My O2 account was hacked!

[Anonymous]

A couple of weeks ago I received an odd text from O2 informing me that I can upgrade my handset in September 2013. Now, I have a sim-only contract and haven't had a new handset from O2 in a number of years but I knew my contract was due to expire some time in late September so I checked my O2 account online. It seems that I now have a new tariff of £36 a month, which I knew nothing about and checking on down the page I spotted a completed order which turned out to be for an iPhone 4. Naturally I hadn't placed this. The Yodel tracking number revealed that it had been delivered to an address that wasn't mine the previous day.
I called O2 and discovered that my security question had been changed along with my home address and e-mail address. Someone had clearly managed to access my O2 account online and ordered himself a phone at my expense. Since the user name and password are known only to me, either O2's site security is extremely poor or someone inside O2 has accessed my information. Either way, I'm not impressed.
The customer service adviser was very helpful and promised that the fraud department would investigate and call me. However, eight days later I have heard no word from them and in the meantime I can do nothing about changing my contract while there is an issue with my account. I was planning to get a new phone, possibly the new iPhone when it comes out, but now I'm very concerned about O2's security. I've been with them for over ten years but I'm seriously considering whether I want to continue with them now.
The only piece of good news is that the phone was delivered one day and blacklisted the next.
Has anyone else had this happen? If so, how did O2 handle it?

[Anonymous]

Guess im not alone same things happened to me looks like 02 are being targeted seems to be people due upgrades

[Anonymous]

I received an email from O2 today confirming my upgrade order but as I had made no such order I telephoned them. The guy I spoke to was very disbelieving assuring me no-one could have made an order without my security information and that they could only have got this from me. After a very heated debate I thought to ask where the phone was being sent to and it turns out my address had been changed - the phone is due to be delivered to Essex, I live in West Sussex. I am sure it is someone within O2 that has done this - I cannot see how anyone else could retrieve such information. I am furious that I now have to wait up to three days for the fraud department to contact me. In fact I was so furious I contacted the nearest Essex police station to the address for the order and explained what had happened but guess what - they won't do anything until contacted by O2. Even though I have given them the address the phone is due to be delivered to they won't do a flippin thing. I am considering driving to the address myself and confronting the thieving ......! Its a disgrace and I have sent an email to Watchdog about what seems to be going on at O2 and hope they will pick up the story. Tomorrow I will have to go to my bank to ensure O2 are not able to take the £37 a month the phone costs from my account and unless I drive to Essex don't see there is anything more I can do.

ive had same thing happen to me the clerk has cancelled all direct debits and they are currently doing the fraud stuff right now, im wondering if any of you have had any problems with bank accounts etc as im thinking they might have our bank details too

[Anonymous]

I don't disagree, and to be fair you have posted something that I was wondering about earlier but couldn't edit in to my post thanks to forum problems. That something was the thought that it may have been accessed over the phone through an agent trying to be misguidedly helpful, or not caring at all. This is borne out by the fact that three agents did turn them away previously. These agents were doing their job and would have noted the account. The details of the call where access was granted will be recorded on the system and that would be basis of my complaint if I was you.

i was told they tried 4 times in one day on my account before becoming succesful tbh i think there should be a number system where over the phone the customer has a pin sent to the account they must quote if they dont quote that pin at all they are refused service. im dumbfounded how this has even happened at all and im notcing the trend its those due an upgrade

[Anonymous]

To sjcrows - I honestly don't believe this - they tried the same amount of times before gaining access to my account and all tries were on the ame day! How on earth can someone not have seen that there had previous attempts to access my account and not locked the account until further checks were made - all they had to do was make one phone call to me on my mobile for confirmation I was trying to upgrade my phone and all this could have been avoided. Wants even more incredible is that having gained access to my account on the 4th attempt they were able to change my address and security questions. I am alos concerned about personal information O2 may have given away during these four phone calls and am considering taking advice with regard to O2 breaching the Data Protection act.

[Anonymous]

The iPhone I supposedly ordered from O2 was also delivered to an address in Essex - 16 The Ave, Loughton, Essex IG10 4PT to be precise. But I don't live anywhere near Essex. In fact, I live in Northern Ireland so I doubt someone has travelled over here to spy on me and acquire my details, then flee back over the Irish Sea to Essex to get himself an iPhone at my expense.
Like karen10 I have never dumped my bills or used public wi-fi. I only use my own computer over my wi-fi, with the higest possible security settings and encryption. And anyway, isn't the O2 site supposed to be secure? If the people involved can access our accounts shortly before the end of the contract period, it seems clear that they have information regarding more than our names, addresses and telephone numbers. I don't know if I believe that it is someone inside O2 as they would have total access to our details and therefore would not need to bluff their way through security but there is definitely a serious lack in security.
After I had resolved the issue with the fraud department and switched network, O2 continued to charge me for insurance on the iPhone. Why on earth would someone steal an iPhone and order insurance for it as well? When I called to report this, I was offered credit on my account to cover it. I pointed out at the time that credit would be no use as I had left but the adviser assured me that it would work out. I assumed that this would come off the bill and accepted his word.
Needless to say, it was only credit against further bills, but I had left O2 so I wouldn't get any more bills, right? Then I got a bill. Because my contract had been renewed just before I left (but not by me if you recall), I was hit with a cancellation fee for two years at my old tariff. My new bill was over £200.
Thankfully the matter was resolved quickly and I now owe O2 nothing. For the moment anyway. I'm with Vodafone. I hope I never have the kind of bother with them that I've gone through with O2. We'll see how it works out. But I have a friend who works pretty high up in Vodafone so I have a hotline to sort any issues out. He even got me discount.

[Anonymous]

Hi all, I was very interested to find this forum thread.
I've had my account repeatedly hacked and infiltrated for 3 years now. 02 have done next to nothing about it and only act if I prompt them.
If anyone has advice on where I should go to get external help, I'd really appreciate it.
I just want more rigorous security measures put in place for my account and for someone to reassure me that my sensitive data is safe in their hands; I'm not after any compensation, just security.
So far I've contacted OfCom, The ICO and Consumer Watch. All are very sympathetic but none are able to assist.
Any help, advice or similar experiences would be welcome.
Thank you.

[Anonymous]

Your o2 details are only as safe as you make them.
If you've had your account 'hacked' 3 times then I'd take a good look at how strong your password is, what you do with, if any, paper bills/letters etc you throw out, what you've been revealing to people you may have though you can trust etc.

[perksie]

This is not true in all cases, people have passed security with as little as a name and phone number.
While O2 allow phones to be delivered to alternative addresses, and orders placed without the security procedures being followed, these frauds will continue.

[Anonymous]

It isnt policy to allow this kind of access though. O2 has a rigid data protection policy. Sadly no kind of policy can compensate for lazy, disinterested operatives 😞
These are few and far between though, thankfully, and call monitoring weeds them out when they do appear,although this, by its nature can only be discovered after the fact and so it is too late for that customer, so, for someone to have had their account hacked repeatedly the cause has to be closer to home.

[perksie]

I know it's not policy, unfortunately though it is happening, even in cases where external access to details has been virtually impossible.
I hope it's as rare as you believe it to be.