Fraudulent ticket purchase

[Merseysider]

At 18:31 last night (14th April) I received an email from the Trainline containing details of a ticket I had supposedly purchased, from Lincoln to London at £48. The nominated journey was 1925 off Lincoln (EMT) and VTEC from Newark NG.

The payment method was my own PayPal Credit account which is linked to my Trainline account. I have this set up as a backup to my normal account with TPE - I rarely actually use it

I notified PayPal, who blocked any further transactions until Photo ID is provided. They agreed to dispute the transaction and investigate but in the early hours of this morning emailed back:

We’ve investigated your unauthorised payment claim.

We've reviewed your account and we’re satisfied that your account is secure and there is a consistent history of payments. We were unable to find any indication of access by a third party. For this reason, we're unable to proceed with your unauthorised payment claim.

If a product you purchased never arrived or is significantly not as described then you may be able to open a dispute in the Resolution Centre and be covered by our Buyer Protection.

...so I asked them to escalate it, given that the above response was sent at 05:48 and there's no way in hell they've conducted an adequate investigation in that time.

I logged into my Trainline account and chose the 'Refund booking' option but that didn't tell me whether the tickets had yet been issued and I won't know whether the refund was successful until up to 4 days have passed. I asked Trainline to inform me of if/when/where the tickets were/are collected from, and obtain IP details of the transaction/login if possible.

I notified Merseyside Police (I live near Liverpool) and will probably notify Lincolnshire Police later on today. I also filed a report online with ActionFraud and have a CRN from their website.

I gave EMT on Twitter the collection reference the order was allocated in the hopes that they could do something simple like instruct LCN not to issue the ticket order, but their Twitter team was less than helpful.

I've changed all my passwords, security info etc. Is there anything else I haven't thought of yet or should do to better my chances of getting the money back? And how the hell was somebody able to gain access to my TL account and PayPal simultaneously?

Thanks in advance

 

[paddington]

The payment method was my own PayPal Credit account which is linked to my Trainline account.

What is a "Paypal credit account"?

If Paypal's resolution is unsatisfactory then you can ask the card company to do a chargeback. (This is why you should not keep any balance in Paypal)

Also for this reason I usually close my paypal account if I'm not using it for any significant period. It is very little hassle to reopen an account if you need it again.

Is there anyone else who may have watched you use the paypal account recently, or have you logged in anywhere else recently?

 

[Agent_c]

What is a "Paypal credit account"?

If Paypal's resolution is unsatisfactory then you can ask the card company to do a chargeback. (This is why you should not keep any balance in Paypal)

Also for this reason I usually close my paypal account if I'm not using it for any significant period. It is very little hassle to reopen an account if you need it again.

Is there anyone else who may have watched you use the paypal account recently, or have you logged in anywhere else recently?

Think of PayPal credit as being PayPal's version of an authorised bank overdraft.

 

[Merseysider]

What is a "Paypal credit account"?

If Paypal's resolution is unsatisfactory then you can ask the card company to do a chargeback. (This is why you should not keep any balance in Paypal)

Also for this reason I usually close my paypal account if I'm not using it for any significant period. It is very little hassle to reopen an account if you need it again.

Is there anyone else who may have watched you use the paypal account recently, or have you logged in anywhere else recently?

PayPal Credit is a credit facility offered online, whereby PayPal purchases on eBay, Trainline etc can be paid off at the end of the month, rather than immediately.

This means that funds haven't been taken from my bank account yet - but I'll be expected to pay if off at the end of the billing cycle.

I haven't been to Lincoln in over 6 months, and I'm not aware of any device through which I've accessed PayPal/TTL other than my phone and laptop, which makes it even more bewildering.

 

[yorkie]

If they accessed your email account and that had details of your PayPal & Train line accounts, and if they were the same password as your email account, that could explain it

Though the next question would be how they gained access to your email account

If you are registered on any website with your email address and the same password as your email account, then you are at risk if the website becomes compromised

 

[Quakkerillo]

You can check here: https://haveibeenpwned.com/
To see if any of your e-mails / account names are found on any data leaks / breeches from many websites. If it's on there, it could just be that someone abused that information to gain access to and use your accounts to buy train tickets.

 

[Merseysider]

I'll get back later on today to any additional points raised; preoccupied in London at the mo. Rang TTL who informed me that the tickets had not been collected; I had cancelled them just in time last night The lady I spoke to did however inform me that TTL will not be refunding me the £10 "admin" fee so I'm gonna chase that up later too. Thanks all for your advice so far

 

[najaB]

...so I asked them to escalate it, given that the above response was sent at 05:48 and there's no way in hell they've conducted an adequate investigation in that time.

That's the better part of 12 hours which is long enough to see if your account has been accessed from any 'odd' (e.g. Russian) IP addresses, or if it's been used for any unusual purchases. I'd be surprised if the escalation produces a different result (though, obviously, happy for you if it did).

 

[transportphoto]

Rather notifying two Home Office forces, Jake, isn't this something BTP would pick up on?

 

[Merseysider]

Rather notifying two Home Office forces, Jake, isn't this something BTP would pick up on?

I'm afraid that I don't see what difference it makes, whether or not a police force answers to the Home Office? Genuine question, not meant dismissively.

EMT and Trainline told me to contact BTP, and PayPal told me to contact regular police. I can't not do as instructed

 

[transportphoto]

I was thinking more along the lines that BTP have national jurisdiction/coverage, rather than you reporting it to Merseyside and they then having to liaise with Lincolnshire. One would hope that the same result is achieved, of course.

 

[Merseysider]

I was thinking more along the lines that BTP have national jurisdiction/coverage, rather than you reporting it to Merseyside and they then having to liaise with Lincolnshire. One would hope that the same result is achieved, of course.

Yes, I can see your point actually - thanks.

 

[Puffing Devil]

Sorry to hear of your troubles.

PayPal are a real pain for adding continuous charging authorities when you process some payments - this leaves you exposed when an account is compromised and PayPal needs no further approval to process a payment. I'd advise you to check your account for any of these agreements and stop them.

Next steps - turn on multi-factor authentication for all you accounts that support it - PayPal does. Think also about using a password manager to capture and change all of your passwords to new, secure, password. LastPass is good, though has had a couple on minor wobbles recently. I still use it.

Don't store passwords in your browser or in your phone. Use a password manager - it may be less convenient - there is a price to pay for increased security.

 

[Andrew1395]

I would ask Trainline if they are able to confirm that all their retail systems are PCI data security standard compliant. If they cannot give a categorical guarantee that they are, then it's an admission that their systems store personal details that make them more liable to be hacked. I would then ask them to refund the money and I would then stop using their sales portals.

 

[Lincoln]

Sounds like as well as changing your passwords you should also consider using Two Factor Authentication. That way only someone with direct access to your phone can illicitly log in to your account in future.

https://www.paypal.com/us/webapps/mpp/security/security-protections

https://en.m.wikipedia.org/wiki/Multi-factor_authentication

I enable this on everything I can as I enjoy the peace of mind that it makes my accounts that little bit more difficult to hack (never say impossible!!).

Hope it gets resolved for you.

 

[Merseysider]

PayPal have refunded the transaction as "upon further investigaton" it was "indeed fraudulent".

I can't be arsed risking this happenng again so both accounts are being closed.

Thanks to all above for your input. I'll update finally in due course at a more timely hour of the day.

Predictably, Trainline were completely useless.

 

[221129]

I was thinking more along the lines that BTP have national jurisdiction/coverage, rather than you reporting it to Merseyside and they then having to liaise with Lincolnshire. One would hope that the same result is achieved, of course.

Every force has national jurisdiction. I would expect BTP to just pass it on to one of the Local forces as they probably aren't best suited for dealing with this sort of thing.

 

[Hadders]

I really can't see the police doing anything about this, they haven't got the resources and it's not a priority for them. They will just tell you to log it with Action Fraud, who will do absolutely nothing.

 

[island]

There is no point whatsoever in logging anything with InAction Fraud.

 

[Merseysider]

There is no point whatsoever in logging anything with InAction Fraud.

Ah, so they're the Transport Focus of the consumer industries then.

 

[Hadders]

Ah, so they're the Transport Focus of the consumer industries then.

No, far worse! (I know you didn't think that was possible)

 

[Peter Mugridge]

I thought Action Fraud was, in any case, only concerned with online phishing attempts and similar and not "everyday" non-internet fraud?

 

[talldave]

I thought Action Fraud was, in any case, only concerned with online phishing attempts and similar and not "everyday" non-internet fraud?

Since they do nothing, it's an acedemic point as to the scope of issues they'll do nothing about!

 

[island]

Since they do nothing, it's an acedemic point as to the scope of issues they'll do nothing about!

Quite!