I’m posting this to see whether anyone else has experienced something similar and to understand how EE’s security procedures allowed this to happen.
I am an existing EE customer and already had active Cifas Protective Registration in place because I take identity fraud seriously.
Despite this, a fraudster appears to have gained access to my EE account and managed to place multiple high-value orders worth approximately £6,000.
The orders included:
• Two iPhone 17 Pro Max devices
• Two Apple Watches
Three of the four devices were successfully obtained by the fraudster. I managed to intercept the remaining Apple Watch.
What concerns me most is not simply that my account was compromised, but that several expensive devices and associated credit agreements appear to have been approved without EE contacting me independently to confirm that I had authorised them.
I had active Cifas Protective Registration at the time.
My understanding is that Protective Registration is intended to alert participating organisations to the increased risk of identity fraud so that additional identity checks can be carried out.
I have now:
• Reported the fraud to EE
• Reported it to the appropriate fraud/crime reporting authorities
• Contacted Cifas
• Submitted a Cifas Data Subject Access Request
• Asked Cifas to establish whether my Protective Registration was visible when these transactions were processed
EE has told me that the fraudulent credit agreements have been cancelled and that no further money will be taken from me. Their fraud department is investigating.
However, I still want a clear explanation of how this was possible.
In particular:
1. Was my Cifas Protective Registration detected when the orders/credit agreements were processed?
2. If it was, what additional identity verification did EE perform?
3. How did multiple high-value orders get approved without EE independently contacting me?
4. How was the fraudster able to obtain three of the devices?
5. Were EE’s normal fraud-prevention procedures followed correctly?
I’m deliberately withholding identifying information and reference numbers because this is a public forum.
I would be particularly interested to hear from EE staff or other customers who have experienced account takeover or fraudulent device upgrades/orders while Cifas Protective Registration was active.
I appreciate that EE is currently investigating and I am not alleging what specifically went wrong before that investigation is complete. I simply want to understand how such a substantial fraud could get this far despite the safeguards already in place.
[Mod edit - moved to own thread and changed title]
