My O2 account was hacked!

[Anonymous]

A couple of weeks ago I received an odd text from O2 informing me that I can upgrade my handset in September 2013. Now, I have a sim-only contract and haven't had a new handset from O2 in a number of years but I knew my contract was due to expire some time in late September so I checked my O2 account online. It seems that I now have a new tariff of £36 a month, which I knew nothing about and checking on down the page I spotted a completed order which turned out to be for an iPhone 4. Naturally I hadn't placed this. The Yodel tracking number revealed that it had been delivered to an address that wasn't mine the previous day.
I called O2 and discovered that my security question had been changed along with my home address and e-mail address. Someone had clearly managed to access my O2 account online and ordered himself a phone at my expense. Since the user name and password are known only to me, either O2's site security is extremely poor or someone inside O2 has accessed my information. Either way, I'm not impressed.
The customer service adviser was very helpful and promised that the fraud department would investigate and call me. However, eight days later I have heard no word from them and in the meantime I can do nothing about changing my contract while there is an issue with my account. I was planning to get a new phone, possibly the new iPhone when it comes out, but now I'm very concerned about O2's security. I've been with them for over ten years but I'm seriously considering whether I want to continue with them now.
The only piece of good news is that the phone was delivered one day and blacklisted the next.
Has anyone else had this happen? If so, how did O2 handle it?

[Anonymous]

I think its far more likely that the security issue is at your end. But you'll need to wait for the fraud people to do their job. It will take longer than eight days though. Probably much longer if they need to liaise with courier, police etc.
In the mean time it would be a good idea to check your security procedures as your info is already 'out there' . Both real world and computer. Also check your credit report in case you have been signed up to anything else. You bank can give you advice on protecting yourself (ask them about CIFAS).

[Anonymous]

This exact same thing happened to me last Saturday.
If only I could get hold of the thieving get!!! :robotmad:

[Anonymous]

I think its far more likely that the security issue is at your end.

I'd like to know how. My computer is only accessible to me and my user name and password are not written down or stored anywhere. Other than the O2 site being less than secure, I can't imagine how anyone could obtain my details.
After complaining that I hadn't heard from the fraud department I was told that they had tried to contact me on the 27th. This was not true; I'd had no missed calls, even from withheld numbers. When they did contact me the next day, they informed me that it was possible someone had blagged his way past the security measures by calling with little more than my name and telephone number. I'm not sure how true that is, but if it is, it doesn't say much about their security.
After a round of issues with billing and a retention adviser who deliberately tried to mislead me, I've jumped ship. I was with O2 for over ten years and now I have the new iPhone on another network. I hope O2 can afford to lose customers who are prepared to commit to that kind of outlay.

[Anonymous]

I was told to expect a reply within a week, if my case is fraudulent.
I didnt want to move away from o2 because I l;ike the perks you get with concert gigs, but this isn`t good enough.
I`m now stuck with a £36 x 24 month contract until this is resolved.
Great.
Eddie

[Anonymous]

I received an email from O2 today confirming my upgrade order but as I had made no such order I telephoned them. The guy I spoke to was very disbelieving assuring me no-one could have made an order without my security information and that they could only have got this from me. After a very heated debate I thought to ask where the phone was being sent to and it turns out my address had been changed - the phone is due to be delivered to Essex, I live in West Sussex. I am sure it is someone within O2 that has done this - I cannot see how anyone else could retrieve such information. I am furious that I now have to wait up to three days for the fraud department to contact me. In fact I was so furious I contacted the nearest Essex police station to the address for the order and explained what had happened but guess what - they won't do anything until contacted by O2. Even though I have given them the address the phone is due to be delivered to they won't do a flippin thing. I am considering driving to the address myself and confronting the thieving ......! Its a disgrace and I have sent an email to Watchdog about what seems to be going on at O2 and hope they will pick up the story. Tomorrow I will have to go to my bank to ensure O2 are not able to take the £37 a month the phone costs from my account and unless I drive to Essex don't see there is anything more I can do.

[Anonymous]

Adept and Karen, It doesn't need to be done on your computer, nor is it likely that it is someone at O2. The trouble with identity theft is that the perpetrators are pretty good, you have only to see an ep of The Real Hustle to see how easy it is for them.
For example, if you bin your mail, they could start with your name and address , if you have used public wifi they can read all your emails, including any that are from O2, there are just so many ways they can exploit that it's a mistake to assume anything about how it "must" have happened. That's why the mobile networks have dedicated fraud teams, they all suffer from this.
In my paranoia I never bin anything until its shredded, but I'm sure there are other ways they can get me too

[Anonymous]

Beaufighter - I am absolutley meticulous with my security - I have no paper bills from O2 and always shred anything with any of my personal details on and have never used public wifi. As an update on my case - I have been spoken to this morning by O2's fraud department who have been extremely hepful and have cancelled delivery of ths phone. They have also informed me that this order was made over the telephone and that three or four attempts were made to access my account yesterday before they were finally successful. Well, I'm sorry but that is disgraceful - something should have flagged something up to someone and the fraud guys agree. To try that many times and then be able to change security settings and my address is completely unacceptable in the world we live in. I had a fraudulent attempt on a credit card a while ago and M&S rang me immediately to check a transaction as it was out of my usual spending pattern - surely O2 can install similar systems so after one unsuccessful the account is locked out until the mobile number is telephoned and checked. If M&S can do it I am sure O2 can. So Beaufighter I'm not saying this can never happen but I am saying more should have been done by O2 who could and should have prevented this particular case.

[Anonymous]

I don't disagree, and to be fair you have posted something that I was wondering about earlier but couldn't edit in to my post thanks to forum problems. That something was the thought that it may have been accessed over the phone through an agent trying to be misguidedly helpful, or not caring at all. This is borne out by the fact that three agents did turn them away previously. These agents were doing their job and would have noted the account. The details of the call where access was granted will be recorded on the system and that would be basis of my complaint if I was you.

[perksie]

Hopefully the fraud team will get to the bottom of what's gone wrong here in regard to Karen10.
Perhaps you'll let us know how you get on.