank with full permission to trade and covered by FSCS

Ill be back this weekend to finish off this and create a plan of action.

[fkofilee]

So something for you to digest and respond too... 

 

i have the below as your case notes;  Plus some of my own.

 

Quote

Tesco Bank Complaint 

April 2018 Filed

CIFAS Placed in 2016 (October) (3 and a bit years) 

 

Upheld in Tesco's favour but didnt meet strict criteria to place CIFAS Marker. 
KYC Checks / Anti Money Laundering Laws. 

 

Tesco didnt conduct a sufficient enough investigation - **REQUIREMENTS ARE THAT PROOF IF THIS WAS TAKEN TO THE LEGAL SYSTEM TESCO COULD PROSECUTE?!** 

 

How was transfer made?

 

Normally setting up a new payee can involve
- Call to Account Holder - Code 
- SMS to Account Holder - Code
- Requirement to Contact Phone Banking
- Biometrics (Face Unlock / Fingerprint) 

 

Person reported online issues / security conerns. NOV 16!
Tesco had a security breach sometime in 2016 and users lost money which may or may not have been recovered. 

 

Tesco DSAR refused (This would be due to tipping off which is against Anti Money Laundering Regs) 

 

£150 involved

Gone to Adjudicator @ FOS (Ombudsman?)

 

Possible issue with Compromised devices? 

 

Could this be a situation where the account was compromised by a Tech Support [problem]? **Possibly Not**

 

IPhone - Via Banking App or Web Interface (Mobile) 

 

Repeated DSARs incur cost. (Possible they will charge this time around)

 

How do we combat this? 

 

We need to prove that you are innocent. 

 

First off - We need to raise a further request to Tesco to verify how this transfer was made. What information was there. What number's existed on the account? Can Tesco check the information held on their system? App info on a device wont just be IP Address - A lot more sensitive information is supplied to Tesco about the UAD (User Agent Device) 

It is possible that in the weeks up to the Security Incident that some accounts were compromised to test the sensitivity of Tescos AML Systems etc? I believe so...

 

Also - If a new payee was setup - What verification methods were used to approve the setup of a new payee? 

This may need to go legal to get Tesco to back down. The reason for CIFAS is legislation. Its easily challenged in court  if Tesco have confirmed they didnt do a good enough investigation. Either that or Media might be interested in this case. 

 

However we need 100% certainty that you had no involvement in the APPF (Authorised Push Payment Fraud) - If that truly is the case then this may be a slog but hopefully we can get this sorted. 

 

Have you formally accepted and Ombudsman response in relation to the case? (Not an adjudicator)...

[fkofilee]

Note Principal 4 On CIFAS 

 

Principle 4: Lawfulness (Standard of Proof)

Cases filed to the National Fraud Database must be supported by evidence and meet the ‘four pillars’ of the Standard of Proof. The Standard of Proof is:

1. That there are reasonable grounds to believe that a Fraud or Financial Crime has been committed or attempted;
2. That the evidence must be clear, relevant and rigorous such that the member could confidently report the conduct of the Subject to the police;
3. The conduct of the Subject must meet the criteria of one of the Case Types;
4. In order to file the member must have rejected, withdrawn or terminated a Product on the basis of Fraud unless the member has an obligation to provide the Product or the Subject has already received the full benefit of the Product.

Its off my opinion that Tesco do not hold the required standard of proof to place CIFAS at this time. 

 

[fkofilee]

Have you complained to CIFAS directly yet?

[fkofilee]

You need to be insistent with Tesco's... If you are innocent as you say then you have a mountain to climb to resolve this. 

You havent exhausted the complaints process with Tesco's - You can raise a new formal complaint to them about information you require.  

 

You also have the option of taking this legal. Tesco are required to hold information for 6 years plus an d being unable to provide a copy of the SMS sent to confirm the payee is unacceptable. 

What number was it sent to? They need to provide this information. There is a gray area about whether this would be tipping off - But it wouldnt be if you are innocent.

 

 

[fkofilee]

If there is serious doubt on the evidence and it is not 100% clear that you are culpable then CIFAS holds no bearing and shouldn't be registered.

[fkofilee]

They need to provide you the number to which the SMS was sent - Its important... It can then prove whether it was you or not.

During that time - Do you remember anything like your phone going offline for a small period and speaking to your mobile operator? 

 

Thinking Sim Swap here...

[fkofilee]

Also - Can i see all documentation from the FOS? Removing personal details of course.

[fkofilee]

Upload if possible  

If you need help then let me know,. 

[fkofilee]

Is that an adjudicator or an ombudsman? Need to be clear here...

 

In essence to you - This was a dormant account. Did you have any transaction go through this account between the Fraud occurring and the password reset?

[fkofilee]

Are you an iphone user? Have you ever been?

Also do you know that payee who the funds were sent to? 

 

[fkofilee]

Did you ever have the Tesco App installed?

[fkofilee]

Not having much luck are we... Can you see what im trying to do here... 

You have to be meticulous... If you wanted to trace your download history on an App Store - Where would you go? 

 

Not speaking in Riddles but there is only so much I can do for you.

 

 

In your letter from the FOS - Were all the payments made out from the account to different people?

Did anyone ever contact you saying they could get you some free money? (#Moneymule etc)

[fkofilee]

Wait hang on... Did you give them the Debit Card / Sort Code & Acc Number of the Tesco Account?

 

If so when was this? 

It could be relevant! 

[fkofilee]

Why was the debit card given. Do you have the Email Correspondance / SMS?

[fkofilee]

With those Debit Card Details you can reset logins etc and gain access in some cases.

Which is not good... 

 

If this is the trigger point - Then this will be an issue but we may have found the cause...

 

To refund to a debit card, they need to be a Merchant.

It is highly unlikely that they werent and freely giving away information like that causes situations like this... Not a blame game but people need to be on that ball

 

 

[fkofilee]

Not what to do next - Do you have the Correspondance? 

If so what info was given out?

 

Send me a PM if you do if it is private info - If this is the cause then we can build a case around it.

 

By the way - We are trying to prove that you were not part of some elaborate scheme to screw Tesco out of £150

 

[fkofilee]

Ive removed the attachment for you Ive seen it - Theres nothing in it to suggest the details were given away. 

Do you have anything else that would prove it? 

 

Otherwise I cant put a case together to help get this overturned.

[fkofilee]

Oh no... How much info did they send in the DSAR

? 

[fkofilee]

Yea plz do... 

Im struggling to put a case together here. Is there no call recording at all? (On the off chance)

Can you PM me the Adjudicator letter again without it blacked out... I want to read everything. 

 

Checked and with the IPhone app - You can add a payee with no protection in place so how do they verify its your device doing the transaction. 

Can you remember what Tesco Bank asks for when signing into the app for 1st time?

[fkofilee]

Hang on... ATM withdrawal? 

[fkofilee]

Which ATM was the money taken out of?

[fkofilee]

Hi Thanks for this. Ive read it and removed the attachment as it had PII in it.

So you are saying the Withdrawal had nothing to do with you?