My Adventures with a Freeman

[Hyrion]

Couldn't agree more, there's no way any mortgage company would speak to any third party about any aspect of another persons mortgage, you simply would not pass the security questions.

Sadly - don't be too surprised at the incompetency of bank employees or the lack of real security.

Last year (end of July) someone "hacked" my chequing account. They called up the Banks phone support and with minimal publicly available information managed to get the person on the phone to cancel my card reporting it as lost/stolen. They additionally got the minimum withdrawal amounts increased to the max possible.

The following banking day went into the bank and another bank rep handed them their own card.

End result: in a 3 day withdrawal spree they took out roughly $3,800 before the banks software security mechanisms detected the abnormal activity and locked the account. I found out about it 2 days later when I went into a branch for a transaction. The teller indicated the card I was using had been reported lost/stolen - that raised red flags given I hadn't done that. That night I logged online, put together the sequence of events and the following day raised an issue with the police and the bank both.

So... don't be too surprised if someone can contact a bank as a secretary and acquire info even if that is absolutely against security practices ... assuming the Bank has that as a security practice.

Also Sadly: even though I've followed up with the police I have not heard the tinest peep from them. The bank did refund most of the withdrawn amounts (the missing points were 3rd party fees for ATM withdrawals).

[mufc1959]

Hyrion, I don't doubt that must have been an awful experience. But the situation with mortgage accounts in the UK is very different. For all lenders, account administration is centralised, with an initial call going to a call centre. There is incredibly strict monitoring of the KYC requirements and data protection compliance. It's extremely unlikely that a female caller - even posing as the male borrower's 'secretary' - would get past the initial check when the screen would show that the account is in a man's name, even if that person had the correct security information.

[AnOwlCalledSage]

But the situation with mortgage accounts in the UK is very different. For all lenders, account administration is centralised, with an initial call going to a call centre.

I do not doubt of that for a minute. I also think that anyone posting here is entitled to be pulled up for lackadaisical facts. I know I have and I think this rigour makes this a better forum.

That said, I ended up in a little difficulty with my mortgage in 2012. I don't want to point fingers at any financial institution here but I started getting calls from a "building society" that operated "nationwide".

Unsolicited phone call:
"Hello Mr XXX, I'm from YYY. Before we can speak I need to go through some security questions with you."
"But you've called me. I don't know who you are. You have withheld your number."
"I need to go through some security questions with you."
"I will not give you that information over the phone. You called me. Can you give me a publicly documented number to call back on?"
"I'm afraid I can't do that. Can you confirm the first line of your address?"
"I don't know who you are. Surely you already know my address if you say you are YYY. Can you tell me what it is so I can confirm who you are?"
"I can't do that. I really do need to go through these security questions before I can talk to you."
"I have no way of knowing that you are who you say you are. Please can you give me a number to call back on that I can check?"
"I am not authorised to do that."
"Thank you for your call." (I hang up)

With variations of this conversation, this happened at least 5 times until they sent me a letter which I did respond to!

[mufc1959]

But the situation with mortgage accounts in the UK is very different. For all lenders, account administration is centralised, with an initial call going to a call centre.

I do not doubt of that for a minute. I also think that anyone posting here is entitled to be pulled up for lackadaisical facts. I know I have and I think this rigour makes this a better forum.

That said, I ended up in a little difficulty with my mortgage in 2012. I don't want to point fingers at any financial institution here but I started getting calls from a "building society" that operated "nationwide".

Unsolicited phone call:
"Hello Mr XXX, I'm from YYY. Before we can speak I need to go through some security questions with you."
"But you've called me. I don't know who you are. You have withheld your number."
"I need to go through some security questions with you."
"I will not give you that information over the phone. You called me. Can you give me a publicly documented number to call back on?"
"I'm afraid I can't do that. Can you confirm the first line of your address?"
"I don't know who you are. Surely you already know my address if you say you are YYY. Can you tell me what it is so I can confirm who you are?"
"I can't do that. I really do need to go through these security questions before I can talk to you."
"I have no way of knowing that you are who you say you are. Please can you give me a number to call back on that I can check?"
"I am not authorised to do that."
"Thank you for your call." (I hang up)

With variations of this conversation, this happened at least 5 times until they sent me a letter which I did respond to!

I've had that exact same conversation with a building society that operates nationwide, where they've been trying to talk to me about my ISA. But that's a different scenario from someone who is obviously not the account holder (i.e. a woman calling about a man's account) calling the bank.

[NYGman]

I think you may be applying recent standards to a less stringent past. It also can be impacted by regulation, and enforcement actions, so may differ by institution. While today, this would raise red flags, as recently as 15 years ago, you could still get remarkable access by just stating you were working for the person in question, if you had most of the relevant information. While many more years ago, things were much more lax, over time, with abuse, and fraud, plus regulation, there is now a minimum standard, for which some institutions may actually go beyond, but still apply to legally permissible levels.

So depending on when, and which institution was involved, there is a possibility that the events are as described. Knowing the year, would help determine what rules were in force at the time, and how soon after a change this occurred, as sometimes there is a grace period, or mistakes made initially. The actual bank would also be of interest, as there may be some public disclosures about fines for non-compliance, that can be factored in.

TL;DR Agree this shouldn't happen today, but it could have in the past