TalkTalk is investigating whether its customer database has been leaked after more than 100 customers said they had received calls from Indian-based scammers quoting their names, addresses and account number details.
Suspicions have been raised that a data leak could have come from a call centre used by TalkTalk in India, although the UK internet service provider, which has more than 4 million customers, said it had “no concrete evidence of a data breach” from any of its systems.
A number of customers in TalkTalk forums said they had been contacted in the past fortnight, apparently from India, by callers who quoted their TalkTalk account details to try to assuage doubts about whether the call was legitimate.
A similar scam earlier this year targeted BT Broadband customers, with scammers also quoting account numbers.
One person said on TalkTalk’s forums they were nearly caught out because of the data that was supplied: “[The] caller was obviously from India and his English was poor. [He] claimed he was from TalkTalk and when I queried this he reeled off my account number plus name and address.” Others on the forum confirmed their account details had been provided in the call.
The account number is not publicly available information – though it is held on TalkTalk’s systems and is used in customer support.
A spokeswoman for TalkTalk said there were other ways the scammers might have acquired the account numbers, such as through phishing emails, but she could not say whether TalkTalk had seen any phishing emails recently that would explain the abrupt surge in calls accurately quoting data.
If TalkTalk’s customer data has leaked, it could potentially be liable to a fine under the Data Protection Act for failing to secure personal information – a requirement for British companies even if they store or process data overseas.
The Information Commissioner’s Office said it had been informed TalkTalk was investigating the source of the account details.
TalkTalk is asking customers who have received calls to contact its online scam report page at www.talktalk.co.uk/help/report-scam.
The use of call centres in India for both remote telephone support of legitimate businesses, and for making scam calls of this sort, has long led to suspicions that customer details are leaked by unscrupulous workers or managers to the gangs who run the scams.
The Guardian has reported on this long-running problem previously but there has been limited action against it by the authorities in India, with few arrests. Last year the US Federal Trade Commission froze the US bank accounts of a number of individuals and businesses based in India, though that seems to have had little impact
Once the cold-caller has the customer’s confidence, they begin a spiel in which they try to persuade the user that they are from support and have been notified that the user’s computer has “viruses” or is “downloading malware”, and that the support call will fix it. As “proof”, the scammer directs the customer to a particular program on Microsoft Windows which shows the normal working of the system, and persuades the customer that this actually indicates a problem.
The scammers then persuade the customer to download a program that gives them access to their computer, “fix” the problem and charge them for it via credit or debit cards. But in fact the machines are operating normally and the “fix” can harm the computer, or install viruses, spyware or illegitimate software.
A TalkTalk spokesperson said: “Every year countless people are targeted by phone scammers. This is a growing problem across all sectors and unfortunately TalkTalk and other telecommunications companies are not immune. We know some customers are currently being targeted by malicious scammers claiming to be from TalkTalk who have obtained their account and phone number. We urge customers to be alert, especially when asked for personal details or remote access to your computer, and not to give any more details over the phone. We encourage any customers who have been targeted by this scam – or indeed any scam where fraudsters are claiming to be from TalkTalk – to hang up and contact us so that we can help to catch them. They can do so by calling us or by using our online scam reporting form.”
guardian.co.uk © Guardian News and Media Limited 2010