East Coast delay repay email

[matthewmacleod]

Just received an unusual email from East Coast in response to a Delay Repay claim for Sunday – asking for bank details, in order to pay claims in cash!

Either this is a pretty impressive scam attempt, or a pretty badly-executed genuine email. I notice a few other people have also received this, but the East Coast Twitter account isn't providing any additional information (just redirecting people to the customer support line).

Certainly the first time I've seen cash refunds like this!

Dear Sir/Madam,

Thank you for your recent Delay Repay application, in regard to the disruption to East Coast services on Saturday 27th December 2014. Firstly, we would like to offer our sincere apologies for your difficult journey experience, which as you are aware was as a direct result of over-running engineering works just outside of King’s Cross. Please be assured that we will be working closely with our infrastructure partner Network Rail, and other relevant parties, to understand fully what went wrong, and to ensure lessons are learned to prevent a similar incident occurring in the future.

As a gesture of goodwill for the disruption and inconvenience to your travel plans, your claim will, on this occasion only, be paid in cash by BACs transfer. In order for us to facilitate this quickly, please provide the details requested below by return to this email address (disruption2712@eastcoast.co.uk). Your payment will then be made as quickly as possible although, in view of the holiday, period please do allow 14 working days for the transfer to be made.

Bank Name and branch:

Sort Code:

Account Number:

Journey from and to:

Fare paid:

Many thanks again for your understanding of this difficult situation, and our very best wishes for 2015.

With kind regards,

Customer Relations Department – Managing Director’s Office

East Coast

 

[The North Briton]

The misplaced comma between holiday and period would be ringing alarm bells with me.

 

[northwichcat]

Mmmm - bank account details should never be emailed for security reasons. East Coast should set up a secure webpage to submit those details i.e. one with a URL starting https://

 

[High Dyke]

I wouldn't supply any bank details; it doesn't sound genuine - though apologies if it is actually genuine. Contact East Coast Trains to verify the e-mail.

Their website has this information about claims:

About your claim

• Any successful claims will be reimbursed in National Rail Travel Vouchers
• We only pay compensation under one scheme per journey. For example, if you were delayed by over 30 minutes and the seat you reserved wasn’t available, then you would be entitled to make a claim from the scheme that offers you the most compensation
• We do not normally accept refund claims under Delay Repay if you were advised of the delay before you bought your ticket.
• We do treat each claim on its merits though and never automatically rule out compensation
• Completion of this form does not guarantee compensation, or create any new legal relationship with you as a result of what we say we will do. Nor does it affect your legal rights
• Please take care when completing your Claim Form. To validate claims, we have monitoring systems for checking customer details, ticket types and other information provided. It is important that you write in block capitals within the boxes provided
• This form will only be used to investigate claims against ‘Delay Repay’ or ‘Seat Guarantee’ schemes. If you wish to comment on any other aspect of our service, please contact our Customer Relations team at customers@eastcoast.co.uk
• We don't accept liability for any loss caused by delay to your journey, cancellation of any train, missed connection, or closure of the railway
• For further information on our commitments to our customers you can read our Passenger’s Charter online at eastcoast.co.uk, or pick up a copy from any of our stations

http://www.eastcoast.co.uk/customer-service/delay-repay/#Aboutyourclaim

 

[Hyphen]

Either this is a pretty impressive scam attempt, or a pretty badly-executed genuine email.

In my organisation, someone would be getting a stern telling off (from me!) for asking for details like this over an insecure medium. That said, in healthcare, we have much more stringent regulation of "information governance" than someone like a TOC would.

If you're going to return these details to them via email, I'd recommend penning a new email to the address given (don't just hit reply) along with any reference number you may have been given. A bit more secure would be writing to them (snail mail!)

If it is a scam, they'll probably be relying on you pressing reply, which would probably go to a non @eastcoast.co.uk address.

Edit: If you're relatively IT savvy, looking at the message headers (finding these will differ between mail clients) will go some way to confirming whether or not it's come from EC themselves. I've never received an email from EC CS before though, so I can't tell you what mail server they use. Booking confirmations come from an ATOS Origin email server.

 

[HowardGWR]

Yes, @Hyphen gives good advice although telling someone your bank account number and sort code gets them nowhere except their ability to pay you money.

 

[matthewmacleod]

Oh, it definitely rings alarm bells!

Looking further into it, it does appear to have been sent from East Coast's email system by a fellow who works there as a PA – the email headers all check out, reply-to address is a genuine eastcoast.co.uk email, etc.

I'm going to put my money on this being a 'genuine' email –*but I'll bet someone's going to get into a fair bit of trouble for it. I will hang on and wait for the inevitable follow-up email apologising for it
--- old post above --- --- new post below ---

Yes, @Hyphen gives good advice although telling someone your bank account number and sort code gets them nowhere except their ability to pay you money.

Not quite! Jeremy Clarkson famously published his bank details in the Sunday Times, only to find someone set up a charity direct debit with them: http://news.bbc.co.uk/1/hi/7174760.stm

 

[Hyphen]

Yes, @Hyphen gives good advice although telling someone your bank account number and sort code gets them nowhere except their ability to pay you money.

Sadly not entirely true - though this is a commonly held belief.

Jeremy Clarkson tried this a few years ago when he published his SC+AN in one of the national papers. Someone decided to make a point by using those details to donate some of Clarkson's money to charity.

I'm unsure if the charity in question has since tightened up their collection rules, but there are plenty of more unscrupulous retailers/traders out there who might also be able to use these details to empty your account.

Edit: Beaten to it

 

[northwichcat]

Looking further into it, it does appear to have been sent from East Coast's email system by a fellow who works there as a PA – the email headers all check out, reply-to address is a genuine eastcoast.co.uk email, etc.

If you know how to you can send an email from any address whether or not you own the domain. Although if you do that there's a high chance the email will go in to the junk folder or be marked as a potential phishing scam.

 

[Hyphen]

If you know how to you can send an email from any address whether or not you own the domain. Although if you do that there's a high chance the email will go in to the junk folder or be marked as a potential phishing scam.

This is true, which is why it sometimes helps to verify the mail server you're receiving the message from.

eastcoast.co.uk uses Sender Protection Framework records on their domain, which for any recipient email server which is able to check this, can deny emails from a non-valid source.

Valid servers for email from EC are: smtp1.mail.atosorigin.com, *.atosorigin.com, *.atosorigin.net, *.messagelabs.com, *.mailcontrol.com, *._ec._spf.icomera.com.

That said, they end it with "?all", which kinda negates the entire point of having SPF at all.

 

[matthewmacleod]

If you know how to you can send an email from any address whether or not you own the domain. Although if you do that there's a high chance the email will go in to the junk folder or be marked as a potential phishing scam.

Sure, but in this case though, that's not what's happened. In particular SPF checks out, the email came through East Coast's SMTP server at smtp-pri-yrk.eastcoast.co.uk, and it was also routed through MailControl, which is a service used by East Coast.

(Source - I'm an IT guy )

 

[andrew bell]

Personally I would call East Coast and ask them about the email. I'm pretty sure it's a scam as many firms will not ask for your bank details over email

 

[Stats]

https://twitter.com/eastcoastuk/status/550271556044460032

East Coast TrainsVerified account
‏@eastcoastuk
Apologies to customers receiving email from disruption2712@eastcoast.co.uk, we can confirm this is a legitimate company address.

 

[dgl]

my email runs through my ISP on the way going out (smtp) but through my web host for incoming (pop3) (if you are wondering you have to pay (with my free (and ad free!)) webhost for an smpt account but you get pop3 for free).
The outgoing requires no authentication and is not linked to the isp account in anyway. It can therefore be very easy to spoof email addresses (I could technically put any address in and it would send it).

I would never send any un-encrypted security sensitive information in an email it is just to much of a risk, even if it is to an @eastcost.co.uk email as you have no guarantee that the email account itself hasn't been hacked.

 

[tsr]

It does appear that East Coast have provoked a small Twitter storm, worsened by just telling people to "ring Customer Services" about Delay Repay a high number of times, before really confirming what they were all going on about and whether the email was genuine.

 

[maniacmartin]

Sort code and account number are hardly top secret. They are on the bottom of every cheque you write, and a lot of businesses print it on the bottom of all of their invoices. The worst that can be done is someone sets up a Direct Debit with them, which you could claw back under the Direct Debit Guarantee. I'd have no problem sending them to an @eastcoast.co.uk email address.

That said, it is a bit strange that they are doing BACS payments. Perhaps some megabacklog or shortage of RTV stock?

 

[Capybara]

Yes. I've had this as posted on the other thread. I'm tempted to think it's down to being overwhelmed and someone actually trying to be helpful without realising the implications.

 

[amcluesent]

Am I missing something, but isn't EC asking to be scammed by peeps sending in emails with unverifiable claims? IIRC the usual Delay/Replay needs a photo-copy of the ticket

 

[northwichcat]

someone actually trying to be helpful without realising the implications.

I can imagine an IT manager has gone away for a few days and a technically inept senior marketing person has thought of what he/she things will impress East Coast's customers and gone ahead and implemented it.
--- old post above --- --- new post below ---

IIRC the usual Delay/Replay needs a photo-copy of the ticket

It's being sent to people who've submitted a Delay Repay application already.

 

[Marton]

I was asked by EC to give my BACS by email or phone to repay an improperly charged parking ticket but it was in a letter which made it clear that there were only two employees with access to the data.

 

[HowardGWR]

Sadly not entirely true - though this is a commonly held belief.

Jeremy Clarkson tried this a few years ago when he published his SC+AN in one of the national papers. Someone decided to make a point by using those details to donate some of Clarkson's money to charity.

I'm unsure if the charity in question has since tightened up their collection rules, but there are plenty of more unscrupulous retailers/traders out there who might also be able to use these details to empty your account.

Edit: Beaten to it

No you can stop that (just like you always could). See later posts.

 

[DaveNewcastle]

East Coast have been offering refunds by Bank Transfer in extreme cases for about 18 months now.
I have received a refund by this method in the past. I've found a thread on here from October 2013 with the almost identical paragraphs from East Coast. Here : East Coast Disruption 21/10/13 in post #66.

If anyone doesn't want to disclose their details in this way to receive a prompt repayment (and presumably default to the usual arrangement of compensation in the form of Rail Travel Vouchers) then they are perfectly free to say so.

 

[Starmill]

I don't understand why this 'set off alarm bells'. East Coast have asked me for this before (I just phoned them though and they posted vouchers at the time), their emails often have a couple of minor spelling errors (their grammar is a lot better than Northern's) and what is anyone going to do with those details if they do obtain them? Pay money into your account? EDIT: OK I realise that's not quite the case now.


The other thing that surprises me is how quickly they have gotten back to you.
--- old post above --- --- new post below ---

That said, it is a bit strange that they are doing BACS payments. Perhaps some megabacklog or shortage of RTV stock?

I think it's probably an initiative to get people real money rather than "My elderly mother and six children were forced to sit on our 8 suitcases in a First Class vestibule for 6 hours after we paid £500 for tickets and all we got back were these green vouchers!"

Either that or, if anyone has been disrupted on London to Edinburgh FORs, that's a LOT of £25 RTVs to send out. The inflexibility of RTVs is bad not only for passengers, but the industry itself.

 

[Via Bank]

Sort code and account number are hardly top secret. They are on the bottom of every cheque you write, and a lot of businesses print it on the bottom of all of their invoices. The worst that can be done is someone sets up a Direct Debit with them, which you could claw back under the Direct Debit Guarantee. I'd have no problem sending them to an @eastcoast.co.uk email address.

Email is, by default, unencrypted. Anyone along the chain can intercept and read the contents of the mail. It's like sending a postcard. And since the internet does, by its nature, not necessarily provide a chain of completely trusted servers between the sender's mail server and the recipient's mail server, one is very right to be wary of sending bank details in an email.

True, these details are at the bottom of cheques, but the only people who will usually see a cheque are the sender, the recipient and the bank on both sides. Putting information like that in an unencrypted email is asking for trouble IMHO.

Of course, if East Coast have implemented PGP email on their staff IT and have an easily-obtainable public key for sending encrypted email, that's fine. But I suspect not.

 

[Crossover]

I, too, have had claims dealt with by BACS with EC - although in my case I had an email from Customer Relations saying they would pay it by BACS and that the Finance team would contact me within a few days to arrange. They did and payment was duly received about a week later

I can understand suspicion when they just blanket the same email out without prior warning - if it was expected (in this case due to having a DR claim in progress) and the headers checked out (I work in IT, so I am all too aware of this - as are our users) then I'd be OK with it

 

[Tetchytyke]

Bank details are quoted on every single cheque you've ever sent in the post, and if you think snail mail is any more secure than email you've probably never worked in a post room.

One of the few things you can do with a bank account number and sort code is set up a Direct Debit without consent, which is all that happened to Clarkson. This should be covered by the Direct Debit Guarantee.

It's a shame that East Coast are getting flack for being pro-active and offering cash refunds rather than RTVs for the fiasco on the 27th. Perhaps next time they should just send the RTVs! As for "no company would ask for these details over email", TfL do when processing Travelcard refunds.

 

[jonnyclash1]

Bank details are quoted on every single cheque you've ever sent in the post, and if you think snail mail is any more secure than email you've probably never worked in a post room.



One of the few things you can do with a bank account number and sort code is set up a Direct Debit without consent, which is all that happened to Clarkson. This should be covered by the Direct Debit Guarantee.



It's a shame that East Coast are getting flack for being pro-active and offering cash refunds rather than RTVs for the fiasco on the 27th. Perhaps next time they should just send the RTVs! As for "no company would ask for these details over email", TfL do when processing Travelcard refunds.

Damned if they do, damned if they don't.