Hi Jen
Thank you for getting back to me and for letting me know that the call was genuine. I appreciate your doing so and for letting me know what security details Bulb will ask for. I did get an e-mail but it was without authentication or even any resemblance to any communication that I have ever had from Bulb, which is why I didn’t respond to it.
However, I have to say that the Bulb security protocol is entirely inadequate. Surely you can see that any fraudster, having somehow learnt my name and phone number, could be in a fair way to stealing my entire identity should I be so trusting as to give out the information that Bulb requires as security information?
I acknowledge that the phone call did ask for me by name so it could not have been fraudsters using an autodialer (I never give my name on answering the phone). However there is no way that, with the current protocol, I could have any confidence as to to whom I was speaking before giving away highly sensitive information. There is no way that I am ever going to volunteer any of this information to an unknown caller. I appreciate that Bulb needs to know that I am me if they call - but I also need to know that it is really Bulb calling me.
Bulb needs to have a better protocol for calling its’ customers. Based on a better understanding of how identity fraudsters steal personal data. For example landline area codes and postcodes can be roughly linked by anyone with a map of the physical locations covered by each code. Anyone with a landline area code can make a fair guess as to the first part of the corresponding postcode. I have myself been targeted by just such a scam, in that case they didn’t know my name but did know the area where I lived. They also claimed to be calling from my energy provider. Number spoofing I already covered in my original post.
It really ought not to be too difficult for Bulb to come up with a better system. Phone banking has been around for decades and Bulb could base a protocol on the systems that banks use. Generally the banks set up a codeword, and often also a memorable date and memorable name. The strongest codewords are made up of three words. So I might set up my account with codeword “bulbenergycompany” for example.
One of the key features of the bank telephone protocols is that they never ask for the whole of some identifying piece of information, instead they might ask for the 1st, 5th, 13th and 16th letters for instance. Which would be b _ e _ m _ n. Which I could safely give out as it would be meaningless to anyone without access to the correct codeword. The banks then do the same with the memorable date and name. For added security for a customer I would ask Bulb to provide, should I ask it to do so, digits that I request from a reading from a given bill in the last year. So if the reading on my May bill had been “98765” and I requested the 1st and 4th digits Bulb should reply with 9 _ 6 - which is meaningful only to me and to Bulb and is not sensitive personal information that Bulb should worry about divulging.
More of course could be done with software, but I’m not expecting miracles, or much investment, from a company currently in administration. However, if I can come up with a barebones safety protocol just whilst sitting here replying to your post, then surely Bulb can do better. It is supposed to be a professional, security conscious, high tech company, after all.
I still do not know what the original phonecall was about. However, I suspect that it was likely to have been about increasing my direct debit. Now about 80% of my annual electricity usage happens when I turn on my Economy7 heaters which will be mostly for about three months in winter. The rest of my bills are significantly cheaper. I understand the need to build up a pot of money over the cheaper months, but, frankly, I am not willing to save up that much credit in a company in administration, the customers of which might be taken over by British Gas (poor reputation for customer handling) or some company in the UAE (potentially dubious ethically). So I am saving each month in an interest bearing account. I also know that I have had double glazing fitted and two ancient heaters replaced with modern programmable, thermostatically controlled heaters (difference in monthly units used 400kwh down to less than 50kwh) so my electricity usage will decrease. The Bulb algorithms want to set my direct debit, even the minimum amount, to too high an amount. I would build up an unacceptable amount of credit over the summer months. However I have used the Top Up by Direct Debit function for the last couple of months to ensure that I do not run into debit, and I will continue to do this.
Of course Bulb can insist on increasing my Direct Debit. But then I can insist on having the excess credit refunded to me. On a monthly basis if I need to.
Don’r worry, I am not about to run into debt. In fact my annual budget already factors in a further price increase in October which is at least as great as the recent April increase.
