3

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called Bounce Mobi, and that I had subscribed to it. I hadn't. They refunded the money, then I received the following email almost immediately:

Hello,

We have received a request from your network provider that you would like to learn more about a subscription service that was requested on the mobile number 447719xxxxxx. Thank you for getting in touch - I have provided all the information you requested below:

You were subscribed to the Bounce.mobi Gaming Portal at a cost of £1.50 per week. Our records show that you interacted with one of our advertisements. This took you to our subscription page where you then confirmed your subscription on Saturday 2nd of January 2016 at 09:52:39 PM whilst browsing on your phone using a data connection. I have attached a picture of the type of subscription page which you interacted with in order to subscribe to this service. You will notice that the subscription page clearly shows all details of the service.

This subscription is still active however I have asked our customer service team to stop this subscription. The subscription will be cancelled within 1 working day and you will receive a text message to confirm this.

This is a subscription service where your weekly payment gives you access to our website, there will not be a downloaded 'app' on your phone. A link to the product is sent to you upon subscription via text message and in your monthly reminder message.

I hope this clears everything up, however, if you have any more queries then please feel free to call us on our helpline number, 0330 122 4968, or manage your subscription on our website www.mobilechargesupport.com.

DO NOT REPLY TO THIS EMAIL, PLEASE CALL OUR HELPLINE NUMBER 0330 122 4968 OR VISIT OUR WEBSITE www.mobilechargesupport.com WITH ANY QUERIES.

Kind regards, Emma Bounce.mobi

Note: The phone number was correct, not xxxxxx.

This did not occur, admittedly I may have accidentally clicked on an ad, but I didn't additionally confirm, that is for sure (the legal argument of taking money without further data input, name, address, etc would be a separate discussion).

I'm concerned my phone actually shared my mobile number with the website, as they allege. So my question is, is this even technically possible?

2

You didn't specify whether your phone is Android, iOS, or other. In any case, the mobile security model prevents websites from retrieving the phone number of a device. It could be possible to do so if a vulnerability existed on the browser/phone that allowed this (for example of similar vuln see http://lifehacker.com/5946919/check-if-your-android-device-is-vulnerable-to-the-remote-wipe-hack).

The other way to retrieve the phone number would be through an app installed on your phone. In Android, such app would have to have certain permissions enabled; in this case it would be:

<uses-permission android:name="android.permission.READ_PHONE_STATE"/>

It is also possible that you provided some information to this game provider that they in turn use to identify yourself against your mobile carrier to enable these charges. However, I don't know which piece of information they use or what's the business process behind it.

A final note, the act of using your mobile or land line as a "credit card" of sorts is called cramming. You can see more information about it here: https://www.fcc.gov/consumers/guides/cramming-unauthorized-charges-your-phone-bill

2

Technically possible? Yes, legally possible, no.

When using a data connection via any of the UK carriers, it is not possible to determine the subscriber number from data available to the server. They must have had your subscriber number in order to levy charges against your phone account.

It is theoretically possible that you have some malware in your phone which is exposing your phone number to some (or all?) sites.

It is also possible that they provide a text input on their site to enter a mobile number and then send charges to that number - this breaks OFFCOM rules.

Further, when you are subscribed to a billed service such as this, the organization providing the service is required to send you notifications at commencement and regular intervals throughout your subscription.

I worked for a similar company a number of years ago - and would trust a rabid crocodile more than anyone involved in mobile phone micropayments. Sadly my experience was that the primary function of OFFCOM was to act as a firewall protecting such people from angry customers.

Under law you are entitled not only to your money back but any expenses (including your time) incurred in resolving the issue. But good luck with that!

Update

My information was somewhat out of date.

I am somewhat alarmed to discover that even Offcom were failing to adequately undermine consumer's rights and have now delegated that responsibility to Phonepayplus, adding further complication to resolving inappropriate or unlawful practices by PRS providers.

Could it get worse?

Yes, PhonePayPlus have removed the requirement (see section 2) for PRS operators to notify you that you are subscribed to a premium rate SMS service.

I was also wrong about the current state of affairs regarding divining one's mobile number from the IP address. And PhonePayPlus's definition of "Robust verification" of consent to charge (see section 2.14) says that retrieving a page from the website containing the terms is adequate.

So its completely legal if a provider makes up data or have bugs in their software. After all, who could possibly fake a screenshot (2.14b)?

I'm off to write a clickjacking site.

  • I am going to change my accepted answer for this question, sorry. I agree with you that this shouldn't legally be possible but after the response from the ICO I'm going to flag my post as the answer to highlight their attitude towards this. – Family Apr 5 '16 at 9:39
  • 1
    It's extremely frustrating that there seems to be no recourse to get this kind of thing shut-down. It's organized crime being condoned by the ombudsman that were, I presume, initially set-up to stop this exact kind of activity. – Family Apr 6 '16 at 13:27
1

Not normally no. O2 added subscribers' numbers to outgoing requests a few years back (apparently accidentally): http://www.zdnet.com/article/o2-fixes-mobile-broadband-number-leaks/ but this should obviously not happen without the user's consent.

1

After a few weeks I did get a response from a query that I sent to my mobile phone provider (EE). This is the e-mail:

Good morning Mr Coles

Thank you for your email.

I hope that I am able to address and answer the question that you have raised.

If a customer chooses to access the internet via their mobile phone by using mobile data as opposed to using WIFI, then yes the websites that are visited can obtain the mobile number of the device they are using.

If you are unhappy with how the subscription has been set up with Bounce Mobile you can Phonepay Plus who regulate UK premium rate services. You can raise your concerns with them via their website - http://www.phonepayplus.org.uk/

I hope this helps.

Kind Regards

Beverley Challinor

Executive Office

So, apparently it is freely available to a website (at least on EE in the UK). I don't like it, but there it is.

UPDATE. Reply from the ICO

I eventually received a reply from the ICO. I originally thought that they had ignored my concerns about me not authorizing payment to bounce.mobi, but checking my email it just addressed my concern to them about EE sharing my mobile data. If I'm to follow this up I would need to write a new letter concerning the issue that bounce.mobi charged my mobile phone without anything more than apparently me clicking somewhere on my screen (which I'm not 100% convinced I did that), whereas I would expect the entering of additional details at least, which I absolutely know I didn't do.

Anyway, here is the email:

5 April 2016

Case Reference Number RFA0619487

Dear Mr Coles

Thank you for your correspondence regarding your concerns about EE and Bounce.mobi. Please accept my apologies for the delay in responding to you. Our office is currently dealing with large volumes of work. This has meant we have been unable to deal with incoming correspondence as promptly as we would like.

The Information Commissioner’s Office

Under the Data Protection Act 1998 (the DPA), those who collect and use personal information have to follow rules of good practice (called the data protection principles). The DPA also gives rights to individuals whose information has been processed.?

When eligible concerns are brought to us we will make a decision, which is our view about whether the rules of good practice for handling information have been followed. We do this by saying whether we think compliance with the DPA is likely or unlikely.

The Information Commissioner’s Office is only able to investigate concerns where we have received specific documentary evidence of what has occurred. It is not the role of the Information Commissioner to seek evidence on behalf of individuals – as a regulator the Information Commissioner needs to be seen to be fair and impartial.

Your concern

You are concerned that EE is sharing your mobile phone data with web servers when you connect via their mobile data plan.

We note you have raised your concerns about Bounce.mobi with EE and they have confirmed the following:

"If a customer chooses to access the internet via their mobile phone by using mobile data as opposed to using WIFI, then yes the websites that are visited can obtain the mobile number of the device they are using."

Please note that websites can only obtain your mobile number when you give them your consent to do so.

In this case Bounce.mobi has confirmed that "we only offer a service that subscribers choose to join themselves. You were subscribed to the Bounce.mobi Gaming Portal at a cost of £1.50 per week. Our records show that you interacted with one of our advertisements. This took you to our subscription page where you then confirmed your subscription on Saturday 2nd of January 2016 at 09:52:39 PM whilst browsing on your phone using a data connection. I have attached a picture of the type of subscription page which you interacted with in order to subscribe to this service. You will notice that the subscription page clearly shows all details of the service."

Case conclusion

In this case we have no evidence that either EE or Bounce.mobi have not complied with the DPA. This is because Bounce.mobi has confirmed that you gave your consent to subscribe to their services and we have received no evidence to the contrary. In addition we have no evidence that EE has shared you mobile phone data inappropriately or without your consent.

We are sorry we are unable to assist you further; however we hope this information is useful to you.

Yours sincerely,

Carolan Hunter Case Officer Information Commissioner’s Office Direct

  • That is interesting. Could you have a look through any contact you have with EE to see if they mention this. I'd also be tempted to poke OFCOM and/or the ICO... – Matthew Mar 3 '16 at 19:10
  • I can't find any mention of this anywhere at EE. – Family Mar 4 '16 at 11:19
  • I have just sent an email to the ICO. I shall look forward to reading what they have to say. – Family Mar 4 '16 at 11:35
  • Added update to include response from the ICO. – Family Apr 5 '16 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.