Received email from Greater Anglia Fraud Department – advice needed

[AlterEgo]

They would most likely contact the issuer of the credit or debit card used to buy tickets.

They wouldn't and never have in a case we've seen. The card companies are not going to give personal data to another private company, your post is simply scaremongering.

 

[John R]

They wouldn't and never have in a case we've seen. The card companies are not going to give personal data to another private company, your post is simply scaremongering.

Greater Anglia is not a private company.

 

[Haywain]

Greater Anglia is not a private company.

It is not a privately owned company, but it is still a business rather than a government agency

 

[AlterEgo]

Greater Anglia is not a private company.

Granted they are publicly owned, which makes no difference to the matter at hand. They still will not be given credit card addresses from the credit card company and likely won't even ask, it's just something which doesn't happen. They'll have to get the police involved. Which will also not happen.

OP should take heed of what has happened every single time (nothing) and not take heed of posts designed to scare them which do not fit the context of how things actually happen in these cases.

 

[Tetchytyke]

I don’t remember adding my address to my TrainPal account

You will probably have added your home address when you bought tickets. If I remember correctly, address is part of the PCI standards for online retail.

They would most likely contact the issuer of the credit or debit card used to buy tickets.

No, that is not how it works.

 

[MarlowDonkey]

You will probably have added your home address when you bought tickets. If I remember correctly, address is part of the PCI standards for online retail.


No, that is not how it works.

Try a Google search for
"powers to compel credit card providers to supply name and address"

A run of the mill fare evasion case is unlikely to qualify, but the powers and permissions do exist. That's how TOCs get ticket purchasing history from retailers. As noted, on line retailers usually have a name and address so investigators can use that route. "prevention or detection of a crime" is the magic phrase which trumps privacy.

From the Google search

The Crime & Taxation Exemption: Under Schedule 2, Part 1 of the Data Protection Act 2018, credit card providers are permitted (but not legally compelled) to disclose personal data to law enforcement without a court order if withholding that information would prejudice the prevention or detection of a crime, or the apprehension or prosecution of offenders. [1]

 

[Haywain]

From the Google search

But you'll note that it says "to disclose personal data to law enforcement". Train companies are not "law enforcement".

 

[Tetchytyke]

A run of the mill fare evasion case is unlikely to qualify, but the powers and permissions do exist.

A TOC is not a designated law enforcement agency.

Therefore they do not, under Data Protection Act 2018, have the legal right to process data for the purpose of preventing, investigating, or detecting crime.

If they ask a bank or other financial services company for the financial or other records of an individual they should be politely but firmly told by the bank to sod off.

 

[MarlowDonkey]

Therefore they do not, under Data Protection Act 2018, have the legal right to process data for the purpose of preventing, investigating, or detecting crime.

What powers are they relying on to get details of past ticket purchase?

 

[Tetchytyke]

What powers are they relying on to get details of past ticket purchase?

My best guess from my pretty amateur understanding of GDPR is that they are relying on performance of a contract and legitimate interests.

The retailer is acting as the agent for the TOC so the contractual basis exists between the purchaser, the retailer, and the operator for the information to be shared between them. And both the retailer and the operator fairly obviously have a legitimate interest in detecting and preventing people from evading their fares.

It's very similar to how insurance companies will share information about potentially fraudulent or false claims with each other.

 

[Egg Centric]

The retailer is acting as the agent for the TOC so the contractual basis exists between the purchaser, the retailer, and the operator for the information to be shared between them. And both the retailer and the operator fairly obviously have a legitimate interest in detecting and preventing people from evading their fares.

It's very similar to how insurance companies will share information about potentially fraudulent or false claims with each other.

There's also more than a bit of a clue as to which retailers are most often routinely consulted in the very first post

 

[MrJeeves]

A TOC is not a designated law enforcement agency.

Therefore they do not, under Data Protection Act 2018, have the legal right to process data for the purpose of preventing, investigating, or detecting crime.

This isn't correct.

Exemptions under DPA apply to people ("competent [authorities]") who have a "statutory function" (permission granted by an enactment of law) to pursue criminal proceedings. In this case, this is set out in S29 of the Criminal Justice Act 2003, by reference of a "relevant prosecutor", which is then defined in S6 of the Criminal Justice Act 2003 (New Method of Instituting Proceedings) (Specification of Relevant Prosecutors) Order 2016, which designates any company holding a license to operate on the railways as a relevant prosecutor for Railway Byelaw offenses (crucially, not Regulation of Railways Act 1889 or Fraud Act 2006 offenses).

If they are investigating a byelaw offence, then the exemption under the DPA engages.

It's worth noting that just because the DPA exemption engages, there is no obligation for any other party to actually share any data with them if they (a) do not want to, or (b) they believe that not sharing the information wouldn't prejudice any investigation, potentially because they already have enough information to prosecute or the information is already accessible to them via other means.

The exemptions also apply to any third party acting under instruction of a "competent authority", which is why the likes of ITAL and TIL will investigate cases and request information from other industry parties as well.

It's also worth noting that the specific wording of the crime and taxation exemption does not mean that a hypothetical retailer cannot share information with someone who is not a competent authority. The only requirement is that you must be able to demonstrate that the sharing of the data is necessary for the prevention and detection of crime or the apprehension or prosecution of offenders, and that complying with the DPA 2018 principles will prejudice this purpose.

Anyone can process data for the purpose of preventing or detecting crime, and can share that information as needed to achieve the purposes in the exemption without informing the person if that would prejudice an investigation. That is very clear from Schedule 2 Part 1 Paragraph 2(1). The competent authority exemptions then allow for the data to be used for any investigation or prosecution without needing to inform the person of the source of the data and how it's being processed, or the risk of someone using their Right to be Forgotten, Object, to Data Portability, etc.

 

[Tetchytyke]

Exemptions under DPA apply to people who have a "statutory function" (permission granted by an enactment of law) to pursue criminal proceedings. In this case, this is set out in S29 of the Criminal Justice Act 2003, by reference of a "relevant prosecutor", which is then defined in S6 of the Criminal Justice Act 2003 (New Method of Instituting Proceedings) (Specification of Relevant Prosecutors) Order 2016, which designates any company holding a license to operate on the railways as a relevant prosecutor for Railway Byelaw offenses (crucially, not Regulation of Railways Act 1889 or Fraud Act 2006 offenses).

My understanding was that the Order you referred to simply allowed the TOCs to institute criminal proceedings under the Single Justice Procedure. This is why RoRA and the Fraud Act weren't included: both of those offences can't be tried under SJP because they can result in a custodial sentence upon conviction.

My understanding was that this is merely administrative: it merely allows them to use a specific procedure to facilitate a prosecution under the Byelaws. It doesn't, at least as I understand it, go so far as to confer a statutory function on the TOC. This is different to, say, the Environment Agency who have a specific statutory function under the various Environment Acts to prosecute some environmental offences.

But, as I freely admit, my understanding is amateur at best and I wouldn't want my DPO's job for all the tea in China.

 

[MrJeeves]

It doesn't, at least as I understand it, go so far as to confer a statutory function on the TOC.

S30 of the DPA simply describes a statutory function as "a function under or by virtue of an enactment". I think it would be a difficult argument to say that the right for a TOC to prosecute someone via SJP contained within an enactment of law wasn't a "function [...] by virtue of an enactment" relevant to law enforcement purposes.

 

[AlterEgo]

It is probably worth mentioning at this stage that we have never, ever seen a train company obtain someone's personal details (such as their address) from a credit card company or bank.

 

[MrJeeves]

Quite, and it's far more likely that OP entered their address as part of their payment details when buying a ticket, or maybe provided it when using Apple Pay/Google Pay.

 

[shanzyy]

Quite, and it's far more likely that OP entered their address as part of their payment details when buying a ticket, or maybe provided it when using Apple Pay/Google Pay.

Thanks for your input, I appreciate it. To be honest, this whole situation has been very stressful for me. I’m trying to be careful because I don’t want to put myself in a worse position by making assumptions or saying something inaccurate.


For now, I’m not planning to reply further until I fully understand my position. If they do send me a formal notice, letter, or any other paperwork, I’d be grateful for advice on the best way to respond.


Also, if any of the senior members have seen someone in a similar situation before, I’d really appreciate hearing what happened and how it was ultimately resolved.

 

[paninaro]

Quite, and it's far more likely that OP entered their address as part of their payment details when buying a ticket, or maybe provided it when using Apple Pay/Google Pay.

Would it even need to be a full address? The app I work with only requires a postcode when purchasing tickets, but I imagine name + postcode + public sources of data would get you an address very quickly.

 

[jumble]

Your first reply committed to sending a response when you have more information. Now you’ve got that information, how do you explain not replying?

Oh, and stop fare dodging in future…

Explain to who?
Perhaps the OP took legal advice which mandated no further communication

 

[railuser429]

This is a really difficult case, we dont know what GA hold in evidence for you, as another user said, they very well could have CCTV as its recent showing you board, disembark a train, barrier cctv linking to a e ticket.


They have your name, email adress and likely CCTV imaging of you. Could easily also do a ONSIT search to further identify you from social media, etc.


It's hard to say what to do now, was probably best not to reply originally.

My personal advice here is that you should take this serious, these TOCs do not play about now and their methods are more and more advanced.
Just on a personal note, did you actually do these journies? How many have you done? How long have you been doing it for? Are the allegations of sandwich faring valid?


I would look at requesting a Subject access request to GA, this will tell you everything they have. You are legally entilted to do so.
From there you can really see your position.
Take it from me who went through this all with another TOC, they dont play about.

 

[MotCO]

Re the CCTV images. How could a CCTV image be matched to a ticket? Will the ticket barriers record the exact time of entry/exit to the second, and likewise the CCTV image? What guarantee is there that the timing on the video and ticket barriers are in step with each other? Even if they find an image of a person entering a station on the first doughnut ticket, and no image of them leaving at the exit station on the first ticket, is that proof? They could have bought a ticket on the train before the exit station etc. I'm not sure how reliable CCTV evidence would be.

 

[MarlowDonkey]

Re the CCTV images. How could a CCTV image be matched to a ticket? Will the ticket barriers record the exact time of entry/exit to the second, and likewise the CCTV image?

If you watch the Channel 5 series about fare dodgers, you see investigators matching ticket scans against CCTV footage. They do this in order to identify a person for a future in person challenge.

 

[Mattplans]

If you watch the Channel 5 series about fare dodgers, you see investigators matching ticket scans against CCTV footage. They do this in order to identify a person for a future in person challenge.

Only that's a bit different. We've strayed so far away from what is realistically likely to happen here and it's fearmongering for OP. We have seen enough of these data trawl cases and we know that for the TOC to take action against OP they would have needed to stop them while they were using the ticket. The forum has seen this indentical case enough times to know what happens next, I'm not sure how we have reached this position and I don't imagine it's very helpful for OP.

Op needs to go about their life, stop worrying about this and stop fare evading. They don't need to reply, and they don't need to issue a SAR.

I wouldn't be at all surprised if they took a case like this one through to prosecution

This isn't true. For a number of reasons, but most importantly OP has not actually been caught using an irregular ticket.

 

[MotCO]

We've strayed so far away from what is realistically likely to happen here and it's fearmongering for OP.

I wasn't attempting to scaremonger - just to give the OP a view as to how likely it was that he/she could be caught by CCTV

 

[saismee]

Will the ticket barriers record the exact time of entry/exit to the second, and likewise the CCTV image?

Yes to the second, but are the clocks synced properly? Absolutely not. Doesn't mean it isn't possible to match up but I highly doubt it was done.

I think OP should look at a lot of other similar threads with these identical emails, especially the ones where the OP has replied, stopped replying, and been forgotten about by the TOC. And start paying your fare properly.

 

[shanzyy]

Just got,

Good Morning,
We have not received any contact from you; you were previously contacted on 13/07/2026.
At this stage we would like to offer you an opportunity to explain these irregularities on your account, and based on your response the decision will be to either offer you the opportunity to repay any funds relating to these journeys (plus our administration fee), (b) to forward your case to our prosecutions department for processing or (c) close your case (if sufficient evidence has been provided and proved).

If we do not hear from you within the next 5 working days, you will lose any opportunity to settle this case with us.

 

[MarlowDonkey]

(b) to forward your case to our prosecutions department for processing

A key question is whether the prosecutions department have enough evidence to make a prosecution case. That's why it's important to establish whether someone has ever been caught in person with a dubious ticket. That said, travelling with an invalid or no ticket is now more risky as either a random or targeted stop will link in to the existing investigation.

 

[Tetchytyke]

If we do not hear from you within the next 5 working days, you will lose any opportunity to settle this case with us.

Standard waffle, you'll probably receive several more of these.

Unless you were stopped, they cannot easily prove that a) the tickets were used incorrectly, or b) that you were the one using the tickets.

f you watch the Channel 5 series about fare dodgers, you see investigators matching ticket scans against CCTV footage. They do this in order to identify a person for a future in person challenge.

To come back to this, that would be a standard use of CCTV. It doesn't need to be calibrated or accurate to the milisecond for this purpose: all they're doing is trying to see what someone looks like in order to make stopping them much easier.

It is a lot harder to introduce CCTV footage evidentially in a situation such as this. It isn't impossible but it is harder. The question, though, isn't whether they can hypothetically do it (they can), more whether they would. For this level of matter, I would consider it highly unlikely.

 

[MotCO]

It is a lot harder to introduce CCTV footage evidentially in a situation such as this. It isn't impossible but it is harder. The question, though, isn't whether they can hypothetically do it (they can), more whether they would. For this level of matter, I would consider it highly unlikely.

Ultimately, in a Court of Law, a civil case would require it to meet the 'balance of probabilities' - i.e., is it probable that the person seen on cctv at around the same time was the same person whose invalid ticket was read by the ticket machine, and that the cctv image matched that of the OP. That is a hard one to call.

 

[MarlowDonkey]

Ultimately, in a Court of Law, a civil case would require it to meet the 'balance of probabilities' - i.e., is it probable that the person seen on cctv at around the same time was the same person whose invalid ticket was read by the ticket machine, and that the cctv image matched that of the OP. That is a hard one to call.

If it became a civil case would it not be the case that the balance of probability was that the person holding the account that repeatedly bought the tickets was also the person using them?