bank authorised payments on a debit card reported lost for 5 months

[salviablue]

Hi guys, A little input as to what should be my course of action would be much appreciated.

 

Background (the abridged version):

 

Around december 2010, we reported our debit card as being lost.

When the replacement card arrived I updated paypal and alertpay with the new card details.

Upto around May 2011, paypal and alertpay payments had gone through as usual, no issues.

One day in May 2011, I tried to pay for an ebay item and the payment was refused by the card issuer (santander). A few seconds later, the phone wnet and it was santander's fraud dept stating that our account was on hold pending investigation of fraudulent activity.

After several phone calls, the account was unfrozen as we verifid the payments where not fraudulent, i.s. we had initiated them.

Second attempt at paying for the ebay item (through paypal), same issue, payment refused, followed by fraud alert phone call.

after a few days of this reoccurring pattern, I contacted both ebay and paypal.

Paypal helpfully informed me that the bank had refused payment, I had already ascertained that there was sufficient funds to cover the transaction, and so through paypal double checking the information they held on us, we worked out that the card i had on file was indeed the one I had reported lost in december 2010.

It appears that I must have deleted the wrong card details after updating paypal with the replacement card.

 

So, after much a-do on the phone to santander and visiting the local branch several times, our replacement card was destroyed and a new one issued. Keeping in mind that during this we had been accused by santander of fraudulently using two cards on one account etc..

I made a complaint to the staff in the branch, and wrote a letter to santander headoffice, asking why it took them 5 months to discover that they had been authorising payments on a card reported lost and to request statements covering the period with the last four digits of the card used for any card transactions.

 

Understandably, we were concerned that if someone found that lost card, and the bank had been authorising payments from it, especially if they were small local transactions, we would be none the wiser.

 

They finally, after again, much to-ing and fro-ing, sent me our transaction history covering the period in question, however what they sent us were just regular statements, with nothing identifying the card used for card transactions, as requested.

Furthermore, in the cover letter, they ask for us to provide evidence that the lost card has had payments made against it, even though they have previously admitted it in a phone conversation and that the case is considered fully closed since they fulfilled our request (of which they have not) - the cheek, and thats without even addressing how it is that they allowed such a thing to occur - or even refute it having had occurred.

 

Up on phoning them, and being pushed around complaints dept.s and managers, they are still very non-committal to resolving the issue, despite me stating that we have now reason to refute their claims that they are a professional and responsible body and that we feel, without just explanation or due customer care, we can no longer trust them to process our banking needs and they risk losing us as customers. As well as feeling that we now have no option but to issues them with a SAR (costing them considerably in time and money), as they have explained to us that they have no system with which to deal with our requests (only revealed during todays phone conversation) and that it would take someone to manually trawl through the account to discover the indescrepancies - why they did not do this in the first place knowing our requests, and that not just their reputation are at stake and that they don't have the system to automatically do this. In addition, I feel the regulatory bodies as well as the newpapers may do a better job of getting to the bottom of it than them, as our faith and good will in them is running dangerously thin.

 

There has been still no real attempt to deal with our complaints, fulfil our requests, compensate us for time, money and reputation loss nor even a partial apology.

 

 

 

It feels that my only course of actions now are to issue a SAR for ALL notes, conversations, computer details, branch visits etc., regarding our account covering this period, issue complaints for how our initial complaint was ignored and a separate one for how the complaint they are currently bungling has been dealt with, then escalating all three complaints to the ombudsman on top of informing all the papers of said fiasco.

 

If you've managed to still be reading thus far, well done.

 

 

I also wonder if this has happened to anyone else. Maybe you didn't even realise. Have you had a fraud alert for a transaction you have made? Did you report a card lost or stolen, and if so, are you sure that it is actually blocked?

[citizenB]

I would agree, send the Subject Access Request, detailing exactly what you want to see included. You will find a draft letter in the CAG library. Once you have the information, you will hopefully discover what has gone wrong.

[salviablue]

I have made the relevant information request from paypal just for further comfirmation. I just hope I don't have to go down the SAR route with them too....however in previous phone calls with them they have confirmed that all paypal transactions covering that period where made from a card ending in four digits not concurrent with the (supposed) only card current at the time. However, santander seem to be very reticent at providing us with the last four digits of the card we reported lost....

 

Thanks for that citizenB, I will get onto to that. However I won't be able to send it until thursday, as it will only be then I can spare the £10 to cover their costs for the SAR.

[salviablue]

OK, SAR sent, special delivery with the requisite £10 PO, should be with them, at the very latest, by tomorrow 1pm, apparently.

Although still no written confirmation as yet from paypal, I did managed to get a list of the last four digits of all cards (and the respective card holder name) for all cards we have held with them.

Going through the paypal statements/transaction history, I have deduced that the bank most certainly have indeed, with irrefutable proof, authorised payments on the card that was reported lost in december, right up to at least June.

 

Lets see what the SAR turns up, and, if as I suspect, a case of gross negligence on their part, in light of which, should they not wish to appease me with a satisfactory conclusion, a feast for the papers and even more damage to their already gargantuantly negative reputation.

 

I had given them ample opportunities, comunicated with them on numerous occasions, with no more from their side but empty promises and around a £30 "goodwill" gesture, of which I stated specifically was accepted in no way a settlement of the issue, and as just a show of their will to deal with the situation appropriatey (and that goodwill gesture was months ago).

 

How they can continue to mistreat customers and overcharge them rediculous amounts for even the smallest "violations" of t+c's, yet be so lax in their handling of peoples account security and still get away with it is beyond me....

[citizenB]

Excellent.. lets hope you obtain the information you want. If as you say, they have stuffed up royally, then you can have a field day

 

In response to your last question.. they get away with it because people dont walk with their feet and dont complain to the regulators. Once a complaint has "finally" been resolved most just want to get on with their lives and forget it

[salviablue]

A little up date:

 

I hope I've not left things too late, as shortly after receiving the matter from the SAR, I've had many more important and immediate things to deal with, leaving me with little resolve for this issue. However, now that the other issues are dealt with or at least on temporary hold, I wish to resume and hopefully instigate the ramifications for, this issue.

 

Anyway,......

 

Eleven days before their deadline, I received, via normal post, a thick wad of papers, a cover note and the P.O. I sent them to cover the SAR fee.

The thick wad of papers was yet another copy of my regular bank statements covering the last six years, and nothing more.

The cover note 'explained' to me that they presumed that my SAR was to effectively assist me in reclaiming excessive bank charges and that I was entitled to a copy of my bank statements for free, thus they returned the P.O.. Furthermore, it stated that they hope I find the information I require and that they have dealt with my query and now consider the matter closed.

 

So, I sent the P.O. back with a letter stating that they have not complied with the SAR as per law. I asked for clarification on whether they thought that they where not required to fully comply with the SAR or the law and if so, why, or whether their last letter + wad of regular bank statements was sent in error and that more information was to follow as per the SAR. I also stated that they have 11 more days in which to comply and that this did not constitute in anyway an extension to the deadline for returning to me the data requested.

 

Three days late, the package arrived via registered, signed for post. (and I did mean 'late' and not 'later', i.e. I received the matter of the SAR 43 days after they received the request in the fisrt instance)

 

No where in this wad of paperwork was there a detailed list of all DC transactions whereby the exact card used could be identified for each transaction, for the DC in question. They supplied this information for our two existing cards, which I explicitly told them we did not require, just all transactions paid for using DC's in such a way that the DC used for each transaction could be identified covering the period in question.

 

Neither had they listed all DC's we have had with them, in who's name they where in, their respective card no., when they where activated, when they where deactivated, why and when.

 

Also, they seem to conveniently not have any record of us reporting that DC in question having been lost. Yet, if we had not reported it lost, and its expiry was not for another year at least, then how did they know to issue us with a replacement?

 

I also asked for them to indicate where they did not hold specifically asked for information and for a reason and that if such information was destroyed, then when and by what means.

 

Hopefully, I have them by the short and curlies.

What kind of trouble do you lot think these have landed themselves into?

 

Keeping in mind that all I wanted to know, since I found out that they had been authorising payments on a card we reported lost months prior to its actual deactivation, was a detailed list of all transactions made using that aforementioned card covering the aforementioned period (since it being reported lost) so that I could ascertain that all the authorised payments where initiated by ourselves, and that someone else hadn't been using that card.

 

I think its the implications of admitting their bumbling in-competencies that has them really scared and thus the complete unwillingness to assist me in this endeavour, just incase I decided to kick up a stink or, even worse, I found that someone else had indeed found and been using the lost DC.

 

 

Furthermore, I was under the impression that where specific information is requested, and with information being supplied by the person (making the SAR) to render locating such specific information reasonably feasible, that they where under the legal obligation to make reasonable efforts to highlight such information and represent it in such a manner that the general 'layman' can understand/interpret.

They have done no such thing, and infact, although they supplied me with a list of commonly used abbreviations and their respective full terms, there are many abbreviated terms used throughout the data where their respective full terms have not been listed and neither can the meaning of these abbreviations be deduced from their context.

 

All the data supplied took the format of screen shot print outs, bar the statements.

 

All the things they did not supply, or in the manner of which I was under the assumption I could have expected, I specifically asked for, as it was such information they had thus far refused (by way of action/in-action/neglect) to give me.

 

 

 

So, I wonder if someone could advise me as to the best course of action now, and in what order.

 

Here are my thoughts:

 

1 - Simultaneously write to santander (detailing exactly what has occurred since my last correspondence with them; of course having escalating the complaint to the highest level (considering the amount of times I have contacted them regarding this matter, most of the time in complaint, and they have already stated that they are treating this matter as an escalated complaint); and that in their cover letter to the late-past-deadline SAR information they stated that, unless I could provide them with proof that they have authorised payments on the DC we reported lost, they will consider the matter closed and if I disagreed then I could go to the OFT (or whoever it is); that I have made a complaint to the OFT and my MP detailing your conduct causing the debacle in the first instance, and your conduct throughout my attempts at mutual resolvement leading to my investigation/SAR; and also a complaint to the ombudsman regulating the data protection act (whomever or whatever) regarding the wilful non-compliance of the guidelines regarding SAR's as per the law.), the OFT and the regulatory body for non-compliance/breach of the data protection act, and possibly

the police?

 

2 - depending on santander's reaction to 1, publishing the story to as many public places as is possible (news papers, rags, internet both on forums and creating a webpage, magazines, TV, radio....

santanders response to 1 had best be very favourable to us to prevent this. I think they are going to lose a lot more reputation and custom as a result of this if they are not very careful.

 

I have given them every reasonable chance,and beyond, to remedy their mistakes. I would suggest to the OFT that they undergo a full investigation into account negligence of this magnitude by santander, and if they are found to be negligent to an unacceptable degree (whos margin had aught to be very small, considering their business and that they are meant to be a professional body) that they are to have their license to operate in the UK revoked.

 

 

 

Oh, and incase anyone was wondering as to wording of the SAR, I have reproduced it here, minus identifying details of course:

 

 

 

Please supply me with copies of all the data which you hold on me in relation to any matter and in any form and for any period of time.

 

Please note that I require disclosure of any personal data which you hold on me or my husband for the entire period of my dealings with you.

 

The Subject Access is not limited to my transaction history and it is not limited merely to 6 years of historical information.

Additionally, where there has been any event in my account history over this period which has required manual intervention by any member of your staff, or any other person, I require disclosure of any indication or notes which have either caused or resulted in that manual intervention, or other evidence of that manual intervention in relation to my banking business with you. This is to include either a written transaction of or a copy (either on audio tape cassette or CD/DVD in a format that can be played on any common stereo cassette player/cd/dvd player, or in a digital format as an mp3 file on a CD/DVD or USB flash memory stick, or if the SAR information is to be provided via an electronic means, the recording(s) can be on the same medium as the rest of the information) of the recording of any phone conversations between myself and yourselves and between my husband and yourselves.

In addition to, and not limited to, I require all debit card transactions covering the period from 01/10/2010 - present, detailing the specific card used for each transaction - for this, the name of the card holder and the last four digits of the 16 digit card number for each card/transaction will suffice.

Also to be included and not limited to, is a list of all cards myself and my husband have, or have had, with you, including their card numbers and respective card holders name, when they where issued, if and when they where reported lost, stolen, expired or otherwise withdrawn from use, and when they where respectively and officially blocked from further use.

 

If you are unable to supply data from manual intervention because there has been no such manual intervention, then please be so kind as to confirm this in your response.

 

I enclose the statutory maximum fee of £10. You have 40 days in which to comply. Furthermore, if I discover that you have levied disproportionate penalties or charges which are invalid under the Unfair Terms in Consumer Contracts Regulations against me, then I shall be reclaiming them together with any interest charges which you have levied on them.

 

As it is your wrongdoing and mishandling of my account which has created the necessity for this Subject Access Request, I shall also be reclaiming the enclosed £10 DPA Subject access request fee, including the cost of the postal order and its assured delivery method (special delivery).

 

If there is specific information which you require in order to satisfy yourself as to my identity, please let me know by return. However, please note that the above address is the one which you normally use to communicate my private business to me and which you have hitherto found to be acceptable.

I would be happy to collect the Data from my local branch.

 

 

Yours faithfully,

[citizenB]

You should certainly make a list of all the information you are missing. The Information Commissioner is the person to complain to in respect of non compliance with a SAR. However, you could always take them to court yourself to force compliance.

 

http://www.consumeractiongroup.co.uk/forum/showthread.php?208966-Me-and-Them-SAR-non-compliance-claim.-**SUCCESS**

 

The Financial Ombudsman would be the person to take your original complaint regarding the payments made on a card that was no longer in use. Although again, that is not a quick option and you might find you will need to take court action to get your money back there as well

[salviablue]

Thank you again citizenB.

And to whom should I be making the complaint regarding santanders gross misconduct and negligence over the handling of my greviance arising from the aforementioned mishandling, the financial omsbudsman or the oft, or both?

 

 

That link is certainly encouraging, however the prospect of so many possible appearences in court isn't so appealing. Its a shame one cannot 'appear in court' by proxy......

[citizenB]

Yes, appearing in court by proxy would have been a lot easier methinks.

 

I think you should send your complaint to the Financial Ombudsman, copied to the OFT and FSA