Victim disputes bank's claim that she was negligent

Virgin Active accused of lax security after three lockers were broken into

A nightmare experience was only beginning for a woman who returned to her locker after a workout at a Chiswick gym to find her belongings had been stolen.

Charlotte Morgan had been visiting the Virgin Active gym in Chiswick Park on Wednesday 24 August. When she entered the premises with a colleague, she noticed that the security barriers at the entrance were not working so no check was being made of people entering the locker rooms.

She stored her belongings including her bank card and mobile phone in a locker at the club but, while she was in the gym, it was broken into along with three others.

She promptly reported the theft to Santander where she banked but even in the very short time between the theft and the notification, the thieves racked up nearly £5,000 on her debit card. They spent £3,000 at the Apple store in the Westfield Shopping Centre in White City before going to another Apple store in Regent Street and to Selfridges in Oxford Street buying a range of high-priced items. Ms Morgan says that the Selfridges transaction was initially flagged as fraud but then approved three minutes later.

Santander did not respond to our question as to why such an uncharacteristic spending spree was not blocked by fraud protection.

Ms Morgan was aware that, because the purchases were made with her debit card, she would not be entitled to an automatic refund as would be the case if a credit card was used, but she was unprepared for the response from Santander which prompted her to detail her experiences on Twitter.

After a long wait on hold to get an update on her case, she eventually managed to get through to a Santander fraud team who she quotes as saying, "Oh yeah, you ain't gettin' your money back". When she asked why she was told, "Because they used your PIN number."

They alleged that the purchases were possible because she had either left a piece of paper with the card with the PIN number on it or had shared it with friends or family.

Ms Morgan insists this didn’t happen because she rarely uses her PIN. Her subsequent research revealed that the PIN is embedded on the Santander banking app on her phone and she believes that is the way the thieves obtained it.

She uses facial recognition to access her phone and rarely enters her passcode so claims it would be impossible for the thieves to have gained access to her phone through any negligence with security on her part.

Several articles have been published online by several sources saying that facial recognition software on smartphones isn’t completely fool proof and thieves can bypass it to gain access to your details.

Once thieves had access to the banking app on the phone it is thought possible that they used the PIN reminder function on the Santander app to discover the PIN.

When her account was frozen, Ms Morgan explained to the bank that her phone had also been stolen and that number should not be called. However, when she finally received a new sim to restore the phone, she found that Santander had contacted it twice while it was in the possession of the thieves.

She also learnt that the thieves had manage to spend such large amounts on her debit card because they had used the Santander app to transfer money from her savings account in two lots of £2,500, once again without raising any red flags for fraud.

Ms Morgan commented on Twitter, “There is clearly a huge security loophole that they know about and until we crack it this will keep on happening. We're talking seriously organized, sophisticated and calculated fraud on a scale and speed like never before. Ignoring it by blaming the victim cannot be the answer.

"For them to have known or guessed my PIN is impossible, yet Santander refuses to entertain any other explanation. Simply saying my PIN was used does not mean I authorized the purchase.”

In addition to the theft of her phone and cards, her house and bike keys were stolen requiring the purchase of new locks.

A spokesperson for Santander refused to give answers to questions about the concerns raised by Ms Morgan saying, “We take protecting our customers’ accounts extremely seriously and have comprehensive fraud prevention systems in place. We are investigating the details outlined by our customer on social media as a matter of urgency and contacted them as soon as we were alerted to the case to discuss the issue further.”

We asked Virgin Active if they could confirm Ms Morgan’s report that the security barrier had been out of action at the time of the theft. Ms Morgan says that the company is refusing to take any responsibility for what happened. A spokesperson for the company said, “We’re working closely with the Metropolitan Police regarding an isolated incident that took place at Virgin Active Chiswick Park last week. We cannot confirm any further details at this moment in time.”

August 31, 2022