Not Delivering Financial Regulation

February 18, 2015

The DeliveryDemon is sick to the back teeth of the legions of scammers who employ phone drones who are thick enough to expect people to believe them when they call out of the blue and try to scam all the personal data needed for ID theft and financial crime. When she can be bothered, she reports them to the appropriate regulatory bodies. DeliveryDemon does not have much faith in the great British bureaucracies, and in this she is rarely disappointed.

Take for example a call received recently from some sleazy bunch in Manchester calling themselves Beyond Comparison, pretending to offer free insurance. Obviously, the FCA should know about this sort of thing since either the company is regulated and not conforming to the rules, or it is not regulated and shouldn’t be peddling financial products and advice. In this case, the DeliveryDemon saw that they are registered with the FCA, so reported appropriately. She was somewhat flabbergasted to receive a reply claiming:

  • I’ve found an entry for Beyond Comparison.Com Limited (click link to double check), but I don’t know whether this is the same firm that contacted you.
  • If you do business with a firm we don’t regulate, you won’t have access to the Financial Ombudsman Service or the Financial Services Compensation Scheme if you have a dispute or something goes wrong.
  • You haven’t provided me with enough information about who has contacted you for me to pass it anywhere. If you would like to provide us with any more information, you may wish to use our unauthorised firms reporting form

Yes, the FCA regulate this company but is indulging in a coverup by pretending it might be another company calling, and uses the opportunity to try and frighten a complainant by abdicating responsibility for companies operating within the FCA’s remit without authorisation. The FCA can identify the company as one it regulates but says it doesn’t have enough information to do anything about its malfeasance, and suggests I report it as unauthorised. Yes, really, the FCA suggests the DeliveryDemon should report an authorised firm as being unauthorised!

So what is the FCA choosing to ignore?

  • The DeliveryDemon has provided the company name, which is registered with the FCA.
  • The company call from a Manchester number and the company’s registered office is in Manchester
  • The company is phoning people claiming to hold data about them, which they are not authorised to hold.
  • The company are quoting as a source of personal information a company which has been dissolved for several years and never had authorisation to hold such information.
  • The company start by misleadingly offering free insurance, and only back off from this when explicitly queried about whether the caller is authorised to offer financial advice.
  • The company claim to be holding personal information but do not have a data protection registration

If the FCA can’t identify the company from the first two items, there’s something badly wrong with its process. If the FCA regards the other items as acceptable, it’s hardly surprising that the British financial sector is rife with corruption. But if the FCA isn’t going to get off its backside and do a bit of regulation, why the hell should the British taxpayer be paying nearly half a billion a year for this useless bureaucracy? Not only can we not trust financial companies, we can’t even trust the regulator to do its job.

Advertisements

Aiding and Abetting Criminal Activity

December 9, 2014

That’s what our phone companies are doing. It is an offence to harass people. It is fraud to entice people into believing that they have money due to them when the caller has no evidence that that is the case. It is an offence to hold people’s data without their permission. It is fraud to lie to persuade people to reveal their personal information. According to a government task force, a BILLION of these crimes are committed every year, with the assistance of our phone companies.
Our telecoms companies are making money out of these crooks, one way or another. They are certainly making no effort to prevent their infrastructure being used for criminal activity, despite being fully aware of the scale of what is going on. All we get is mealy mouthed platitudes recommending that we take actions which are either unfeasible or ineffective. Let’s get a few facts straight on just how useless these recommendations are.

  • Register with TPS? It’s a waste of time.
    • TPS doesn’t actually do anything with complaints
    • The crooks ignore TPS anyway
  • Block callers?
    • The crooks are spoofing numbers so blocking one number has little effect
  • Don’t answer if the number is withheld?
    • There are, unfortunately, some genuine companies which call from withheld numbers, ignoring good customer service for their own administrative convenience
  • Don’t answer if you don’t recognise the number?
    • Few if any people have complete knowledge of all the numbers they could be called from, whether personal or business. A child whose phone battery is dead could borrow a friend’s phone to call so no parent can afford to ignore unknown numbers. A friend can change phone number. A business contact could call from a landline when you only have their mobile number recorded. There is a host of reasons why a call from an unknown number could be both valid and important.

There are various reporting mechanisms – the ICO, Action Fraud, TPS, Ofcom, to name but a few. All those websites are badly designed. Their automated responses are uninformative and, in the case of Action Fraud, hide the content of their response in a dubious looking attachment. There is little if any evidence of any use being made of the information provided by these routes.
It would not be unreasonable to expect phone companies to make significant and meaningful effort to prevent their infrastructure being used to harass people, commit large scale fraud, and commit widespread identity theft. It would not be unreasonable to expect legitimate organisations not to behave in a way which emulates crooked behaviour.
Here are a few suggestions for the Nuisance Call Task Force.

  • Make it an offence to spoof a number
  • Make it an offence to deliver a call with a spoofed number
  • Make it an offence for a commercial organisation to withhold their number
  • Make it an offence for any organisation to sell or give away the personal details they collect
  • Limit the period for which an organisation can retain personal details and use them for sales and marketing
  • Create a single, simple, effective means of reporting the numbers used by scammers
  • Use the scammer reporting facility to create and maintain a single database of numbers recognised as being used by scammers
  • Make the database publicly visible
  • Flag numbers which are consistently being used in a criminal manner – say after 10 reports of the number as one which makes scam / harassing calls
  • Make it an offence for a phone company to issue the scamming number to anyone
  • Make the ban on reissue of scammer numbers meaningful – say a 10 year ban on their reissue
  • Make use of existing legislation to prosecute scammers for harassment as well as data protection and telecoms offences
  • Hold the directors of those companies responsible – directors of the calling company, its parent company, and any company on whose behalf it makes outbound calls
  • Since the crimes are being committed in this country in the homes of those being called, ignore the country of residence of those responsible for the scams and arrest any responsible directors who set foot in this country
  • Recognise that it is individuals who are responsible for encouraging / permitting these crimes and hold all directors responsible and liable to prosecution
  • Set penalties so that they automatically include both default and a significant fine

So why does the DeliveryDemon thinks this would work?

  • It will create an incentive for phone companies to take responsibility for the way in which they allow their infrastructure to be used
  • It would prevent genuine customers from being issued with numbers which people have blocked because the numbers were being used for scam calls
  • It would prevent banks from grooming their customers to give away security information to people who call them – for over a decade banks’ cavalier attitude to customer security has been demonstrated time and again when they make outbound calls to customers and proceed to ask for passwords and other sensitive information
  • It would encourage organisations to start to take data protection seriously
  • It would do away with the loophole which allows all the enforcement organisations to abdicate responsibility for scam calls originating overseas
  • A mandatory penalty of imprisonment would prevent those responsible from buying their way out of loss of liberty
    Significant fines for every offence would start to undermine the business model which makes scam calls profitable.

Let’s face it, we are talking of 32 crimes every second of every day. If our politicians and legislature and police and regulators aren’t prepared to take this seriously, the DeliveryDemon wonders what the hell we pay them for.


Banks that don’t deliver

August 7, 2012

The DeliveryDemon prefers to avoid dealing with financial institutions, primarily because of the enormous effort required to overcome their incompetence. The validity of this prejudice was confirmed recently during an attempt to open a very simple bank account https://deliverydemon.wordpress.com/2012/06/20/delivering-complexity-at-the-expense-of-security/

But the saga didn’t end there. Despite the DeliveryDemon having previously entered her details online – and she knows how to spell her own name – when she went to a branch to complete the tedious and primitive process, the bank person (teller? salesman?) managed to introduce an incorrect spelling. When the DeliveryDemon pointed this out, and expressed the wish to have cards and cheque book showing the name she normally uses, the bank person claimed to have corrected it. This was followed by the staggering assertion that, having introduced the error, the bank would send me documentation in the incorrect name as well as correct documentation.

So what actually happened?

  • A chequebook arrived with the incorrect name
  • A paying in book arrived with the incorrect name
  • TWO cards arrived in the SAME envelope, one with the incorrect name and one with the correct name, with the covering letter referring to BOTH cards
  • Two separate envelopes arrived in the same post as the cards, with PINs for each card – not particularly good security.

Today the DeliveryDemon spent nearly half an hour on the phone to their hell centre to try and sort the mess out.  The first clueless idiot, who couldn’t even read what was on the screen in front of her, just bleated that she wasn’t capable of changing details. Rather than waste time, the DeliveryDemon asked to talk to the supervisor. This person waffled on about stuff having gone missing – in fact he was referring to the cards etc that I had received with the incorrect name on them. Eventually he stopped waffling for long enough to arrange for corrected chequebook and paying in book to be sent, but the card problem was handled elsewhere.

When the DeliveryDemon got through to the bunch who deal with cards, their first suggestion was that they would send new cards to the branch to be picked up – a round journey of 80 miles, not to mention the time wasted and the tedious hanging around in the branch –  suggesting incorrectly and without checking the facts that cards had been sent which the DeliveryDemon had not received.

Eventually it transpired that nothing had gone missing but the bank had generated an incorrect card and a correct card and had chosen to send out BOTH cards in the same envelope. There is clearly a complete lack of intelligence in the system to pick up the fact that two cards were being sent for a single signatory account. Even if it had been a multiple signatory account, sending two cards in the same envelope is poor security, and the fact that this can happen indicates that, if the card sticking and envelope stuffing gets out of sequence, there’s nothing in the process to stop cards going to the wrong person.

This is the same bank which wants the customer to come up with EIGHT so-called authentication factors, considering it a form of security to ask a customer for information which is in the public domain. It hasn’t registered the fact that anything which makes a number memorable also makes it easier to guess. And it’s far too stupid to realise that, even if someone is sufficiently media-led to have a favourite sleb, that is hardly the sort of stable information that makes for a decent authentication factor – just how many people are going to contact their bank every few weeks to announce that they have gone off Lady Gaga recently and much prefer Metallica?

Clearly this bank has no concept of the basics of security. Like so many institutions it has confused security with making it difficult for customers to access their own money. And to confirm that staggering absence of commitment to customer service, it expects customers to go out of their way to sort out mistakes whcih arise purely from the bank’s incompetence.


Delivering Complexity at the Expense of Security

June 20, 2012

The DeliveryDemon is frequently flabbergasted by the sheer stupidity demonstrated by so many financial institutions when it comes to security. They obstinately pretend that imposing complexity on account access equates to security, in the face of all evidence to the contrary. At the same time they refuse to acknowledge that their own processes are often staggeringly insecure.

Some time ago after a trip abroad, the DeliveryDemon had a phone message claiming her credit card had been compromised, and asking her to ring the issuer on an unidentifiable number. It clearly sounded like a scam which needed to be reported to the issuer. So the DeliveryDemon phoned the switchboard and asked to be put through to the person who had left the message. She was unsurprised when the switchboard had never heard of this person, and asked to be put through to the security and fraud department – where she found herself talking to the person who had left the suspect message.

So how many security mistakes was that?

  • Leaving a message about a card compromise on a landline answering machine without knowing who might pick it up
  • Asking the cardholder to ring a number which could belong to any scammer
  • Creating a situation designed to justify a request for secure information, using a process riddled with fundamental security flaws
  • Preventing a customer from carrying out basic security checks by using a name not recognised by the switchboard.

But the biggest mistake of all was the fact that some time afterwards the DeliveryDemon had to deal with the identical flawed process. Needless to say, the DeliveryDemon had complained to the card issuer on the first occasion, yet the organisatioj had taken no notice of the complaint and had continued knowingly to operate processes which were fundamentally insecure.

This type of stupidity is remarkably common in the financial services sector, and a couple of very similar examples are described in an earlier post .

https://deliverydemon.wordpress.com/2012/04/02/delivering-poor-banking-security/

The other side of this refusal to operate secure processes is a determined effort to create barriers to prevent a customer from accessing their own funds. This goes hand in hand with lengthy and inequitable Ts and Cs which attempt to absolve banks from any responsibility whatsoever. The DeliveryDemon recently encountered this while opening a very basic bank account. This ‘simple’ account required no less than EIGHT authentication factors, including providing answers to some remarkably stupid questions.

  • A memorable number? Seriously? Numbers are not intrinsically memorable. Those which are memorable usually relate to public domain information, which is hardly secure.
  • Details of various third parties? Public domain again. It is also questionable in data protection terms whether a bank should be asking for information about third parties who have nothing to do with the account.
  • Favourite TV programs, newspapers, historical person, sleb, town? Get a life! This sort of preference is transient and likely to be forgotten months or years down the line when it is eventually needed in order to deal with some call centre drone who is not empowered to think beyond the mindless detail on the screen in front of them.

This sort of pseudo security is not just stupid in its own right, it is creating a situation where complexity makes life difficult for the customer, while being used as an excuse for financial institutions to try to avoid their own responsibilities.

Put these so-called security processes in the context of today’s digital native. Basic security advice is not to use the same details in multiple places, since compromise of one account can lead to compromise elsewhere. Typically, an account asks for 4 pieces of information, even when no financial transactions are involved. Try counting them up. Even without an intricate lifestyle the following range of accounts is pretty commonplace.

  • Mortgage
  • Mortgage-related insurance
  • Life insurance
  • Health insurance
  • Current account
  • Savings account
  • Debit card
  • Credit card
  • ISA
  • Pension
  • E-mail account
  • Work e-mail account
  • Mobile account
  • Landline / broadband account
  • Car insurance
  • Car radio code
  • Electricity account
  • Gas account
  • Water account
  • Council tax account
  • Supermarket account
  • Amazon account
  • i-Tunes account
  • Comparison site accounts – up to half a dozen
  • Social media accounts – another half a dozen
  • Technology support arrangements – say 3
  • Travel accounts for commuters – another couple
  • Online information sources such as newspapers, news sites and the like – say 3.

All of these want a login ID and a password, plus several additional pieces of information for ‘security’ should you be unable to log in. Security guidance suggest that unique information should be used for each situation, and that the information should not be written down in a recognisable format, even when months or years may elapse between accesses to the account.

Put this into the context of the real world. Current security guidance expects the individual to memorise in excess of 172 unique pieces of information, and to relate each piece of information to one of 43 or more situations. Current practice is for Ts and Cs to forbid keeping written records of passwords in any useful format. This is complete nonsense, not security.

So what’s the answer? There are organisations which can be used to store multiple passwords, but these then become a single point of failure should the access password be compromised or the organisation’s own security be breached. It’s not clear whether this sort of password storage is acceptable under access Ts and Cs either.  Even if banks start to give some form of approval to these organisations, it could be withdrawn, leaving the customer with the option of dealing with multiple password holders or changing to a new one. If a security breach underlies the reason for change, that would mean working through every single account to change access details. In some circumstances that may mean the delay of going through the account provider to replace codes which they do not allow the customer to change.

The current security situation is clearly unsatisfactory, ineffective,  and unfair to the customer. The DeliveryDemon thinks it is time that organisations which are responsible for security got together with both security and usability experts to come up with a solution which is designed to protect the customer’s interests, not a solution based on allowing financial institutions to avoid responsibility.


Delivering Poor Banking Security

April 2, 2012

The DeliveryDemon has the rather naive expectation that banks who are entrusted with our money should operate reasonably secure procedures. Hang your heads in shame RBS and Barclays.

The DeliveryDemon has had cause to complain to both banks recently. In each case the complaint was about their processes, not anything specific to the account. In both cases an idiot from their customer ‘service’ team phoned up and demanded to know secure account access details before they would consider listening to the complaint. Do they really think it is sensible for someone to give out account password information to a random caller?

RBS, there is no need to access my account in order to hear that it does not constitute ‘faster payment’ if you take details of a payment on Friday and can’t process it till Tuesday unless the I ring again on Monday.

In fact there is no need for your customer ‘service’ to access my account at all. The default action should NEVER be to access the customer account. Basic security is that this should only be done if the customer raises a matter specific to the account, i.e. if there is a genuine need to access the account.

Banks are piling on nuisance value processes to make it more difficult for the customer to access their own money, all in the name of security. It’s about time they got their own house in order, introduced secure internal processes and gave their customer contact staff some basic security training.