Trainline.com assisting TOCs with fraud investigations

[Doubleplus]

What we're talking about here is where people buy tickets for short journeys to get through barriers; these could cost a tiny fraction of the actual ticket price. Then they have a much more expensive ticket for the actual journey made, which they fradulently claim a refund on.

Doughnutting isn't easily represented by analogies for other scenarios; there isn't really a comparison with any other industry that I can think of. The Halfords analogy doesn't work for this at all.

In fairness I think the question is rather wider, the general question of whether Trainline are 'assisting' with fraud investigations by examining passengers' travel details (whatever they may be - wrong railcard, short faring, wrong type of ticket, wrong time of day, etc) and proactively bringing those to the attention of their commercial partners, rather than having been legally required to disclose such information after the detection of an irregularity.

One thing for XYZ Railway Operating Company to approach the Trainline and say "We have reason to believe that Person X who purchased a ticket from you has done so in an illegal manner and we therefore require all the information you hold about this person so that we may determine if it has happened before", and for Trainline to say "Our whizzo database has identified 180,000 possible irregular journeys which we would be happy to provide details of, for a fee, or a share of the fines."

 

[AdamWW]

I don't think a simple case of short faring by itself is going to involve a retailer; it wouldn't be applicable.

What we're talking about here is where people buy tickets for short journeys to get through barriers; these could cost a tiny fraction of the actual ticket price. Then they have a much more expensive ticket for the actual journey made, which they fradulently claim a refund on.

Doughnutting isn't easily represented by analogies for other scenarios; there isn't really a comparison with any other industry that I can think of. The Halfords analogy doesn't work for this at all.

I find it hard to understand an argument that the Trainline themselves have been defrauded.
Someone has purchased valid tickets and the Trainline has got their commission + any fees.

Perhaps if the offender had purchased the correct tickets then the Trainline would have had more commission so I can see an argument that it's in their financial interest to prevent this from happening. But that's not the same as saying they've been defrauded themselves.

Looking at it another way - what could the Trainline do even if they were certain the passenger was doughnutting? They can tell the operator, but presumably they can't take any direct action because the tickets in themselves were valid. If they were being directly defrauded, there should be some remedy available to them.

 

[Doubleplus]

It states "We may also share your personal data with travel operators to prevent and detect fraud against either you, Trainline or the travel operator."

The inclusion of "travel operator" would appear to cover them.

Screenshot attached.

Ah, thank you. Yes, that does indeed seem to be what I was missing.

 

[AlterEgo]

That seems quite a ridiculous suggestion. Again, I refer to the Halfords example. If my car had four bald tyres and I elected to buy only two new tyres from Halfords, rather than the full four tyres which I would have needed to drive legally, would Halfords really have legitimate claim to say that they had been "defrauded" when I subsequently (and illegally) drove my car with two bald tyres and two new ones?

The answer is obviously no. Even if all four tyres are a requirement for legal driving, I am under no legal requirement to buy all of those tyres (or any of those tyres) from Halfords. And if I drive on partially-worn tyres then the wronged party is The Crown, not Halfords. Hence no credible suggestion of fraud. Same applies to Trainline. "We would have liked to have made even more commission from this customer" is very sad I am sure, but it is not evidence of having been defrauded.

Any 'commercially sensitive' arrangement between Trainline and third parties for the exchange of passengers' personal information would of course be quite legitimate if it were disclosed to Trainline customers in the T&Cs and privacy policy. But unless I'm missing something, it does not seem to be.

It’s a bit different if you suspiciously buy tyres from Halfords *all the time* and use them in something like a VAT or export scam. Halfords wouldn’t be the one defrauded but they would have a moral responsibility to take action on the matter if they had reasonable suspicion.

The problem is some companies don’t have reasonable suspicion when asking TL to investigate.

 

[Meerkat]

I'm struggling to see on what grounds this isn't seen to be a good thing - anyone??

 

[yorkie]

Looking at it another way - what could the Trainline do even if they were certain the passenger was doughnutting? They can tell the operator, but presumably they can't take any direct action because the tickets in themselves were valid. If they were being directly defrauded, there should be some remedy available to them.

If a passenger buys cheap tickets for gatelines at each end and also an expensive ticket for the journey made, then gets a refund on the expensive ticket, the retailer who has to refund the ticket isn't being defrauded?

 

[Bluejays]

What's in it for Trainline? Well I'd imagine the long term security of their business.

If they were seen to be a major enabler of fare evasion then I wouldn't imagine they'd be allowed to continue to sell tickets for a long time.

They are also one of the frontrunners for the GBR centralised ticket retail platform I believe. A decent fraud prevention system can only help when it comes to that bid.

 

[AdamWW]

If a passenger buys cheap tickets for gatelines at each end and also an expensive ticket for the journey made, then gets a refund on the expensive ticket, the retailer who has to refund the ticket isn't being defrauded?

OK if the retailer is just used to buy tickets for the start and end of a journey ("classic" doughnutting) then I don't see where the retailer can claim it's been defrauded. It has sold some tickets which were themselves used in a valid way. There was a part of the journey where there was no valid ticket but the retailer isn't involved in that bit.

If the offender also buys a parallel ticket for the full journey and then refunds it, then maybe there's a case to consider them being defrauded if they lose out financially from the refund. But as pointed out above they may make more money on refunded tickets than ones which are actually used.

 

[Tetchytyke]

It’s a bit different if you suspiciously buy tyres from Halfords *all the time* and use them in something like a VAT or export scam. Halfords wouldn’t be the one defrauded but they would have a moral responsibility to take action on the matter if they had reasonable suspicion.

The problem is some companies don’t have reasonable suspicion when asking TL to investigate.

Agreed.

AML/CFT (Anti Money-Laundering and Countering the Finance of Terrorism) legislation doesn’t just impose a moral duty, it imposes a legal one. And this is why the GDPR exemptions are there, so AML/CFT concerns can be reported lawfully.

I have absolutely no issue with Trainline reporting people dishonestly claiming refunds. I’m more sceptical about how the reporting is then managed by the TOCs though, as it seems reliant on email correspondence to/from a TOC being used against someone without them being told of their rights (in person, it’d normally be under caution).

I’m not convinced their reporting should be solely to the TOCs either, as repeatedly buying tickets then refunding them could be an excellent way to launder money. Anything to clamp down on this is a good thing.

Where I do have an issue is where TOCs go on a fishing trip after discovering an error (e.g. expired railcard) and then demand someone accounts for every purchase they’ve ever made. That’s stretching the law to breaking point.

 

[island]

AML/CFT (Anti Money-Laundering and Countering the Finance of Terrorism) legislation doesn’t just impose a moral duty, it imposes a legal one.

But it does not impose a duty on Trainline, which is not a financial services business or otherwise prescribed under the anti money laundering regulations.

 

[Camsus]

Using the expired railcard example mentioned above, from the TOC's point of view, would they not be fully entitled to request data from The Trainline in order to try and establish the extent of underpaid fares if someone's railcard is, for example, found to be 2 months out of date during a ticket inspection?

 

[AdamWW]

Using the expired railcard example mentioned above, from the TOC's point of view, would they not be fully entitled to request data from The Trainline in order to try and establish the extent of underpaid fares if someone's railcard is, for example, found to be 2 months out of date during a ticket inspection?

There was a case reported here where the railcard was actually valid but unable to be shown due to app problems.
Therefore there wasn't a period during which the passenger could have been using an expired railcard.

Nevertheless it seems that the ToC, having acquired data showing that over a period of years the passenger had purchased tickets with various railcards, they then required them to produce proof that they held the relevant railcards.

This seems unreasonable to me.

 

[185]

Given the trainline is a commercial enterprise, what's in it for them

95% of rail tickets TL sell are for DfT ie government contracts, and as such the DfT can pretty much dictate whatever it wants to these glorified travel agents. It wouldn't take much for government to remove their accreditation to sell RDG rail tickets if they felt they were allowing fraud or fare evasion to flourish. Thus, TL will jump to assist when asked.

 

[Camsus]

There was a case reported here where the railcard was actually valid but unable to be shown due to app problems.
Therefore there wasn't a period during which the passenger could have been using an expired railcard.

Nevertheless it seems that the ToC, having acquired data showing that over a period of years the passenger had purchased tickets with various railcards, they then required them to produce proof that they held the relevant railcards.

This seems unreasonable to me.

That does seem a little unreasonable however, surely the individual would be provided with a period of time after the event to provide evidence of their railcard to the TOC? For example, when someone is unable provide evidence of their railcard during an inspection, they're details would be taken and they then are given something like 14 days to provide evidence of said railcard to the TOC. If they subsequently failed to do so, then the TOC would have just cause to seek the individual's purchase data from the seller (such as The Trainline) in order to see the extent of any potential fare evasion

 

[AlterEgo]

That does seem a little unreasonable however, surely the individual would be provided with a period of time after the event to provide evidence of their railcard to the TOC? For example, when someone is unable provide evidence of their railcard during an inspection, they're details would be taken and they then are given something like 14 days to provide evidence of said railcard to the TOC. If they subsequently failed to do so, then the TOC would have just cause to seek the individual's purchase data from the seller (such as The Trainline) in order to see the extent of any potential fare evasion

They shouldn’t have to evidence historic ownership of railcards they no longer have. The response should be along the lines of Arkell v Pressdram.

 

[yorkie]

OK if the retailer is just used to buy tickets for the start and end of a journey ("classic" doughnutting) then I don't see where the retailer can claim it's been defrauded. It has sold some tickets which were themselves used in a valid way. There was a part of the journey where there was no valid ticket but the retailer isn't involved in that bit.

If the offender also buys a parallel ticket for the full journey and then refunds it, then maybe there's a case to consider them being defrauded if they lose out financially from the refund. But as pointed out above they may make more money on refunded tickets than ones which are actually used.

I think that is what is happening. (If the fraudster had any sense they would buy the three tickets from completely separate retailers, but if they were that clever they wouldn't be committing the fraud! )

== Doublepost prevention - post automatically merged: 24 Apr 2023 ==

Where I do have an issue is where TOCs go on a fishing trip after discovering an error (e.g. expired railcard) and then demand someone accounts for every purchase they’ve ever made. That’s stretching the law to breaking point.

Such a thing should never be allowed to happen; this would be of great concern.

== Doublepost prevention - post automatically merged: 24 Apr 2023 ==

Using the expired railcard example mentioned above, from the TOC's point of view, would they not be fully entitled to request data from The Trainline in order to try and establish the extent of underpaid fares if someone's railcard is, for example, found to be 2 months out of date during a ticket inspection?

I don't thi I that would be reasonable; don't forget anyone can purchase a ticket for anyone else to use.

 

[duncan788]

Will this result in a decrease in the use of trainline.com as the preferred option for purchasing train tickets? I always ensure that I have valid tickets for all my travels, but if trainline.com can monitors my ticket purchasing habits makes me feel uncomfortable about my privacy. Since I purchase my railcard using my ID card, I am concerned about the potential leakage of our data.

 

[Hadders]

I doubt very much if people will stop using Trainline becuase of this. There are many reasons to avoid using Trainline, like their booking fees, but that doesn't stop people using them.

Organisations holding personal data do have to comply with the GDPR legislation to make sure it is kept safe. Reputable organisations take this sort of thing very seriously because a data breach could be very brand damaging for them.

 

[Camsus]

Will this result in a decrease in the use of trainline.com as the preferred option for purchasing train tickets? I always ensure that I have valid tickets for all my travels, but the fact that trainline.com monitors my ticket purchasing habits makes me feel uncomfortable about my privacy. Since I purchase my railcard using my ID card, I am concerned about the potential leakage of our data.

Does anyone know for sure that TL monitor ticket purchases and informs TOC's of any suspicious activity, or is it simply speculation?

 

[duncan788]

I doubt very much if people will stop using Trainline becuase of this. There are many reasons to avoid using Trainline, like their booking fees, but that doesn't stop people using them.

Organisations holding personal data do have to comply with the GDPR legislation to make sure it is kept safe. Reputable organisations take this sort of thing very seriously because a data breach could be very brand damaging for them.

I agree with your view. However, as a foreigner who previously lived in a police state, knowing that someone can tracking me makes me feel uneasy.

 

[Hadders]

I agree with your view. However, as a foreigner who previously lived in a police state, knowing that someone is tracking me makes me feel uneasy.

I wouldn't worry too much about a company selling train tickets, there are many many more ways in which the day to day activities of everyone can be tracked.

But this is getting off topic now....

Does anyone know for sure that TL monitor ticket purchases and informs TOC's of any suspicious activity, or is it simply speculation?

Cases we've seen on this forum tend to be ones initiated by train companies after they have caught someone during a ticket inspection. They then obtain details from Trainline to assist them with their enquiries. I don't recall a case where it has happenned the other way round, although it could happen.

For example, let's say someone was purchasing tickets, using the same account from Peterborough to Huntingdon and Finsbury Park to Kings Cross on a regular basis. Should Trainline tell the GTR about this and should GTR deploy RPIs on-board the services the person is suspected of using, or at Kings Cross to try and catch the person. Should GTR research e-ticket scans at barrier lines to assist in determining exactly which trains were used?

We know Trainline has data sharing agreements with many train operating companies and although they are the largest train ticket retailer they aren't the only one. I suspect other retailers will have siilar agreements.

 

[duncan788]

Does anyone know for sure that TL monitor ticket purchases and informs TOC's of any suspicious activity, or is it simply speculation?

I apologize for not expressing myself clearly in my previous comment. I have edited it to better reflect my thoughts. I didn't mean that TL monitors ticket purchases and informs TOCs of suspicious activity. My concern is the unease I feel about the possibility of being tracked and having my habits monitored.

 

[Hadders]

I apologize for not expressing myself clearly in my previous comment. I have edited it to better reflect my thoughts. I didn't mean that TL monitors ticket purchases and informs TOCs of suspicious activity. My concern is the unease I feel about the possibility of being tracked and having my habits monitored.

Practically everything you do is tracked these days if you connect to the internet and conduct business online, or use any form of social media. Same if you use a loyalty card ina shop. I believe the UK has more CCTV cameras than many other countries.

 

[Doctor Fegg]

Practically everything you do is tracked these days if you connect to the internet and conduct business online, or use any form of social media. Same if you use a loyalty card ina shop. I believe the UK has more CCTV cameras than many other countries.

You can, however, take sensible and achievable steps to minimise that tracking. Not using Trainline is one such step.

I’m always pleasantly reassured when I open Google and it thinks I’m in Kettering. I’m not.

 

[AdamWW]

That does seem a little unreasonable however, surely the individual would be provided with a period of time after the event to provide evidence of their railcard to the TOC? For example, when someone is unable provide evidence of their railcard during an inspection, they're details would be taken and they then are given something like 14 days to provide evidence of said railcard to the TOC. If they subsequently failed to do so, then the TOC would have just cause to seek the individual's purchase data from the seller (such as The Trainline) in order to see the extent of any potential fare evasion

They were given the opportunity to show that they had a valid railcard and did so.

Of course the "extent of any potential fare evasion" for multiple uses of an expired railcard is - in the sense of actual money gained by the offender and lost to the railway - £30 at most.

I appreciate that the conditions of travel say that a ticket without a valid railcard is completely invalid and therefore the railway can (and does) argue that it has been cheated of an anytime fare for each journey. But it's not actual money the railway would ever have seen and there doesn't seem to be any oversight in how the railway deals with its new-found ability to easily extract punitive fares for such historic offences.

Using the expired railcard example mentioned above, from the TOC's point of view, would they not be fully entitled to request data from The Trainline in order to try and establish the extent of underpaid fares if someone's railcard is, for example, found to be 2 months out of date during a ticket inspection?

I don't think that would be reasonable; don't forget anyone can purchase a ticket for anyone else to use.

Indeed, and I don't suppose there is actually any requirement for someone to prove their innocence. But that probably doesn't prevent people from incriminating themselves in the belief that things will go better for them if they're honest.

 

[Camsus]

I don't thi I that would be reasonable; don't forget anyone can purchase a ticket for anyone else to use.

I'd imagine the vast majority of people use e-tickets that they purchased themselves via their own account with TL. Using a ticket bought by someone else is of course entirely possible, but I'd assume is a small minority.
I still think a TOC would be justified in making enquiries regarding a person's ticket purchases in the following circumstances;

The individual has been found to be using a railcard discounted ticket without having the actual railcard on them and don't/can't produce evidence of the railcard within 14 days of being stopped and questioned
OR
The individual admitted to the inspector they don't have a railcard when questioned.

== Doublepost prevention - post automatically merged: 25 Apr 2023 ==

They were given the opportunity to show that they had a valid railcard and did so.

Okay. Without knowing the full circumstances, I would say it seems unreasonable on the part of the TOC to require the person concerned to produce their previous railcards

 

[AdamWW]

I'd imagine the vast majority of people use e-tickets that they purchased themselves via their own account with TL. Using a ticket bought by someone else is of course entirely possible, but I'd assume is a small minority.
I still think a TOC would be justified in making enquiries regarding a person's ticket purchases in the following circumstances;

And I think that the passenger would also be legally justified in ignoring such enquiries.

Besides if you take the view that the railway's loss for someone failing to renew a railcard is the actual money they have lost, not a theoretical amount based on treating each trip as if the passenger had jumped on a train without buying a ticket at all, then it doesn't matter to them how many times it got used - the "railway" is owed the renewal fee + plus a reasonable penalty.

 

[Tetchytyke]

I don't suppose there is actually any requirement for someone to prove their innocence

Which is why the TOCs say “tell us about this” and hope people incriminate themselves. As @AlterEgo says, the correct response is to refer to Arkell v Pressdram.

Of course the "extent of any potential fare evasion" for multiple uses of an expired railcard is - in the sense of actual money gained by the offender and lost to the railway - £30 at most

In most cases. If someone would otherwise have been entitled to the railcard, definitely. But if they wouldn’t have been, it is a bit different.

But I agree with your underlying point: the retail loss from an expired railcard is £30, not the difference between the discounted and undiscounted fare. It certainly isn’t the Anytime fare the TOCs like to rinse people for.

 

[AdamWW]

In most cases. If someone would otherwise have been entitled to the railcard, definitely. But if they wouldn’t have been, it is a bit different.

Oh of course. I was considering the case of an expired railcard which could have been legitimately renewed.

But I agree with your underlying point: the retail loss from an expired railcard is £30, not the difference between the discounted and undiscounted fare. It certainly isn’t the Anytime fare the TOCs like to rinse people for.

And it definitely isn't the Anytime fare plus the original fare paid.

 

[Wolfie]

There's no fraud risk in this particular case as this format of ticket would not be valid unless it has been printed/collected.

The fraud risk is where tickets have been fulfilled (either paper tickets which have been collected or e-tickets) and not clipped/marked (in the case of paper tickets) or not scanned (in the case of e-tickets) and are then submitted for a refund.

In some cases, tickets are even sent for Delay Repay as well as refunded (this can be detected; it's much easier to detect this with e-tickets than paper tickets)

Re your last para, what utterly dumb scammers! They deserve everything that they get.

== Doublepost prevention - post automatically merged: 25 Apr 2023 ==

95% of rail tickets TL sell are for DfT ie government contracts, and as such the DfT can pretty much dictate whatever it wants to these glorified travel agents. It wouldn't take much for government to remove their accreditation to sell RDG rail tickets if they felt they were allowing fraud or fare evasion to flourish. Thus, TL will jump to assist when asked.

However DfT are not entitled to demand that Trainline breaks data protection laws. Any such data release has to be legal.

== Doublepost prevention - post automatically merged: 25 Apr 2023 ==

Will this result in a decrease in the use of trainline.com as the preferred option for purchasing train tickets? I always ensure that I have valid tickets for all my travels, but if trainline.com can monitors my ticket purchasing habits makes me feel uncomfortable about my privacy. Since I purchase my railcard using my ID card, I am concerned about the potential leakage of our data.

What makes you believe that alternative retailers are/will not do exactly the same thing?