A Cautionary Tale (HSBC Travel Money)

My wallet was stolen on Tuesday, while I was running a conference in a venue near Reading. I'm not too sure at what point, although I've narrowed it down to a window of opportunity of around six hours on the day in question. This is a first for me, as I've stayed in numerous hotels over the years without problems.

In my wallet, as well as a debit and credit cards and less than fifty quid in cash, I also had the plastic part of my UK Drivers License, plus a few random loyalty cards and some membership cards like my Rotary International card and my Bristol Libraries Membership Card.

The staff at De Vere's Wokefield Park were very helpful, but since the supervisor had left (at 17:00) the reception team weren't able to open the "Lost Property" box to check whether my wallet had been handed in. This probably didn't make much difference this time, but in other circumstances perhaps a guest would have delayed reporting the loss due to this policy.

Immediately, I contacted my bank (HSBC) and my credit card company to cancel the cards. I also logged on to my Internet banking service to have a look at my statement. And I was surprised to find a single charge for the following:

29 Jul DR TRAVEL FACILITIES 2517.33

Bit odd, I think: I haven't bought any plane tickets this month. Time to call the police. Or rather, email them.

Deciding to put yesterday's advice to one side, I signed on to Avon and Somerset Constabulary's Online Non-urgent Crime/Incident recording service. And it's really very good. Through the encrypted website, I was able to list all the details of the incident and the lost items that would otherwise have required me to take up a Police Constable's time for a couple of hours while s/he drove out to my house (obviously not the crime scene) to take a statement and write it all up in Biro. I even got my "Crime Number" by email.

Meanwhile, I rang HSBC to enquire about the "Travel Facilities" transaction. The crack team at the call centre were straight on the case.

A few days later, after a couple more calls to Bangalore and a bit more digging, it turned out that "I" had walked into the HSBC branch in Newbury and purchased £2517.33 worth (including fees) of foreign currency.

It would appear that you can walk into any random HSBC branch with a Debit Card, the account holder's photographic ID and a library card, and walk out with £2517.33 (excluding fees) of cash in any of eighty currencies of your choice. And you don't even need to know the PIN or be able to forge a signature. This service is known as "Travel Money", presumably because it allows your money to travel from your account into someone else's pocket.

No doubt my refund from HSBC is already on its way, so I'm not too bothered. But it does raise some interesting issues. Getting challenged for ID is not uncommon these days. I can think of occasions when I've been asked for ID (Drivers License or Passport) before setting up loyalty cards, non-credit accounts, and picking up pre-booked tickets. Having ID on hand for these challenges is convenient, but the risk associated with routinely carrying your ID would appear to be higher than one might think.

I'll be watching my Experian Credit Expert service like a hawk for the next few months just in case there's a follow-up Identity Theft attempt.

The Database State has its merits

In another first, I then used the DVLA's web service to find out how to request a new Driver's License. I was assuming I'd have to fill in a form, take it to the Post Office and perhaps even send off my Passport as verification. But, no: it's all online now. You will be charged £17.50 for the privilege, which can be paid online if you have any cards left.

I have a Government Gateway account, which I originally obtained to sign up for the National Blood Service. This is a single sign-on service for government applications, and it is now in use by the DVLA. Once you are logged in, you can order a replacement drivers license as long as your address hasn't changed, and as long as you have a UK Passport. The latter is an interesting point: to verify your transaction, the DVLA ask for your Passport number. So the relationship in the databases between your passport and your drivers license has already been made.

I don't like laws that make the refusal to carry identification papers a crime (see NO2ID), but the focus on the physical bit of mandatory national identity systems is somewhat irrelevent as the underlying database is already being built. Databases are tools, and like any tool can be put to virtuous or malign purpose, which is why I worry less about the data and more about the people using it.

Overall, assuming HSBC don't start prevaricating, I'm down about £100.00, plus a few old photos and other items of sentimental value. A reasonable price for a useful lesson.

Things to remember

1. Make sure you've got the "Lost or Stolen Cards" number on your mobile phone for any card you carry. Cardwatch maintains a comprehensive list.
2. Don't carry financial payment cards that you don't use.
3. Think twice before routinely carrying ID cards, or indeed any card that could be used by a fraudster to "blag" a transaction.
4. Problems with your bank? Get on to the bank manager. And if that doesn't work contact the Financial Ombudsman Service.

A quick Google Map:

View Larger Map