topic Re: EE contract fraud / identity theft Alert in Security

EE contract fraud / identity theft Alert

Mil3n3 — Fri, 26 Jan 2024 17:48:27 GMT

TLTR:

A fraudulent contract for £2,300, including an iPhone 14 Pro Max and Nintendo Switch, was taken out in my friend's name at EE store (hours away from her place). She only discovered this when her direct debit payments spiked. Despite her never authorising this, EE sent OTPs to a secondary phone number on her account, used by her underage son, and the OTPs weren't even opened. EE's lack of thorough identity checks and their refusal to provide CCTV footage raise concerns of potential internal fraud. After facing threats to her credit score and mental health strain, my friend's appeals to EE and the ombudsman have been dismissed.

I am sure this isn't an isolated case and I am looking for people facing experiencing similar story. We're creating a coalition to bring this issue to the media and possibly to court. If you're affected or concerned, join us in this fight for justice. Together, we're stronger!

Full story:

My friend is a single mom of two boys working part-time in London. On July 1st, 2023, someone posing as her entered an EE store in Solihull Touchwood and fraudulently took out a contract on her existing EE account, amounting to approximately £2,300. This contract included an iPhone 14 Pro Max and a Nintendo Switch as an add-on.

She became aware of this matter when she noticed a significant increase in her regular direct debit. Upon contacting EE, she was informed about the activity on her account. EE informed her that on July 1st, 2023, two separate One-Time Pin Codes (OTPs) were sent to one of the secondary phone numbers on her account. EE alleges that the OTPs were used to secure the fraudulent contract. Further investigation revealed that during the window the OTPs were sent to her son's number, no phone calls were made or received by him that could explain the OTP being passed on to the fraudsters. Moreover, the text message containing the OTP was not even opened by her son.

EE has now cut off all her lines after sending her multiple threatening messages, taking actions that will affect her credit score. She has exhausted all possible avenues before considering legal action (which I’d like to pursue) but has been rejected and let down by both EE’s fraud service and the EE ombudsman.

This situation has severely impacted my friend's mental health, and she has now run out of energy to fight the case. Therefore, I am offering my support in trying to resolve the situation.

YOU ARE NOT ALONE: After a limited investigation on my part, I’ve already found a few people facing the same situation just by browsing the EE forum. I am sure hundred+ people are concerned. I now want to join forces, take this to the media, and potentially to court to fight this injustice. TOGETHER, we can be stronger! Join the fight.

Further findings and information on EE's failure to protect their business and customers against fraud:

The OTPs were sent to a secondary phone number, while all security information had previously been sent to the primary phone number.
The secondary phone number is assigned to a minor under 18. A contract with a minor is voidable, meaning it can be canceled at any time before they reach 18 and for a reasonable time afterwards, without any reason.
Her son did not make or receive any calls during the timeframe the OTPs were sent to their phone. Furthermore, the text message was left unopened.
The OTPs were sent three times, and the fraudster failed to provide the OTP twice. Despite this, the EE salesperson did not ask for further ID to obtain the contract.
The signatures on the contract not only do not match my friend's signature but also differ from one page to another. EE admitted that this situation should have raised their employee's concerns.
EE has refused to provide CCTV footage, and we are now very suspicious that this could be an internal fraud by one of their employees. My friend has been informed that the store is under investigation as she is not the only victim of this fraud in that location.
EE has admitted that the person who came to the store was not my friend.

Re: EE contract fraud / identity theft Alert

James_B — Fri, 26 Jan 2024 19:00:11 GMT

Hi @Mil3n3,

Welcome to the EE Community. 🙂

I'm sorry to hear your friend has been a victim of identity fraud.

Do they have an open complaint with us?

James

Re: EE contract fraud / identity theft Alert

Mil3n3 — Fri, 26 Jan 2024 19:40:53 GMT

Hi @James_B,

Thank for you message (if you are not a bot).

Yes she did raise a complain and her complain has been rejected. Although if you read carefully the full story you'll understand it was unfairly rejected as EE there are many EE obvious security negligences that took place in this case. She is tired has she has been bullied by EE service for 6 months and she has a day job to do and she is a single mom of two kids, but I decided I won't let go, I am decided to not necessarily in that order:

Gather more victimes
Contact the media
Contact local MPs and a layer

As unlike her I have got time, money and energy.

What would you suggest to shorten this issue, as seriously the moment I'll start to invest more energy into this I'd be probably less willing to solve this with no financial compensation on her side?

Re: EE contract fraud / identity theft Alert

Chris_B — Fri, 26 Jan 2024 20:17:56 GMT

@Mil3n3 Just to point out EE don’t sell contracts under 18, it’s down to the account holder on who they give a contract sim too if that person is under 18. So as this was an adult taking out the contract and giving it to an under 18 the adult took out that contract so it’s not voidable.

Re: EE contract fraud / identity theft Alert

Mil3n3 — Fri, 26 Jan 2024 20:50:09 GMT

Understood @Chris_B which kinda relate to my other point how can EE prove the person who signed the contract is aged over 18 if they did not control the ID of the person who signed the contract off?

Re: EE contract fraud / identity theft Alert

Chris_B — Fri, 26 Jan 2024 22:19:58 GMT

@Mil3n3 And that’s what you need to focus on. A child can not take out additional contracts even with OTP codes forwarded to their contract number.

EE will not/do not sell contracts to a child. The only problem you have is that anyone could be given a contract sim by the account holder. But still the account holder has to approve the additional contracts and a 2nd line on an account isn’t the primary number on the account that should be receiving OTP codes to approve additional contracts on the account. A 2nd line is a user of the account and the main number on the account is usually in the account holders name so their number should be receiving OTP codes for additional contracts.

I wish you all the best with this.

Re: EE contract fraud / identity theft Alert

Mil3n3 — Fri, 26 Jan 2024 22:40:03 GMT

Agreed @Chris_B I created a group of victims on Facebook it's been just a few hours and I already have about 10 people facing the same issue from different area in London. I'll post on a local group of the city where the fraud took place (4.4K members) and see if I can find more victims. As an employee of EE himself confirmed to my friend she was not the only one.

I have an acquaintance working for Sky News I'll reach out to if I/We don't get more movement on EE side int he coming days. I want to avoid that for her as she ha been through a lot of stress already, as I said a single mom of two boys working part time in London who is already struggling with cost of living so defo not afford the luxury of a 2.3K worth contract she did not sign off herself.

If you've got more advises feel free to contact me through MP.

thx

Re: EE contract fraud / identity theft Alert

BrendonH — Fri, 26 Jan 2024 23:07:52 GMT

EE would not be allowed to give you any CCTV footage. But if police are involved then they will hand this over to the police.

Re: EE contract fraud / identity theft Alert

Mil3n3 — Sat, 27 Jan 2024 00:09:27 GMT

@BrendonH yes indeed and conveniently as the police does not get involved in identity theft as:

This is not considered as a crime under UK law
Action fraud is the service in charge of this type of cases anyway and not the police

A grey area in the UK law that EE is well conscious of and therefore is taking advantage of to bully their victim customers when EE themselves did not take reasonable steps to verify the identity of the fraudster/contractor.

Quick reminder here:

The OTP was sent 3 times to try to identify and they failed to provide the pin twice. Despite this they did not ask for a physical ID.
On the claim they call OTP second Auth (but they are failing to explain what was the FIRST Authentication method)
The signature on the contract not only does not match my friend signature, but the signatures are different in the signed contract itself.
Not to mention the last attempt to identify the OTP has been made on a different number (secondary number of the contract so no doubt secondary number is not own by the owner of the contract right 😉 )

An Employee at EE has apparently mentioned the fraud comes from an insider, but still my friend is apparently reliable for paying. Waiting for EE official feedback in the coming days. If they keep silent I'll find other route for the victim to be made justice.

Thank you for your contribution Brendon, I'll get there!

Re: EE contract fraud / identity theft Alert

BrendonH — Sat, 27 Jan 2024 00:22:53 GMT

I know it's action fraud that deals with this but they are also police.

EE would give them the CCTV but I'm guessing you haven't contacted them

Re: EE contract fraud / identity theft Alert

Chris_B — Sat, 27 Jan 2024 09:06:53 GMT

@Mil3n3 Sorry to correct you again

“

Not to mention the last attempt to identify the OTP has been made on a different number (secondary number of the contract so no doubt secondary number is not own by the owner of the contract right 😉 )

The account holder is the owner of all contracts on their account even if they are not the user of that number. The account holder takes full responsibility of these payments as all bills are in their name.

Any OTP codes should be sent to the primary contact number on the account and this is usually the account holder’s number as that’s when been set up. As it’s usually the first contact the account holder has with EE.

I’ve been doing some checking and you say EE refuse to give you CCTV footage. There are 2 possible reasons for this.

1 its only recommending that CCTV footage is kept for 30 days. ( you say this happened just 1st 2023 )
2 you can only request CCTV footage of yourself by law not anyone else in that footage.

Crazy I know but that’s what the GDPR is about as that could prove everything but then the first item I listed is very relevant.

Re: EE contract fraud / identity theft Alert

Leanne_T — Sat, 27 Jan 2024 10:05:42 GMT

Hi @Mil3n3

Thanks for coming back to us.

I am very sorry to hear how this has impacted your friend and understand how stressful this must be for her, EE take fraud and security very seriously and any reports of fraud would be fully investigated by our security team. Our Fighting Fraud | Cyber Security Help | EE has further information.

We are unable to access individual cases on the community and would advise your friend to contact our mobile guides directly. If the case has been referred to the ombudsman, they are independent from EE and would review all evidence from both sides. Please see the EE Complaints Code of Practice January 2022 page for more details.

Thanks.

Leanne.

Re: EE contract fraud / identity theft Alert

Mil3n3 — Sat, 03 Feb 2024 20:10:16 GMT

Hi @Leanne_T thank you for your message. Something you can defo help me with would be to understand what is the difference between:

OTP Authentication and Secondary OTP authentication?

Thank you,

Re: EE contract fraud / identity theft Alert

James_B — Sun, 04 Feb 2024 08:40:23 GMT

Hi @Mil3n3,

OTP verification is when we send a single use pass code to the 'lead' phone number on an account.

I'm not aware of a secondary OTP authentication process.

James

Re: EE contract fraud / identity theft Alert

Mil3n3 — Sun, 04 Feb 2024 13:28:29 GMT

Thank you @James_B how would you read the attach table then? How many code has been sent to the user how many of them failed and how many of them succeeded according to you. And same question as above on what is the difference between OTP Authentication and Secondary OTP authentication?

Re: EE contract fraud / identity theft Alert

Mil3n3 — Sun, 04 Feb 2024 13:30:20 GMT

Sorry @James_B I missed the screenshot. Here you go

Re: EE contract fraud / identity theft Alert

James_B — Sun, 04 Feb 2024 14:15:59 GMT

Hi @Mil3n3,

Our mobile guides are best placed to answer any specific questions about the verification steps that were taken on your friends account.

They can contact them on 150 from their EE phone.

James

Re: EE contract fraud / identity theft Alert

Mil3n3 — Mon, 05 Feb 2024 14:45:20 GMT

@James_B are you working for EE or are you just a forum participant (I am not being sarcastic that's a real question).

As if you are working for EE I find it a bit worrying that this type of basic questions around EE processes cannot be answered by the support team. The process should be transparent and shared by the entire staff.

ie would you be able to let me know how many OTP attempt are deemed acceptable without a member of staff asking for an ID? Is there clear guidelines a EE to protect their customers? Can you please share these guidelines here?

Re: EE contract fraud / identity theft Alert

James_B — Mon, 05 Feb 2024 15:58:23 GMT

Hi @Mil3n3,

Yes, I work for the EE Community Support Team.

As discussed earlier, the best course of action to find out further information on the security steps that were taken on this specific account would be for the account holder to contact our Customer Care Team.

Thanks

James

Re: EE contract fraud / identity theft Alert

Mil3n3 — Mon, 05 Feb 2024 17:04:06 GMT

Hi @James_B my question is not to find out information on the security steps that were taken on this specific account. My question is what are the security guidelines at EE to open a new line on an existing account. And in addition to my question, what are the official guidelines in terms of OTP attempt failure. This is not specific to an account this is how EE keeps their Customer and customer data safe. I'd like the official guidelines to be share with me. Thank you.