Here is how anyone can take money from your bank account without your permission

Debit order fraud is rife in South Africa, and has been so for a while.

According to a 2014 report by Carte Blanche, banks receive an average of 200,000 disputes from customers with regards to “mysterious debits” – usually amounts below R99 – every month.

Call centre agents needing to make commission, unethical companies, and criminal elements are all initiators of fraudulent debit orders, which often go unnoticed by those who don’t regularly check their banks statements.

I was a victim of a form of debit order fraud recently, and wanted to share the experience with other bank account holders – from first noticing the transaction, to asking my bank to help me stop this from happening in the future.

R60 for TransUnion what?

On the morning of 13 June I received an SMS from Standard Bank that R60 had been deducted off my account. The transactions was a TransUnion “service agreement” through Sage Pay.

I phoned the bank to query the debit, and told the consultant I spoke to that I suspected it was fraudulent.

The consultant told me the transaction can be reversed, and that Standard Bank can investigate who instituted the debit. I would have to pay R22 for this investigation.

I asked for the bank to investigate, and a day later an SMS was sent to me with the “company details”: Sage Pay, and a general contact number.

Sage Pay was listed in the initial notification I received, and on my Internet banking statement, and the contact number was available on Sage Pay’s website.

I contacted Standard Bank, and was told the provision of the contact number was the extent of the investigation. I then asked for the transaction to be reversed, which they processed.

Sage Pay just a channel

After requesting the payment reversal I contacted Sage Pay, which informed me that they processed the transaction on behalf of TransUnion. A consultant gave me a reference number and a contact number for the company.

TransUnion

While dealing with Standard Bank and Sage Pay consultants was a smooth process, I hit my first hurdles with TransUnion – a company which conducts credit checks and produces credit reports for customers.

I explained the situation to a TransUnion consultant, who asked for my ID number, cellphone number, and address.

She told me that a credit check had been conducted through my “TransUnion profile” online, which cost R60, but could not help me any further as the cellphone number and address I provided did not match what she had on the system.

I informed her this was because the profile was fraudulent, and someone had created it without my permission. After saying she was unable to help me any further, I asked to speak to her supervisor.

I held the line for about a minute, after which the consultant came back on and told me that TransUnion was aware the transaction was fraudulent, and the company was investigating it.

Please help me Standard Bank

Following my contact with TransUnion, I phoned Standard Bank to try and ensure this type of transaction did not happen again.

It took some time to find the right person to speak to, as the consultants I dealt with said there was no specific department in the bank which deals with debit order fraud.

I eventually spoke to a general banking agent, and explained what had happened.

I asked if Standard Bank could implement a notification system on my account, where I am contacted and asked for authorisation if a new debit order tries to take money from me.

The consultant told me that system does not exist, after which I asked to speak to her supervisor.

I explained to the supervisor that when I use my debit card at a point-of-sale, I have to produce a PIN along with the card. When I use my credit card online, I must have the card number, the CCV number, and submit a one-time-password which is sent to my cellphone.

Yet with a debit order or service agreement there is no interaction between me and the bank.

A third-party can submit a debit order to the bank with the relevant details – person’s name, ID number, and bank account number, according to a TransUnion employee – and deduct money without the bank asking me if I have given permission for the transaction to take place.

Surely Standard Bank can call me, send me an email, or SMS me stating: “TransUnion has submitted a debit order for R60, Do you approve it?”. I would be willing to pay for this service, I added.

The answer is no.

The supervisor told me that Standard Bank cannot do this, as it would be “difficult”.

Standard Bank and TransUnion respond

Seeing as I had reached a dead end, I decided to contact Standard Bank through its media channel – informing them I worked for MyBroadband, and explaining the situation. Up until then I had only interacted with the companies as a client.

The bank’s employees who assisted me following the media query contacted TransUnion to try and get to the bottom of the issue. They also assured me my R60 debit and R22 investigation fee would be refunded.

I declined the refunding of the R22, but both amounts have subsequently been deposited into my account.

Their official response, in short, was that it was my responsibility to check my account regularly and report suspicious activity.

“Banks act as a payment mechanism where such debit orders get presented for payment. The onus is on the account holder to regularly scrutinize his/her account statements and bring to the bank’s attention any such unauthorised entry,” said Standard Bank.

“There is a process regarding the reporting and reversing of any unauthorised debit order, which needs to be done in person at the nearest branch.”

Standard Bank added that the SA Reserve Bank in conjunction with the Payment Association of South Africa are developing an “authenticated debit order system” that will give customers greater control, but provided no further details.

Feedback from TransUnion was also provided by the bank.

They said an account was created on TransUnion’s website as the fraudster had “full access” to my personal information – by which the company meant my ID number, name, and bank account number.

The residential address and cellphone number used were not mine, but that did not stop the perpetrator passing TransUnion’s security checks. The registration of the account was also fraudulent, but TransUnion said they could not close the account – only update it with my correct details.

They suggested perhaps my wallet had been stolen, containing the aforementioned information.

The company said the matter is being investigated by its fraud department, and the IP address and cellphone number of the perpetrator would be loaded onto its fraud database.

Until the next time money is taken from my account

I do not hand out my personal information unless it is necessary, my wallet has not been stolen – as TransUnion suggested – and I am secure in all my financial transactions.

The money taken from my account was not substantial – R60 – and pursuing the companies involved to rectify it was only worth my time as I planned to write an article about the incident.

I also had the luxury of dealing with the companies’ media liaisons – organisations are very helpful when they find out you are a journalist.

It should be noted that when I contacted Standard Bank as a “regular customer”, everyone I spoke to was extremely professional, polite, and as helpful as the systems they worked in would allow.

For most people, though, multiple days of phone calls and emails to chase R60 is not worth their time, or they simply don’t have the time to do it.

The burden of proof with regards to a fraudulent debit order is also set on their shoulders, despite the fact they may have done nothing wrong.

Is it unreasonable to ask your bank to help stop fraud and protect your money? The answer, it seems, is yes.

More on banking

Standard Bank to launch Apple Watch app

FNB rolls out NFC credit cards

Watch out for these card skimming and PIN theft tricks criminals use