Banking / GDPR breach?

[Katyrosebug]

But of background, 8 moved back to the UK about 2.5 years ago, my friend helped me set up a bank account as I didn't have a UK number at the time and it was just easier to use her number etc.. I don't have any issue with this and trust her implicitly. We changed the the number on the account to mine when I was sorted about 1 month later and never had issues since

So today, friend calls me and tells me for 3 months she's been getting bank alerts from the bank, she doesn't have an account with them and assumed it was fraud. She decided to call them to report it just incase as she had an account with them years ago. With my bank you have to use your voice as your password, this then authorises who you are and puts you through to an advisor. She used her 'voice' and then got through to an advisor.

The advisor was telling her about up and coming direct debits and also transactions from this week, obviously my friend didn't recognise them at all, it was at this point she decided to check that bank had the correct person and as it turns out it was my account!

As I said, I'm lucky it was my friend and not someone trying to access my account. From that point onwards obviously the advisor wouldn't speak to her and told her is was a problem as in the breach as that should happen.

I called them 18 minutes later (I know this as the advisor I spoke to told me), I asked how that could happen, he first told me it was because her mobile number was linked which I xojkd understand if they'd then asked d.o.b address etc.. But it was the voice is my password that she used.
I've taken her number off now which we thought it had been originally. Anyway, I asked how this was possible, at first he denied that's how she'd come through then must have seen it was and his explanation was that our voices must sound the same 😐

Thankfully no hame done, it's been sorted now, strange how the banking alerts have only happened for the last 3 months by there we are.

The more I've thought about this to more angry I've been. I do understand her mobile was linked but that still shouldn't let her go through with the voice password should it? Do I email and complain about this?

Yes, complain. It shouldn’t have happened and could be a risk.

And they may offer compensation, the size of which may help you gauge how large the risk was

I think I'm going to, I'm doubting myself because her phone number was registered, obviously not her voice

This is concerning. Lots of people change numbers and often their old number gets assigned to a new person. This shouldn't have happened if you changed the number on the account.

Even if I hadn't of changed the number, she still managed to get through with the voice activation thing which she's never done on my account as it was set up with my voice. There were also 2 landline numbers on it that neither of us recognised

Assume this is first direct. Personally I couldn't bank with somewhere that had such lax security and can't manage to delete a phone number when you initially told them to. I'd move elsewhere and I'd also complain, they need to up their security.

I think you need to raise it OP, but.. did your friend without remembering perhaps set up her voice as the password on the mobile number in question perhaps?

It's still wrong as without power of attorney or similar one account should equal one voice (two if it's joint) so I'd complain but wonder if this is what's happened.

It's a relatively new thing but if you call from the mobile number registered that's part 1 of verification. The voice id though shouldn't have worked unless she is registered on your account for voice id.

Op it is your responsibility to make sure your numbers are up to date and remove any that are not. Realistically you should have gotten a uk number first before setting up a bank account and this could all have been avoided.

However you probably should complain so that they can investigate it.

It's a big red bank that being's with S. I understand about the removal of the phone numbers, we're sure this happened, the day I got picked up from the airport my brother had a phone and aim sorted for me and we started to change things.
She 100% didn't do the voice thing, I remember doing it when I arrived, all the letters for the bank had been left unopened as well so I know she hadn't gone through them. I'm very lucky it was just her, I also totally get the number on the account, but not the voice is my password bit, to also be told that it's because we have similar voices by the advisor doesn't cut it with me, like someone said up thread, it's very lax and concerning.

Email has been sent anyway, my friend wrote what had happened and then I added to it and sent it. Luckily the calls are recorded so they can go back and listen in

To add, I was out of the country at the time getting my ducks in a row to escape an abusive relationship, sorting things out and getting ready was keeping me occupied. I had a job lined up and they needed account details which is why she set it up for me, 4 weeks before my return