Senior TalkTalk staff were warned as early as 2013 that fraudsters were accessing customers’ personal details – two years before the company fell victim to an external cyber-attack.
As further TalkTalk fraud victims came forward this week – one losing almost £10,000 – it has emerged that a manager in the chief executive’s office was warned of a suspected data breach in July 2013, more than a year before the first evidence emerged that part of the firm’s database had been leaked.
Customer Keith Aldridge switched phone and broadband to the company in 2013, but within days he was called by a fraudster on the new landline number. The caller said he was ringing from TalkTalk and quoted details of his account – data that he claims “only someone working for the telecoms firm would have had access to”.
Aldridge lost £110 as a result of the scam, but TalkTalk’s head office later told him it would be inappropriate for the company to investigate the possible breach as it was a police matter, he claims.
TalkTalk said there was “no evidence” that a problem in 2013 was ignored, and has refused to pay compensation. It argues that Aldrige must have provided additional personal or financial details to the scammers for the fraud to take place.
Fourteen months after Aldridge was targeted by fraudsters, TalkTalk suffered the first of series of data breaches, culminating in the most catastrophic breach last month. About a dozen people are each thought to have lost several thousand pounds after being called by fraudsters who were able to convince their victims that they worked for TalkTalk.
This week, three further victims emerged, including a Manchester nurse who has lost £9,600 after being contacted by fraudsters purporting to be from TalkTalk just days before the company revealed the latest cyber-attack.
Thomas Catherall was quoted all his account details and promised a £250 refund. His computer was taken over remotely and two payments were taken out of his bank account. His bank, Santander, has refused to refund him – as it has other victims– on the basis that he was tricked into handing over security codes.
TalkTalk has repeatedly refused to accept any liability for its customers’ losses. But fraud victims planning to bring a class action against the telecoms firm have claimed that they were not properly warned that their personal data was in the hands of fraudsters after the 2014 breach, and therefore they should be compensated. Any evidence that the company was aware its data had got into the hands of criminals as early as 2013 could strengthen their case.
Aldridge said he switched to TalkTalk in the summer of 2013 but almost immediately suffered technical problems.
“The fraudsters called me on my brand new landline, on a new number that I had been given as part of the switch. It was so new that I had only passed it on to two family members, and yet the fraudsters had that number – and knew all about the technical problems I had had,” he claims.
Like other victims he was promised a £50 goodwill payment to apologise for the problems he experienced after the fraudsters used his bank card to make a Western Union payment for £109. While his bank, the Co-op, refunded the money, Aldridge was so concerned at what had happened that he contacted the TalkTalk CEO’s office to outline his concerns.
“In my view the company did not address it in anything approaching an adequate manner. Perhaps if they had done so there might not have been these newer issues,” he said.
Two teenagers and a man in his 20s have been arrested in connection with the most recent alleged data theft from TalkTalk. Almost 157,000 TalkTalk customers had their personal details hacked in last month’s cyber-attack. TalkTalk said the total number of customers affected by the attack two weeks ago was 156,959, including 15,656 whose bank account numbers and sort codes were hacked. The total is 4% of TalkTalk’s 4 million customers and is a small fraction of the number feared when news of the attack broke.
In a statement, TalkTalk said: “We’re sorry that Mr Catherall and Mr Aldridge have been targeted by criminals. Sadly, telephone scams are a growing problem for all companies, not just TalkTalk. That’s why we continue to advise customers to be vigilant and we have put measures in place to help our customers stay safe.
“We have written to all our customers to warn them about phone and email scams and provided a list of information we will never ask customers to provide over the telephone. We’ve also set up an online advice page, and customers can report suspicious calls by calling 0800 0832710.
“It’s important to note that scam telephone calls and emails have been going on for years and continue to be a growing issue. Just a few weeks ago research from the Money Advice Service showed that around eight scam calls are placed every second from fraudsters purporting to be from the likes of banks, utilities companies and even HMRC.”
