Tesco Bank - CIFAS Placed 2016 - Advice On How To Handle?

[L33noa]

Please can anyone help me with a CIFAS complaint, i cant work out how to post my question?

 

I filed a compliant with Tesco Bank in April 2018 as I found out I had a CIFAS marker placed against me dating back to October 2016.

 

Tesco delivered a final response and referred me to the Ombudsman,

I subsequently complained to the Ombudsman who in January 2020 some 22 months later delivered a final verdict to uphold Tesco banks decision to place a CIFAS marker.

 

Whilst they upheld the decision they made it very clear that Tesco bank did not carry out a fair and clear process and did not meet the strict criteria to satisfy the recording of  information against me with CIFAS.  

 

The ombudsman also went on to say that Tesco bank did not conduct a sufficient investigation.

However as they could not establish how the transfer would have been made so they have upheld Tesco decision.

 

I want to know what my next steps are.

I have not been involved in any fraudulent activity of any kind , I never used this account since it opened in 2015 due to security concerns and online access problems which I raised.

 

The first time it was used was when deposits and withdrawals were made on my account.

[dx100uk]

so who made these transactions and how did they gain access?

did you send Tesco's and sar before you started all these complaints?

 

dx

 

[L33noa]

I requested SAR from Tesco who originally refused my request.

 

I complained further and they sent me the SAR and a cheque for £250 as an apology.

unfortunately they didn't provide me anything to do with the transfers as they said they it would be tipping off.

I sent all of this information to the Ombudsman as well.

 

I have not been able to establish who made the transactions.

only that Tesco Bank was notified by the sending bank there had been unauthorized payment from one of their customers account into mine.  which was subsequently transferred out again, an amount of £150 came in and two payments out of £125 & £25 this happened on two days running.

[dx100uk]

eh? what are they playing at...it obv wasn't you doing it else they'd have sent the data!!

 

was this an adjudicator at the FOS or the Ombudsman man himself…?

[L33noa]

it was an adjudicator,

I complained and apparently it was reviewed by someone else who didnt contact me, I just had another email saying he agress with original decision. he stated that ...

 

Tesco Bank ought to have done more to ascertain the true position before placing the CIFAS marker and specifically it should have contacted me in the first instance to get my side of the story.

 

he goes on to say ...however i think it is most unlikely that someone would have been able to commit these transfers without my knowledge and cooperation and I am more involved that i am prepared to say 

[dx100uk]

and are you?

 

dx

 

[L33noa]

No. Never.

I opened the account in 2015.

Had nothing but issues getting online with the account. So decided not to use it.

 

It wasn’t until 2018 when my RBS account got closed and I investigated I found out anything about this. 

it’s caused me so many issues and stress.

Can’t get a bank account.

Job turned down

. Insurances cancelled

. And no end in sight

[dx100uk]

Well someone got into it

wasnt a virus hack going on on your pc at the time was there.. Key logger or an infection??

 

 

[L33noa]

I don’t know. The only laptop I had was a work laptop which was open to staff to use when I was working onsite at events as part of my job. Again which I told the fos 

[L33noa]

hey dx just wondering if any further advice at all? help much appreciated 

[dx100uk]

its a diff one.

if the only laptop used was not a secure single use machine used only by you...

anyone could have used it 

found out the details of the account (could that be why you could never access it?)

then transferred money over

then withdrawn it.

then reported to their bank the unlawful transfer..

 

 

 

[L33noa]

they have never specified it was the laptop which accessed, said it was via an iphone again not specified it was mine. provided an IP address which goes to a address different to me. 

 

the fact that they have not carried out a full investigation and the full and proper process for placing the marker should make it wrong and be removed anyway shouldnt it regardless of anything else? the rest it heresy and speculation as opposed to following a process and procedure which they didnt?

Edited January 16, 2020 by L33noa
didnt mean to submit

[dx100uk]

ah so you know more info than we currently know...re the iPhone etc?

 

I think a new sar as it's free is in order here.

lets cross i's and dot t's ..then we canr have a firm hold upon what arrows to fire in a complaint.

 

we have a cifas expert here but it will be better to get every shred of info first before their help IMHO.

[L33noa]

ok thats great I will request a further SAR , I will also request a SAR from Ombudsman. 

are Tesco Bank required to issue another SAR if they have already issued one?  again the first one didnt provide anything around IP address etc that came from Ombudsman so clearly they didnt provide everything

 

I also note that the week after the on goings within my account there was a major  security breech at Tesco : as below: which doesn't fill me with great confidence around what has happened to me:

 

Over the course of the weekend (5 – 6 November 2016) it was reported that approximately 20,000 customers of Tesco Bank (the banking arm of the supermarket giant) saw their money vanish from their current accounts.

 

A further 20,000 customers reported instances of suspicious activity.

The total amount stolen has not yet been revealed but some customers have cited losses of up to £2,400 each.

 

To date, Tesco Bank has confirmed that it has refunded around 9,000 customers up to £2.5m following the breach.

[dx100uk]

can't not be connected.

 

dx

[L33noa]

Ok Tesco have replied to say the original SAR issued is the full and final one that they hold with all the data. they apologized the original one didn't have telephone calls and have compensated me £50 for this, these will arrive in 30 days.

 

So what am i looking for in the SAR now? what do i need to do next?

Thanks 

[L33noa]

@dx100uk i was wondering if i can obtain some further support around this please. Many thanks you mentioned  cifas expert

 

Many thanks as always 

Lee

[fkofilee]

Hi L33noa - DX asked me to pop by - I will digest your thread in full and advise next steps during the weekend if possible? Unfortunately I work full time so have to balance helping people with helping people in my job ^_^

As for your CIFAS dilemma - Can I ask quickly. Have you access to your own bank account at this time? 

 

CIFAS is complicated and is a very grey area but I will see what I can do to help.

[L33noa]

@fkofilee Many thanks for the reply and thank you so much for assisting.

Completely appreciate you have a full time job and of course that comes first so no rush at all.

 

The bank this happened to was Tesco bank (opened Feb 2015),

I never used he account as I had constant problems with accessing it right from day 1.

decided to stick with my main bank (RBS).

 

The account was left open and I didn’t know anything about Tesco placing the CIFAS (in Oct 2016) until RBS unexpectedly closed all my accounts in Jan 2019 leaving me with no banking facilities and unable to get a high street bank or basic bank.

I am now using an internet bank as that’s all I am able to get.

Thanks again

[fkofilee]

When you say Internet Bank? Monzo / Starling?

[L33noa]

Monzo 

[fkofilee]

Good Call - They are full fledged bank with full permission to trade and covered by FSCS

Ill be back this weekend to finish off this and create a plan of action.

[fkofilee]

So something for you to digest and respond too... 

 

i have the below as your case notes;  Plus some of my own.

 

Quote

Tesco Bank Complaint 

April 2018 Filed

CIFAS Placed in 2016 (October) (3 and a bit years) 

 

Upheld in Tesco's favour but didnt meet strict criteria to place CIFAS Marker. 
KYC Checks / Anti Money Laundering Laws. 

 

Tesco didnt conduct a sufficient enough investigation - **REQUIREMENTS ARE THAT PROOF IF THIS WAS TAKEN TO THE LEGAL SYSTEM TESCO COULD PROSECUTE?!** 

 

How was transfer made?

 

Normally setting up a new payee can involve
- Call to Account Holder - Code 
- SMS to Account Holder - Code
- Requirement to Contact Phone Banking
- Biometrics (Face Unlock / Fingerprint) 

 

Person reported online issues / security conerns. NOV 16!
Tesco had a security breach sometime in 2016 and users lost money which may or may not have been recovered. 

 

Tesco DSAR refused (This would be due to tipping off which is against Anti Money Laundering Regs) 

 

£150 involved

Gone to Adjudicator @ FOS (Ombudsman?)

 

Possible issue with Compromised devices? 

 

Could this be a situation where the account was compromised by a Tech Support [problem]? **Possibly Not**

 

IPhone - Via Banking App or Web Interface (Mobile) 

 

Repeated DSARs incur cost. (Possible they will charge this time around)

 

How do we combat this? 

 

We need to prove that you are innocent. 

 

First off - We need to raise a further request to Tesco to verify how this transfer was made. What information was there. What number's existed on the account? Can Tesco check the information held on their system? App info on a device wont just be IP Address - A lot more sensitive information is supplied to Tesco about the UAD (User Agent Device) 

It is possible that in the weeks up to the Security Incident that some accounts were compromised to test the sensitivity of Tescos AML Systems etc? I believe so...

 

Also - If a new payee was setup - What verification methods were used to approve the setup of a new payee? 

This may need to go legal to get Tesco to back down. The reason for CIFAS is legislation. Its easily challenged in court  if Tesco have confirmed they didnt do a good enough investigation. Either that or Media might be interested in this case. 

 

However we need 100% certainty that you had no involvement in the APPF (Authorised Push Payment Fraud) - If that truly is the case then this may be a slog but hopefully we can get this sorted. 

 

Have you formally accepted and Ombudsman response in relation to the case? (Not an adjudicator)...

[fkofilee]

Note Principal 4 On CIFAS 

 

Principle 4: Lawfulness (Standard of Proof)

Cases filed to the National Fraud Database must be supported by evidence and meet the ‘four pillars’ of the Standard of Proof. The Standard of Proof is:

1. That there are reasonable grounds to believe that a Fraud or Financial Crime has been committed or attempted;
2. That the evidence must be clear, relevant and rigorous such that the member could confidently report the conduct of the Subject to the police;
3. The conduct of the Subject must meet the criteria of one of the Case Types;
4. In order to file the member must have rejected, withdrawn or terminated a Product on the basis of Fraud unless the member has an obligation to provide the Product or the Subject has already received the full benefit of the Product.

Its off my opinion that Tesco do not hold the required standard of proof to place CIFAS at this time. 

 

[fkofilee]

Have you complained to CIFAS directly yet?