Banking non-Privacy

[UncleEbenezer]

I was taken aback today by the amount of information my banking app gave me about another person.

I was looking to pay a chap called Steve, who has done a small job for me. Steve had sent me his bank details for payment, so I was setting up a new payee. I know that banks today are pretty helpful and will verify payee details, so when I entered Steve's I expected it to flag a close match (Steve almost certainly being either Steven or Stephen - I didn't know that detail, though I did know the exact spelling of his surname).

And indeed, it was so. But my app told me more than just that: it revealed Steve's full name as owner of the account whose details I had entered. Which is the kind of personal information I really wouldn't expect the banks to reveal to me: I expect it merely to confirm (or otherwise) information that I enter about someone else.

Is this usual? How well-defined are the limits to banking privacy?

[stevensfo]

I was taken aback today by the amount of information my banking app gave me about another person.

I was looking to pay a chap called Steve, who has done a small job for me. Steve had sent me his bank details for payment, so I was setting up a new payee. I know that banks today are pretty helpful and will verify payee details, so when I entered Steve's I expected it to flag a close match (Steve almost certainly being either Steven or Stephen - I didn't know that detail, though I did know the exact spelling of his surname).

And indeed, it was so. But my app told me more than just that: it revealed Steve's full name as owner of the account whose details I had entered. Which is the kind of personal information I really wouldn't expect the banks to reveal to me: I expect it merely to confirm (or otherwise) information that I enter about someone else.

Is this usual? How well-defined are the limits to banking privacy?

I don't understand the problem. You mean that you're willing to send money to someone and you don't think you should know his full name?

In transferring money to a stranger, I would think that knowing that person's name is the very minimum of information you should have.

Nothing to do with privacy, but everything to do with security, safety and common sense.


Steve

[UncleEbenezer]

I was taken aback today by the amount of information my banking app gave me about another person.

I was looking to pay a chap called Steve, who has done a small job for me. Steve had sent me his bank details for payment, so I was setting up a new payee. I know that banks today are pretty helpful and will verify payee details, so when I entered Steve's I expected it to flag a close match (Steve almost certainly being either Steven or Stephen - I didn't know that detail, though I did know the exact spelling of his surname).

And indeed, it was so. But my app told me more than just that: it revealed Steve's full name as owner of the account whose details I had entered. Which is the kind of personal information I really wouldn't expect the banks to reveal to me: I expect it merely to confirm (or otherwise) information that I enter about someone else.

Is this usual? How well-defined are the limits to banking privacy?

I don't understand the problem. You mean that you're willing to send money to someone and you don't think you should know his full name?

In transferring money to a stranger, I would think that knowing that person's name is the very minimum of information you should have.

Nothing to do with privacy, but everything to do with security, safety and common sense.


Steve

I set up a new payee to pay him for the work he'd just done.

A fraudster might set up a new payee in order to fish for information. For example, he's seen Steve in a pub and caught a glimpse of a letter, a creditcard, a business card, and is filling the gaps needed to steal Steve's identity and apply for loans and benefits, or set up an account to launder money, in Steve's name.

Or the fraudster might be running a bot setting up random payees at a million per second, and taking whatever hits it gets.

I legitimately have Steve's details. My needs are perfectly well served if the bank merely confirms the details I have entered. I can query Steve further before paying if I need to.

This is Security 101. You verify information supplied by the customer, and alert the customer if there's a problem. You do not disclose additional information. Disclosing information beyond what I've entered benefits the fraudster, but does not benefit me.

Come to think of it, that was almost certainly a Data Protection violation. Not merely GDPR, but the 1998 Data Protection Act.

[SteelCamel]

What new information did they reveal? You already had Steve's full name and bank account details. All that they added was a minor correction, changing "Steve" to "Steven". If you'd entered "Joe", it would have told you "that doesn't match". And if you didn't have the account number you'd get nothing.

So the fraudster in the pub would have to "catch a glimpse" of Steve's full account number (and have a photographic memory to memorise 14 digits at a glance). The bot would have to guess random names as well as account numbers - which would match so rarely that the volume of attempts is likely to trip anti-fraud monitoring. And this assumes that the fraudster's own bank is OK with the fraud, as otherwise they need an account (in their own name, verified with ID) to run the attempts from.

I could also point out that every cheque has the writer's full name and account number on it, so it's not exactly difficult to obtain this information.

[mc2fool]

I was looking to pay a chap called Steve, who has done a small job for me. Steve had sent me his bank details for payment, so I was setting up a new payee. I know that banks today are pretty helpful and will verify payee details, so when I entered Steve's I expected it to flag a close match (Steve almost certainly being either Steven or Stephen - I didn't know that detail, though I did know the exact spelling of his surname).

And indeed, it was so. But my app told me more than just that: it revealed Steve's full name as owner of the account whose details I had entered.

And that is what "close match" does, so that you can check and confirm that it really is the person you wanted to send money to.

"Close match – If the customer had used a similar name to the account holder, they will be provided with the actual name of the account holder to check. They can update the details and try again, or contact the intended recipient to check the details."
https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/

What if you'd entered Stevie Bloggs and instead of it coming back with Stephen or Steven Bloggs it came back with Stephenie Bloggs.....

I expect it merely to confirm (or otherwise) information that I enter about someone else.

So if the account name was Stephen Bloggs and you entered Steve Bloggs you think it should just say, nope, doesn't match, and that's it?

[UncleEbenezer]

I expect it merely to confirm (or otherwise) information that I enter about someone else.

So if the account name was Stephen Bloggs and you entered Steve Bloggs you think it should just say, nope, doesn't match, and that's it?

It can confirm a close match without revealing the actual name. That's what I've seen before in similar circumstances, and what I expected this time.

Then leave it to me whether to proceed or go back to him for more detail. In this case I'd've proceeded: I had the details from Steve himself, so the risk was a typo rather than an elaborate fraud.

[Lootman]

I remember the good old days when you could walk into a bank branch with a pile of cash, and ask to pay it into a designated account, identified only by sort code and account number.

The bank did not ask me who I was nor did it ask me if I knew who owned the account.

This was only about a decade or so ago.

[scrumpyjack]

Oh I thought this thread might be about something like the chairman of a bank discussing a client's account with a BBC journalist she happened to be sitting next to at a dinner? Very Uncoutts of her.

[the0ni0nking]

I remember the good old days when you could walk into a bank branch with a pile of cash, and ask to pay it into a designated account, identified only by sort code and account number.

The bank did not ask me who I was nor did it ask me if I knew who owned the account.

This was only about a decade or so ago.

Whereas I had a bank account closed earlier this year after making an online transfer of a five figure sum out of the account to another account owned by me.

They asked me to provide proof of funds (this is the bank I was transferring the money from NOT to) and when I said if you look at the statements you've created for the account you'll see where the money came from they decided they didn't like that and told me they would be closing the account in 3 months.

Idiots.

[stevensfo]

I remember the good old days when you could walk into a bank branch with a pile of cash, and ask to pay it into a designated account, identified only by sort code and account number.

The bank did not ask me who I was nor did it ask me if I knew who owned the account.

This was only about a decade or so ago.

Whereas I had a bank account closed earlier this year after making an online transfer of a five figure sum out of the account to another account owned by me.

They asked me to provide proof of funds (this is the bank I was transferring the money from NOT to) and when I said if you look at the statements you've created for the account you'll see where the money came from they decided they didn't like that and told me they would be closing the account in 3 months.

Idiots.

Don't they have to give a reason?

Make sure you empty the account before they close it. I've heard of cases where accounts are closed and the bank holds onto the money for ages.

The changes in banks over the last ten years are really quite disturbing.

Steve

[Lootman]

Whereas I had a bank account closed earlier this year after making an online transfer of a five figure sum out of the account to another account owned by me.

They asked me to provide proof of funds (this is the bank I was transferring the money from NOT to) and when I said if you look at the statements you've created for the account you'll see where the money came from they decided they didn't like that and told me they would be closing the account in 3 months.

Idiots.

Don't they have to give a reason?

Make sure you empty the account before they close it. I've heard of cases where accounts are closed and the bank holds onto the money for ages.

The changes in banks over the last ten years are really quite disturbing.

Agreed. My current approach is to maintain three separate bank accounts. If one of the banks goes all weird on me then I have alternatives.

I also like to test them occasionally, say by withdrawing a large amount of cash from one and then deposit it into one of the others. Then see how maturely each bank handles that. Are there lots of prying questions and sketchy insinuations? Or does the clerk just do what they are told without commentary or backchat?

[bungeejumper]

Whereas I had a bank account closed earlier this year after making an online transfer of a five figure sum out of the account to another account owned by me.

They asked me to provide proof of funds (this is the bank I was transferring the money from NOT to) and when I said if you look at the statements you've created for the account you'll see where the money came from they decided they didn't like that and told me they would be closing the account in 3 months.

Don't they have to give a reason?

Sounds familiar. We had a business bank account closed last year by a big four bank, with the vague but totally bizarre allegation that it had somehow infringed the money laundering regulations. (Onionking, might one of your accounts have been non-UK?) They refused to tell us more, although we implored them for details. And we'd been with them for forty bloody years! Apparently banks can close down any account they like, for any reason they like. As Farage found out.

Since this was a "service account" (actually it was the non-profit shared maintenance fund for an apartment block, with less than £1,000 in the collective kitty), it took us some time to cut throught the flannel and discover that our bank, like several other banks, was simply getting rid of these accounts because they weren't making it enough money. This account had never been in debt - indeed, it was not constitutionally allowed to be in debt! - so it didn't fit the corporate drive for profitability.

It transpired that the whole property management industry was/is having the same problem. Even fairly large freeholders and property managers were having the rug pulled from under them. And here's the twist - freehold managers are legally required to hold these service accounts! So doing nothing was not an option. We could have been sued for not having one.

Fortunately, a quick search showed that there were two or three banks still doing these accounts. Within a week, one of them had been asked to take over all of our little company's six-figure asset bank accounts. We don't stay where we're not welcome.

BJ

[the0ni0nking]

Don't they have to give a reason?

Make sure you empty the account before they close it. I've heard of cases where accounts are closed and the bank holds onto the money for ages.

The changes in banks over the last ten years are really quite disturbing.

Steve

I did mention it on another thread - although that might have been on a different forum and not this one but to provide a brief overview:

I think I opened my bank account with them in c2019/20. The money in the account has steadily grown via rental income (paid directly into the account by bank transfer by the company managing the rental). I use a separate bank account for each property and this property has no mortgage so the amount had steadily grown such that by around the end of last year there was c43k Euros in the account. The bank doesn't pay interest on cash balances so I, through online banking transferred c40k Euros to an alternative provider who did.

Then, about 2 to 3 weeks after the transfer, the bank I had transferred the money out of contacted me and asked me to provide proof of funds. (I thought that would more likely come from the receiving bank but no). I told them it came from rental income which you can see in the bank statements as it's all gone in by direct credits (i.e. no cash).

They didn't like that - so came back asking me for my tax return. I told them no. They then asked me for my P60, I told them no. They then notified me they would be closing the account in 3 months time.

The day after, I spent about 30 minutes moving various DDs that are paid from that account to a new provider and transferred the residual balance out. I then closed the account there and then.

[the0ni0nking]

(Onionking, might one of your accounts have been non-UK?) They refused to tell us more, although we implored them for details. And we'd been with them for forty bloody years! Apparently banks can close down any account they like, for any reason they like. As Farage found out.

Since this was a "service account" (actually it was the non-profit shared maintenance fund for an apartment block, with less than £1,000 in the collective kitty), it took us some time to cut throught the flannel and discover that our bank, like several other banks, was simply getting rid of these accounts because they weren't making it enough money. This account had never been in debt - indeed, it was not constitutionally allowed to be in debt! - so it didn't fit the corporate drive for profitability.

It transpired that the whole property management industry was/is having the same problem. Even fairly large freeholders and property managers were having the rug pulled from under them. And here's the twist - freehold managers are legally required to hold these service accounts! So doing nothing was not an option. We could have been sued for not having one.

Fortunately, a quick search showed that there were two or three banks still doing these accounts. Within a week, one of them had been asked to take over all of our little company's six-figure asset bank accounts. We don't stay where we're not welcome.

BJ

Yes indeed - as outlined in my reply above the bank account I had closed on me was in Spain.

I'm also a director of a company that looks after the maintenance of a converted apartment block - as there are only 4 flats, we used to make each owner of the flats a director of the mgmt company. When; in our case; Barclays did a check around KYC they found the 4 directors listed on CoHo but found they only had KYC info on me.

None of the other owner/directors bothered to reply to requests from me to provide this detail to Barclays and so Barclays said they would close our account if they don't get the info they need within 3 months.

To avoid me having the hassle of having to sort a new bank account out, I told the fellow directors if you can't be bothered providing the intel Barclays request, I'm going to resign you all as directors so that CoHo (now 1 director) would align with what Barclays wanted. This I did and when it all was filed at CoHo, Barclays then were happy and didn't close the account!

Madness really as despite the others being directors, I am still the only one with signing authority etc which you'd think would be most important i.e. having people on the mandate aligns with their KYC info but no; they also check CoHo for directors/25% shareholders and want their info even if they can't do owt on the account.

[Lootman]

I think I opened my bank account with them in c2019/20. The money in the account has steadily grown via rental income (paid directly into the account by bank transfer by the company managing the rental). I use a separate bank account for each property and this property has no mortgage so the amount had steadily grown such that by around the end of last year there was c43k Euros in the account. The bank doesn't pay interest on cash balances so I, through online banking transferred c40k Euros to an alternative provider who did.

Then, about 2 to 3 weeks after the transfer, the bank I had transferred the money out of contacted me and asked me to provide proof of funds. (I thought that would more likely come from the receiving bank but no). I told them it came from rental income which you can see in the bank statements as it's all gone in by direct credits (i.e. no cash).

They didn't like that - so came back asking me for my tax return. I told them no. They then asked me for my P60, I told them no. They then notified me they would be closing the account in 3 months time.

The day after, I spent about 30 minutes moving various DDs that are paid from that account to a new provider and transferred the residual balance out. I then closed the account there and then.

Asking for a P60 makes no sense since this is rental income from an individual, who quite rightly has no need to issue tax documents.

Asking for a tax return makes little more sense. Quite apart from the fact that that is a confidential document, it would not necessarily exist at the time of the request, since it typically is only prepared well in arrears. And for that matter it would not be hard to "mock up" a tax return telling them whatever you want

The time for them to have quibbled was when you were making the deposits and not much later when you are withdrawing the funds. That it was the latter just shows how dishonest the bank was being about its motives. This would have been a good meeting to have had in person - I would greatly enjoy demolishing every argument this odious little clerk was throwing at me.