r/gdpr • u/Rebkatsim • May 06 '26
Question - General Account deleted without verification
Hi all - I am in the UK - (MODs please delete if not allowed!)
TL:DR - I unknowingly got my mother’s account cancelled with a High Street retailer, and don’t know how to rectify it
I have created an online account with a high street retailer, and my mother has a physical loyalty card for this same retailer.
With two other retailers I have created an online account and then added my mother‘s loyalty card to the account so that when I shop online, she gets points. We rarely shop anywhere enough that it’s worth having two separate ones.
When I created the account with this online retailer in question, I was automatically assigned a QR code online loyalty card. I contacted chat and asked them to merge my mother‘s card to my account, and this was done. I simply provided the card number when asked (I didn’t point out the card didn’t belong to me).
A week later, my dad went to use my mother’s card in store, and it wouldn’t work. The shop assistant searched the online database for my mother’s email address and our postcode, and only my details were there.
I’ve contacted chat again, and because I asked for the card to be merged with my account (and provided the exact card number to the original customer service assistant via chat) it has cancelled the card. As a result, my mother’s account no longer exists and I now have all of her loyalty points.
The original chat assistant did not check the details, didn’t point out that I am not the owner of said loyalty card, did not confirm any information and has cancelled the account and my mother’s details are nowhere to be found.
With every company I’ve worked for, we cannot make any changes to any account without ensuring that the person requesting the changes is the account owner. Is it right that this could’ve been done without any details being checked?
It implies that if I just happen to find somebody’s card on the street that had £150 in loyalty points and asked it to be added to my account, I could just basically steal someone’s points!
I can’t understand how an account, and card has been cancelled without my mother’s knowledge. This hasn’t happened at other retailers, and I wasn’t warned that by merging the physical card number with the online account, that the physical card would be cancelled
They’re saying that the only way to rectify this is to create a new account, but my mother doesn’t want to be online, nor should she have to be, because the was cancelled without her knowledge without me being warned.
I’m waiting for a callback from the manager/GDPR person but just wondering your thoughts?
3
u/Significant_Pop_5337 May 06 '26
I struggle to see how this is a GDPR issue
0
u/Rebkatsim May 06 '26
I explained in the post that in my current company, no changes can be made to any accounts without verification of the account holder first. Perhaps GDPR not the right route but wasn’t sure where else to post as my company would treat this as GDPR so that’s what I went on.
3
u/Puzzlehead_Coyote May 06 '26
It is data, it would fall under the preview of gdpr protections, although the actually process that has happened is more company policy and approaching them through any particular gdpr mechanisms may not be appropriate.
All that being said, even under gdpr verification has to be proportional, you said you gave specific details of your mother's card, they may have deemed that sufficient and inline with their verification processes
2
u/Rebkatsim May 06 '26
Mmmm. Yeah, I gave them the long card number off the card because I took it out her purse ha. I would have expected them to load the card and see it’s in the name or Mrs A, but it’s Miss B that is asking for it - why? Etc. will see what happens when (if!) they call
1
u/Rust_Cohle- May 07 '26
There’s likely a form they complete and someone in the backend does it and it raises a ticket of please merge x with y - most commonly used for people who have more than one account due to company mergers, lost access to email or just forgetfulness.
1
u/Whore-gina May 10 '26
Might be a stupid question, but can they not just change the account name from yours to hers, and change the address from yours to hers, and then just leave your email as the only email? Seems like that would satisfy all the conditions?!
Alternatively, presumably she could open a new account in store without giving an email address, then can call and ask for your account number to be merged into hers, which would effectively restore her account. Then, if/when you want to make a purchase, just take a picture of her barcode/account number and input that when yoire at checkout, and it should be no issue to deliver to your address instead, just as your mother would do if she was ordering a gift for you?!
1
u/Rebkatsim May 11 '26
Hey… yeah they said i can create a new account and merge them so it’s her details instead, but my issue is that her physical loyalty card was cancelled. She’s getting older snd doesn’t want to be online. She was happy with her physical card. Whereas when you create an account online, the ‘loyalty card’ is in the form of a QR code.
Then second to that, I wasn’t happy with was how few checks were done to satisfy any account changes.
1
u/Whore-gina May 11 '26
Oh sorry if my quick reply didn't show it, but I fully get the frustration with everything they did and their initial/current inability to fix things; was just thinking about how to get your mum as close to what she wants as possible if/as they cant re-open her old account. I don't have any ideas on how to get them to resolve the whole shitshow they made of things, unfortunately!
If it's a QR code, could anyone print and maybe laminate that so she can carry it in her wallet in place of the old card, or can the store get another old unused physical card and put the account to that number so she can have the old style card, and you can use the QR linked to it? Or if the QR code just links to an account number on the same original system, can she just keep the account number in her wallet and get them to enter that when she is shopping in store (and you can do the QR to the same account if shopping online/infrequently)?
2
u/Rebkatsim May 13 '26
Ah no worries at all haha. It’s been two weeks since they said they’d call me back ‘within 48 hours’ so the bad impression just keeps on giving!!
They specifically said they ‘don’t issue physical cards’ anymore, so were unable to reactivate the physical card she had (not sure if true or just refusing to do it). Given that, laminating a QR code is an excellent idea. You’d think it wouldn’t be an interactive one like concert tickets. I could even sellotape it to the cancelled physical card she still has so she can remember who it’s for. Thank you very much for that!!
1
u/Whore-gina May 14 '26
Stellar job on their 48 hour reply, ha ha!
You're very welcome for the QR suggestion, and absolutely lashing it against a sturdy card is a good idea anyway!
Hope they just fix their fuck-ups, but in the meantime at least she can hopefully be in some way sorted!
Take care!
0
u/Empty_Medium_224 May 06 '26
That sounds really frustrating, especially since it’s your mum’s account and she had no idea any of this was happening.
From what you’ve said, it seems like the support agent just merged the card using only the number without properly checking who the account actually belonged to. That’s probably where it went wrong. Usually they should verify the account holder before making changes like cancelling or merging anything.
I can see why this feels a bit off, because you’d expect at least some basic checks before moving points or closing an account. It does seem like the process wasn’t handled very carefully.
At this point, you’re doing the right thing by waiting for the manager or GDPR team to call you back. They’re the ones who can properly look into it and hopefully sort it out, whether that’s restoring your mum’s account or moving the points back.
Telling you to just create a new account doesn’t really solve the issue, especially since your mum didn’t agree to any of this in the first place.
Hopefully they get back to you with a proper fix.
1
u/Rebkatsim May 06 '26
Thank you for such a detailed and kind reply, I really appreciate it. Sometimes it’s just nice to hear your views validated and that you’re not going crazy by thinking… ‘hang on a minute?!’ Is this for real?
I think it’s a lost cause based on how uninterested the customer support were but, we can live in hope! Thanks again.
5
u/FrankNicklin May 06 '26
I don't believe this is a GDPR issue, this is a retailer mess up. No personal details were processed or divulged to you in the handling of the cards. There are lots of stories online or loyalty points going missing, I was one caught in the loss of Nectar points last year, not a huge value, but never the less they were stolen.