VM don't take security seriously

[JPL8]

Anyone who uses the internet wants to be assured that their data is secure and being handled responsibly.

On Sunday (31/10/21) I found a problem with my account. When I sign in, sometimes my account name is shown correctly as "Jean-Paul" and sometimes it's "Jackie". Clearly this is concerning. So I contacted Virgin via WhatsApp (which is an epic story in itself) to share screenshots showing the problem.

Addressed as "Jackie" in the chat, I was told that the IT team would take 3-5 working days to fix the "glitch"! Not very reassuring.

Virgin didn't take my concern about fraud and data security very seriously. After over an hour of back and forth and round in circles on WhatsApp I rang them to see if there was anyone who could think independently outside of a script.

Again, I was told the IT team worked office hours and not weekends and the complaint had been passed to the fraud team to investigate. I pointed out that fraud is a 24/7 activity and I really need to know what action Virgin are taking to ensure that my account and data are secure.

After another round on WhatsApp on Monday I was promised that someone would get back to me within 72 hours … and guess what? No response.

So the only clear answer I've had is that Virgin would do nothing until Monday morning and that I won't know what they did, if anything, until maybe Friday. They didn't even offer any advice on what I could do to secure my account.

I've changed my passwords, but "Jackie" is still there.

In the meantime, all I can do is hope and pray that "Jackie" is just a "glitch". Easily fixed, apparently, but just not in the evening … or Saturdays … or Sundays … or any time soon.

Virgin, the way you're dealt with this has been pathetic. A new low in customer service even by your standards. So thanks for nothing — I've reported you to the Information Commissioner's Office and raised a formal complaint.

[asim18]

What an interesting glitch. There are people out there who could solve this within 10-15 minutes, perhaps VM should contract external help to look into this? I wonder how long this will be juggled around before the executives even find out about this urgent need to make an executive decision?

By the way the VM website is a mish-mash of code accumulated over a decade.

If you put virginmedia.com into the w3c code validator, you get 431 errors.

And just for comparison if you put communityfibre.co.uk you get 15.

And that is just the home page. It should give you an indication of just how many errors there are on the website, I wouldn't be surprised if some pages exceeded 1000 errors... They could "patch" the problem with your account, but what they really need is a complete overhaul of their website and database systems from the ground up.

[JPL8]

I was told by VM that the issue is “easily fixed”, but would take 3 to 5 working days to do. 

Here we are, over a week later, and it’s still not done. 

I can’t take the chance this is a glitch to be honest. No one would put up with it if it was their bank, so why should it be acceptable for VM to take so long to sort it out?

[jem101]

Ah now who told you it was 'easily fixed'? Was is the offshore customer services by any chance?

By far the most likely explanation is that at some point, someone misheard or mistyped your name into a field and it's either not possible to change or not obvious now where it is. Historically VM is a company made up of many mergers and acquisitions over the years and consequently, I can image that their back end is something of a Frankenstein's monster of differing systems all, somehow, being held together with the equivalent of sticky tape and paper glue.

I wouldn't be too concerned that this is a security issue as such - if you feel differently then I fear your only option is to leave as I really can't see this being anywhere near the top 100 operational issues which they need or want to address.

[JPL8]

Well, I don't think it really matters who told me that it was "easily fixed" because, whether they're offshore or not, they're speaking on behalf of Virgin Media. As such, I've already passed the full details of that conversation to the Information Commissioner's Office, including the part where I'm called "Jackie" by the representative!

One of the responsibilities Virgin have regarding data is that it must be correct and that they must correct it when it's wrong. They're failing to do that in this instance.

The main issue is that only Virgin can determine whether this is a security issue or not and they really don't seem to be too concerned about it. Different representatives of the company have dismissed it as a "glitch", which is great if it is, but a very risky thing to say if it isn't.

I'm paraphrasing what I've said before, but if you signed into your bank account and it said "Jackie" instead of "Jem" you'd be s******g yourself.

[coenoby]

---

@JPL8 wrote:

Well, I don't think it really matters who told me that it was "easily fixed" because, whether they're offshore or not, they're speaking on behalf of Virgin Media.

---

And you are right of course.

Sadly though, those of us who have been members of this forum for a long time such as @jem101 and myself come up against this issue with VM Customer Services advice quite regularly.

Time and again we read and respond to forum posts where VM Customer Services have given out totally incorrect information to  people with difficult or unusual issues such as yours. Many of us have a strong suspicion that they do that in an effort to fob the customer off  simply to close the call as quickly as possible.  It is possible the Off Shore teams are paid for calls answered rather than cases solved. In any event they do not seem to have a depth of knowledge of the VM systems

Like jem101 I think it is unlikely there is a security issue here but it is disturbing. As I said earlier, I don't see why the name should sometimes be "Jackie" and sometimes "Jean-Paul". If it was a simple data entry issue surely the name would always be the same?

I suspect the answer and solution is actually very simple but it is a case of getting it passed to the people who know. That should be Customer services' job but sadly they seem to find it easier to fob you off.

Coenoby

[asim18]

I think it is wise to assume there an issue of security. Something is causing "Jackie" to be retrieved from a database and is then feeding this record into a web page where it is not supposed to be. I'd be very worried if I was in charge of this database and website, I'd be working round the clock to sort this out.

[Steven_L]

Hey @JPL8,

Thanks for taking the time to post here on our forums.

I'm really sorry to hear of the issues that you're having with your online account, I have looked into this and can see that a ticket has been logged to resolve this issue, when you last spoke to them and this is currently still open and being worked on by the team.

We will be in touch as soon as we have a response from the team.

Regards,

Steven_L

[JPL8]

Steven, I was replying to the OP on this topic and giving them some practical advice on the best place to complain about the issue they have with VM.

I already have my own thread on the Security Matters forum. 

I have no idea why you’ve removed this from the post I was replying to and moved it here as a separate topic.

I’d appreciate it if you moved this post back to where it was as it doesn’t make any sense without any context. 

I also want to avoid any further replies to me from VM forum team in this thread, when I already have my own in the right place  

[用心棒]

@JPL8, as a ticket has already been raised the following is out of curiosity so do feel free to ignore.

When you next see the discrepancy open a new tab and go to https://my.virginmedia.com/home/userInfo.  Does the:

• userName value returned equal Jackie, i.e. "userName":"Jackie "?
• are other values returned correct, i.e. accountNumber, areaRef?

[JPL8]

Thanks. I’m willing to try anything that gets me closer to a solution, especially as VM don’t seem to be particularly engaged with this issue.

The information when I follow that link is all correct. 

Thank you, I do appreciate the steps that the community are taking to help out here.

It’s a shame that no one from VM has contacted me to ask the same questions (or any questions for that matter).