T-Mobile Data Scandal

17th November 2009

Have you ever wondered why you sometimes get cold-called about your mobile phone contract when it's about to expire.. but the people who are calling are not your mobile phone operator?

A revelation that staff at T-Mobile UK illegally passed millions of customer records to third parties might explain why - but this is possibly the tip of an even bigger iceberg.

T-Mobile themselves say that they are not responsible for this leak, and that staff unlawfully sold the data on. But why? Well, the motivation is simple - money. Selling someone a new mobile phone contract can earn the person selling it £100 or so, meaning that this is potentially a big business.

In this case, T-Mobile themselves discovered the leak and passed the information to the Information Commissioner's Office (ICO). Their report [PDF] shows a determination to prosecute those responsible for these activities, and said that it appears the information has been sold on to several brokers and that substantial amounts of money have changed hands.

T-Mobile may not be alone, it's a common complaint amongst consumers that they sometimes get confusing phone calls about contract renewals - so it may well be more than just T-Mobile employees who are breaking the law.

One possible example of this "call centre fraud" is documented here - This current round of cold calling is on behalf of O2. [They appear] to have subscriber details - when they finally do talk to you rather than putting the phone down, they greet you by name. [..] The caller [..] claimed to be working for O2 (this is known in the trade as a lie). Our attempts to talk to a supervisor at [the caller's company] resulted in the caller putting the phone down. In this case, they do seem to know the name of the subscriber (in this case the phone had previously been with Vodafone and then transferred to T-Mobile).

From the same site a similar story says: I finally managed to answer a call from these people saying they are calling on behalf of O2 regarding my contract. I pointed out I have nothing to do with O2 (seeing as i'm with T-Mobile) and quoted the data protection act to have my details removed from their systems and receive no further calls. A very grumpy "fine" from the gentleman and the other end and then he hung up. So lets see if i get any further calls.

One problem is that these "leads" tend to get sold on and resold though several different companies - so stolen data can effectively be "laundered" and resold to legitimate call centres and carriers. By the time the poor consumer is hassled by cold-calling, the true perpetrators of the data theft are concealed behind several layers of confusion.

So just how much is one of these leads worth? Our research shows that a single customer's details can be worth between 50p to £2, depending on the type of customer. And although that doesn't sound like much, when you consider that hundreds of thousands, or perhaps millions of records have been plundered, then it looks like this is a very serious fraud indeed.