Oral evidence: Service Disruption at TSB, HC 1009

Oral evidence, 6 June 2018.

Witnesses

Andrew Bailey, John Sutherland and Sheree Howard.

Chair

Good afternoon. Thank you very much to the three of you for being here for the first part of our session this afternoon. I am going to ask you all to introduce yourselves. Andrew, it would be very helpful if you could also explain—or perhaps Mr Sutherland and Ms Howard could—their involvement in this particular issue and why you have chosen them to sit alongside you this afternoon on this panel.

Andrew Bailey

Of course, yes. You know who I am. Sheree and John are both part of our team of what we call senior advisers. We have about seven or eight senior advisers in the FCA. They have long experience in the industry we regulate. It is tremendously valuable from that point of view. They are not allocated to fixed functions so they can go across all the things we do. When we have to do things like this, where we need a special operation that needs that experience, being able to use people with John and Sheree’s experience is tremendously valuable—I will let them speak.

Chair

Perhaps you could introduce yourselves, yes.

Sheree Howard

I am Sheree Howard. As Mr Bailey has already explained, I have a long history of working in financial services, in both insurance and, more latterly, banking, in actuarial, financial and risk and compliance roles.

John Sutherland

I am John Sutherland. My background is in retail banking for a lot of years. A lot of the day-to-day activities that TSB does are very familiar to me in terms of work and jobs that I have done in the past.

Chair

Are you both working full-time now on the TSB matters?

John Sutherland

Not quite.

Sheree Howard

Not quite, no.

John Sutherland

It feels that way sometimes, but not quite.

Chair

I was going to ask you about that. Does the fact that you have been appointed signify that this is quite an unusual step for the FCA to take, Andrew?

Andrew Bailey

Can I just explain that they were not appointed especially for TSB?

Chair

Have you been appointed to work exclusively TSB for as long as it takes for matters to be sorted out?

Andrew Bailey

We will certainly use John and Sheree’s skills—and the other members of the team—for as long as it takes. It might be worth me saying that we had a full-time presence in TSB for some period of time, and John and Sheree can explain that. The PRA was also involved. It was a joint thing. We have scaled that back a bit now so that we are not on site full-time. John and Sheree can also explain that one of the things we have also done is, because there is not a single site, we covered what we regard as the key operational sites as well, to understand what was going on.

Chair

I am going to start by asking the questions particularly in relation to the fraud aspects of what has been going on. Colleagues will then have questions about the FCA’s involvement and the role of the Senior Managers Regime as well. Andrew, you wrote in the letter to us that you get daily management information from TSB about the level of fraud and about the response times. Could you give us an update on where things stand and perhaps give us an insight about what was happening at the height of the problems? Perhaps we still are at the height of the problems.

Andrew Bailey

I can give numbers certainly up to earlier this week, and then I will get John and Sheree to give you a view of the latest trends. If you do not mind, I am going to be a little bit circumspect about what we say about fraud. I am very happy to answer questions, but we do not want to give information that fraudsters could use against the firm.

Chair

That is understood, yes.

Andrew Bailey

There have been around 10,600 incidents and that has resulted in a level of pay-out. The other thing that we should probably talk about is the way in which the cases are being handled and what backlogs are emerging. I will hand over to John and Sheree, who follow it day by day, to give you an up-to-date view, and then I am happy to come back in and give you an overview of where we think it is.

John Sutherland

The statistic that is continuing to rise is what TSB calls alerts. These are alerting them to the possibility that there is a fraud, and these then have to be investigated. What that means in practice to a customer is that some element of their banking with TSB is blocked or stopped. That is a safety-first approach. TSB is resourcing up to clear those alerts as soon as it can but they are still on an upward trend. That does not indicate so much that there is an increasing amount of fraud; it is just that it is not resourcing itself yet to clear them fast enough. That is one aspect of it. The other thing we point to is that there is a huge variability in the ability of TSB to answer calls that are placed to fraud. There is a huge variability between one in 10 of calls being answered to practically all of them. It depends on the time of day. It depends on the day. If it is a quiet weekend or a quiet time of day, that makes a difference. That has also then led to some of the feedback we have seen from customers, on Twitter and the likes, about how long they have been waiting to get through.

Sheree Howard

I would support that assessment. We did note that perhaps payments were not being made within PSD2 timelines. They have got on top of that more recently, but there was a period where they were not paying within that regulatory timeline.

Chair

When you say “more recently”, how quickly are you talking? Do we mean the last couple of days?

Sheree Howard

We are talking about the last few days.

Chair

How long was the period during which they were not meeting PSD2 timelines?

Sheree Howard

I would have to revert on that.

John Sutherland

The fraud problem did not really come to the fore for the first 10 days after migration. Roughly speaking, it will be from about two weeks after migration, so the last three weeks has been an issue with fraud. They divide their fraud into what they call plastic and non-plastic, which for our purposes is a card issue, which is a PSD, and non-card, which is when people’s accounts have had the money directly taken out. That has been the problem for a lot of customers in terms of quickly understanding what has happened and getting through to TSB to explain that.

Andrew Bailey

Non-plastic has been the more—

John Sutherland

It is more expensive from TSB’s point of view because they are refunding larger amounts.

Chair

There are reports of people sitting there on the telephone, trying to report these things, watching their bank accounts being emptied, which I am sure will come up in the next session.

Andrew Bailey

We have heard that as well.

Chair

Going back to the one in 10, I am anxious to think about what the FCA requires of a bank in terms of dealing with fraud. I am assuming fraud reporting helplines are deemed to be very important and should be accessible at all times. Would you agree that if only one in 10 calls is being answered—I take the point about it perhaps being at certain times of the day or the week—that is not meeting FCA standards?

Andrew Bailey

We agree.

Chair

I understand there was a suggestion to implement, or there has been implemented, a dedicated phone line for new fraud. When did that become available and at whose suggestion was that line implemented?

John Sutherland

That was a TSB idea and it was two or three weeks ago.

Sheree Howard

It was something like 22 May or 23 May. It was some time around that time.

Chair

How did that come about? How did we get to that point?

John Sutherland

Their idea was that customers would be able to get through to them quicker by using that line. That was the idea behind it.

Andrew Bailey

John or Sheree will correct me if I am wrong on this, but when you hear the statistics for answering, it is important to look across both because of the fact that the old one still exists.

Sheree Howard

Absolutely.

Chair

So people can use either line.

Andrew Bailey

Yes, because the numbers are out there. When you get statistics for answer rates, drop-off rates and so on, from our point of view we always want to look at the combination rather than one or the other.

Chair

That is fine. You noted in your letter that TSB had not complied with the requirement in the Payment Services Regulations to refund fraud victims “by the end of the business day following the day on which the bank became aware of the problem”. What was their reason for failure and are they now meeting that standard?

Andrew Bailey

Initially they were overwhelmed.

John Sutherland

That is the short answer.

Andrew Bailey

You gave a little bit of a hint of that a few minutes ago.

Sheree Howard

Yes. From their perspective, it was an issue that they were overwhelmed and they could not cope with the volumes that they were seeing. They have now prioritised that and are back on track.

Chair

Was one of the delays them initiating gross negligence investigations into customers reporting fraud? The FCA rules on fraud mean that a firm may not be responsible for compensation if a customer has been grossly negligent. Were they using that as a reason not to refund people because they were saying, “We think you have been grossly negligent, so therefore we are going to take longer to look into this”.

John Sutherland

No. They are refunding people. For all non-card fraud, they are refunding people. They are doing a brief investigation but the idea is they will refund people who have had their money taken away. I went to visit the fraud unit at Gloucester and that is what I was being told by the agents who were answering the phones. They were quite clear. They simply needed to have a record and talk to the customer to find out how it had happened, to try to understand that.

Chair

It is difficult with the number of cases, but are you aware of a pattern of TSB trying to argue the case with customers before they refund them?

John Sutherland

I would say no to that.

Andrew Bailey

No.

Sheree Howard

Not that we have seen, no.

Andrew Bailey

To go back to the point I made earlier, it is important that they verify it, because otherwise it is “open sesame”.

Chair

I absolutely understand, yes.

Andrew Bailey

But as John and Sheree said, we have not come across any evidence of obstructive behaviour.

Stephen Hammond

Good afternoon. Can we just do a few fairly basic things. Can you tell the Committee when you were first told about the problems at TSB and by whom?

Andrew Bailey

The first warning that the FCA got was on the Sunday evening. I can tell you to the minute. We were notified at 8.59 on Sunday evening. As far as we know, they thought they had cut over to live the new systems at 6.00 in the evening. They first identified problems at 6.20, and our records are that we heard about it at just before 9.00 in the evening. We had the first call with them just after midnight that evening. Both we and the PRA summoned the call with the firm at about 11.30, and it was at 12.15, so it was pretty prompt in that sense.

Stephen Hammond

You then activated the authority’s response framework.

Andrew Bailey

Yes.

Stephen Hammond

That was activated the following day.

Andrew Bailey

Yes.

Stephen Hammond

Is it the FCA that has been the lead agency on the process the whole way through?

Andrew Bailey

In the context of the Authorities’ Response Framework, yes. Any of the FCA, PRA or the Treasury—occasionally it can be another authority, such as the Payments Systems Regulator—can trigger it. The authority that triggers it becomes the lead authority in handling it. The way it works is that if it hits your objectives and your statutory responsibilities first, you trigger it, so it is not unusual for us to be the triggering authority in these sorts of things because it hits our consumer responsibilities first.

Stephen Hammond

You triggered it and you are still the lead agency?

Andrew Bailey

Yes.

Stephen Hammond

In your letter to the Chair, you set out the four key objectives for work on TSB.

Andrew Bailey

Yes.

Stephen Hammond

The second is about TSB understanding the problems it is currently facing.

Andrew Bailey

Yes.

Stephen Hammond

Could you tell the Committee whether you think it does understand the problems it is currently facing, and have the root causes of each of the IT problems been sorted out and found? Does it know what the root causes of all the problems are?

Andrew Bailey

That inevitably has evolved over time because the understanding of the problems has evolved over time, and that is somewhat relevant to a point I made elsewhere in the letter about the previous hearing. I have had some personal experience of a situation like this at the Bank of England 15 years ago, when I became director of banking and chief cashier and I took over when the Bank of England had done something similar. I spent the next nine months heavy-lifting out of it and it is heavy-lifting. You have a pretty good idea fairly early on but you learn a lot as you go along about the precise causes of things. John and Sheree can probably add to it because they have been closer to it than me, but I would say that understanding is still evolving. I would not regard that as particularly negligent, or at all negligent. You will learn a lot of stuff as you lift your way out of these problems.

Stephen Hammond

I understand that. Are you saying that it does now understand the root causes of each of the IT problems, or that it found them initially and is now finding more? Is that what evolving means?

Andrew Bailey

Faults are still emerging but the rate of emerging faults is falling off, as you would expect. I will give you my initial reactions having had this experience. We have not done the investigation so it would be wrong for me to speculate on that, but it is no surprise that testing is going to be one of the key questions. How robust and rigorous was the testing? How robust and rigorous was not just the narrow testing of things but also what we used to call, in my day, regression testing, which is testing across the whole architecture? One of the things that we have observed happening is that they are in the business of putting fixes in. One or two of the things that have happened recently, which have had some publicity, are where they have put a fix in and then something clearly happens elsewhere in the architecture. Messages are being sent to customers that they did not expect to be sent and should not be sent. To me, that denotes the absence of robust regression testing, because these banking systems are connecting to a lot of outside systems, such as payment systems and messaging systems. These things that crop up, when you put a fix in, that you were not expecting get you back to the question of testing. That is another obvious first area of how well it is understood.

Stephen Hammond

Point 3 of the same section of your letter says that one of your objectives is to ensure that TSB has a coherent plan for recovery of services.

Andrew Bailey

Yes.

Stephen Hammond

Where are we in the timeline on having a coherent plan for recovery of services?

John Sutherland

What it has at the moment is a forward plan. It is a rolling fortnight forward plan for fixing faults that have been identified in the IT. We have not yet seen an overall plan that says, “Having done these things, we expect to be at the service level that we were pre-migration”. I am not saying it does not have it but we have not seen it yet.

Stephen Hammond

You would expect to see that in the near future. Would you not have expected that to be provided for you already?

Andrew Bailey

One of the things that came up in the last hearing is that one of the reasons it had to bring IBM in pretty quickly was that it exactly did not have that plan. One of the things that IBM has been most focused on is putting that plan together. To be fair to IBM, it was a cold start for IBM, so it had to get its arms around it.

Stephen Hammond

Your letter also implies that the chief executive when he was at the previous hearing might have been in possession of some initial slides from IBM which he did not choose to share?

Andrew Bailey

Let me say what we know about that. We had a set of slides. I will give you the timeline as to when IBM was brought in. If the problem starts on a Sunday IBM was brought in on a Wednesday and started on Thursday. By Sunday it had produced a basic set of about six or eight slides, which was essentially a first cut of the issues. We saw those on Sunday, and that was the Sunday before you had your hearing on the Wednesday. We had seen those slides by that stage. They are not definitive but they do point to things. The reason I raised this in the letter was I was reading your transcript and there was a question that Mr Hosie asked. He asked whether, if IBM did the analysis of the system, they assessed the data or looked at the hardware, and what they could bring in now to quickly resolve the problems. Paul Pester said that they believe the issues they are seeing are in the middleware, not in the physical infrastructure. It is true to say that the physical infrastructure—the hardware, if you like—has not been the issue, but it goes beyond the middleware, and that was in the IBM report. That was the particular point that struck me when I read your transcript.

Stephen Hammond

I have one final question. In terms of your investigation so far, has TSB co-operated with you in a way that you would expect since the problem has been detected and ongoing? Has it always complied with your principle for business?

Andrew Bailey

Yes, it has co‑operated. I do want to make this clear: it is working very hard at this. I do not want to call into question TSB’s application to the problem. I have seen quite a bit of Paul Pester and Richard Meddings, and I do not want to call into question their hard work. They are in a hole and they have got to get themselves out of that hole. That is not the issue for me. The issue is, “How on earth did you get here and how are you protecting the interests of customers as is now best possible to get out of it?”

Charlie Elphicke

Turning to the issue of TSB’s communications, the FCA’s fifth principle of business is, “A firm must pay due regard to the information needs of its clients, and communicate information to them in a way which is clear, fair and not misleading”.

Andrew Bailey

Indeed.

Charlie Elphicke

Can you come to a judgment, or give this Committee a view, as to whether you feel TSB has adhered to this?

Andrew Bailey

I would say this, would I not? The investigation is going to do that thoroughly. I will say this to you: we have had some quite frank conversations both at my level, as I think you have, in your involvement, about their communications, and I did set out in a letter that we were not satisfied. My view on that is that there is an onus on over‑communicating, if anything, in these situations, to explain to customers what the situation is. That is against a background of two things that are unfortunately not unusual in these circumstances. One is a lot of uncertainty, particularly early on, about what the situation was and how it would unfold. Secondly—and this is a particular point I made in the letter—about service levels that were very volatile. When you look at the daily service levels for some of the key performance measures, they are very volatile. You have days when it is 90%; you have days when it is 30%. My caution was that quoting averages in that situation is dangerous, because clearly there is a big skew either side. It does not give the entire picture to customers of what is going on. Customers know this because they are dealing with the problems face to face. My view is that there should have been more communication and it needed to be more reflective of the fact that this is a very volatile and uncertain situation. I know—and I have seen this with other institutions—that there is a natural reluctance to communicate uncertainty and volatility. It is not easy to do that. It is difficult but it helps, because otherwise you see what we saw, which is a lot of criticism from customers.

Charlie Elphicke

Is there a bit of spinning going on that is not very helpful?

Andrew Bailey

I am not going to use the word “spinning”, but a more straightforward recognition of what the situation was would have been helpful, and we said this.

Charlie Elphicke

You describe Dr Pester’s evidence to the Committee as optimistic and not rounded, and statements in public as poor and not open and transparent. Have you ever issued a letter quite like this before?

Andrew Bailey

Fortunately, we do not have these situations too often, thank goodness. John and Sheree can answer this because they have seen it close up, but of course it is true that there are some parts of the bank service that cut over without problems, that have functioned and customers have not seen the problem, and it is fair enough to point that out. There is a danger of over-emphasis of that, which gets away from the fact that there are obviously parts of the service that were very troubled. You can perhaps add some flavour to this.

John Sutherland

Yes, exactly. They have had a fairly torrid time with the branch network in terms of the systems not always working, which has generated slower transactions for the customers in the branches. Even in the last few days they have had very, very busy branches, because the systems have not been available. It has been quite clear that those systems problems still exist. What you have been told is absolutely right in terms of what is working. It is the bits that are not working that we are not hearing so much about.

Charlie Elphicke

On 25 April the FCA wrote to Paul Pester and set out its expectations for how TSB should improve its communications to its customers. Were the expectations set out in your letter reflected in Dr Pester’s evidence to the Committee on 2 May?

Andrew Bailey

I still think it should have been a more thorough and balanced communication situation. That is the thrust of my letter. I know they are under a lot of pressure. It is a very difficult situation to be in but my bias would always be, “Look, tell it as it and communicate extensively”.

Charlie Elphicke

That is understood. Your letter sets out eight principles that TSB should consider in its communications with customers. My question to you is: does TSB continue to fall short on that or has it now got it right?

Andrew Bailey

It has improved considerably. We have not been seeing the days of the rather generalised and rather rosy statements so often. It goes back to John’s point about branches. There are a lot of things going wrong in branches because they have not been able to put fixes in to the systems in branches yet. These are quite basic and important things, such as whether the system is connecting to the cheque reader or the cash dispenser inside the branch and so on. These things still need fixing and it is going to take some time, going back to my point about heavy-lifting.

Charlie Elphicke

I was reading an article in the Times this morning; it was a comment piece by Katherine Griffiths, the banking editor. In her final paragraph she said, “This is all a test of the Senior Managers Regime”. Given what has happened, do you think that people will look at whether the SMR is a paper tiger or something to be taken seriously, judging by what the FCA does in this case?

Andrew Bailey

In every case that we have, the SMR is important. It is important. Let me be clear why. It is very important because what we also have here, as came up in your previous hearing, is a relationship with an outsourced provider, which happens to be part of their parent organisation. This is Sabis, the IT subsidiary of Sabadell. That is important because it introduces governance relationships and service relationships. Tthe reason I say this in the context of the SMR is to be clear about something—and this applies whether the outsourcer is in your group or is a third party. You can outsource work—that goes on all over the place and we do it at the FCA—but you cannot outsource responsibility. That is absolutely core to this. The SMR very helpfully crystallises that directly, because it is the concept of responsibility and therefore accountability that comes through that. That accountability and responsibility does rest with the management of TSB and its senior management.

Charlie Elphicke

Finally, do you accept that people will see this as a key test for the SMR and whether, a bit like the SEC in America, it is something to be seen as, “If you do not stand up to it, you will have the book thrown at you”?

Andrew Bailey

Yes, in the sense that the investigation will have to centre around the application of the SMR because that is an important part of the judgment we will have to reach. All I would avoid is that leading to pre-assessments and pre-judgments on, therefore, what the conclusions are and what the punishments are. We set this out in our mission very clearly: we investigate and then we determine what should happen.

Wes Streeting

That leads me very neatly on to the questions that I wanted to ask, which were exactly around the role of senior managers and, in particular, the relationship with Sabadell. When Paul Pester wrote to the Chair on 27 April, he stated that the IT issues at TSB occurred as a result of migration to “a new platform built for TSB by our parent company, Sabadell, and operated by Sabadell’s technology subsidiary, Sabis”. Who in practice controlled the timing, decision-making and risk management of the IT migration?

Andrew Bailey

That would be a major part of the subject of the investigation. I set out in the letter what we observed: the fact that there were attestations made by the senior management of TSB that the system was ready to go live, and that it was made by each senior manager of TSB in respect of their responsibilities. That is important because that aligns up to the Senior Managers Regime. That would be a major subject of the investigation because what must be important, as I said earlier, was that Sabis was the developer and supplier of the service and it was utilising Sabadell’s platform, but the responsibility rests with the management of TSB.

Wes Streeting

I appreciate what you say about the investigation, but is this an issue that you are concerned about? It seems that TSB management, under the Senior Managers Regime, were accountable for the IT migration but, in practice, control rested with Sabadell? I noted that, in the interview he gave on 26 April, Paul Pester, when asked about the IT system, said, “All I can do is tell customers what my IT provider tells me”, adding that, “I have taken control”. Those are quite concerning statements, are they not?

Andrew Bailey

You are putting your finger on it. We have to be clear what control means. This is absolutely fundamental. Going back again to the processes that we would observe, we have to be clear what TSB management required and understood to be the case in terms of testing. All these system changes go through what often gets called UAT, which is user acceptance testing. That, of necessity, must be carried out by the users, i.e. TSB and their staff, so they are a fundamental part of that process. You are right to point to this word, “control”, because it is absolutely fundamental. This cannot be a black box in which something is delivered and, “I do not know quite what is in it but we will know the answer when we switch it on”.

Wes Streeting

Yes, indeed. Dr Pester’s update to the Chair of 5 June states that the TSB Board relied on written assurances from Sabis that parts of the new IT system for which it was responsible had been comprehensively tested. Do you think that written assurances from a third party supplier are sufficient to manage the risks arising from such a major project?

Andrew Bailey

I would want to see the evidence of that. Let me also go back to this point about user acceptance testing. You cannot do that process without involving the users, because you do not know whether it is going to work in your setting.

Wes Streeting

I am interested in the independence. Would you normally expect a bank to independently assure itself that proper testing had been conducted? If I have commissioned you to do some work for me, it is very unlikely you are going to come back to me and tell me what a terrible job you have done. I am putting it very crudely but there has got to be some assurance, right?

Andrew Bailey

You are absolutely right. As well as the user acceptance testing I would want a process of assurance over the testing. You can do that in a number of ways. You can hire firms that specialise in this sort of thing. You can use, for instance, your own internal audit department if you think you have the skills in that area to do it. There are a number of ways you can do it and you can do combinations of all of them, but you are absolutely right to point out that assurance has to happen one way or another, and it has to be robust. It is very hard. We have to get to the bottom of what has gone on because these attestations were made.

Wes Streeting

Given that Pester said that these assurances were instrumental in making the decision to migrate, I definitely think that this is the part of the governance of the project that you really need to dig into.

Andrew Bailey

What we cannot have is this descending into finger-pointing. That is the clear thing.

Wes Streeting

No, indeed. Finally, I wanted to pick up on the process by which each of the 12 members of TSB’s business executive committee provided personal attestations of readiness to migrate supported by risk and audit opinions. These attestations set out risks and issues and any workarounds. To your knowledge, were these attestations provided without fear or favour?

Andrew Bailey

At this stage we cannot answer that question definitively until we have done the investigation. It is obviously a key question; you are right to point that out. By saying that, I am not prejudging this either way. That is something that has to be got to the bottom of. I would simply come back to this point that they should, by necessity, have involved a line of sight through their own acceptance testing.

Mr Jack

Can we turn to switching? I am conscious of the time so I am going to try to rattle through this quite quickly. In some cases when customers have asked to switch away from TSB, the bank has written to the councils, the utility providers and others and informed them that they died. You will be aware of this.

Andrew Bailey

I am aware of this.

Mr Jack

What does the FCA expect TSB to do in those circumstances?

Andrew Bailey

John and Sheree are much closer to this, but that is another example of putting a fix in to solve a problem but then some other part of the system is sending out some letter and you think, “How on earth did that happen?” I do not think they did it intentionally. Let me get that clear. That is an example where you say, “How did that happen?”

Mr Jack

They clearly sent an automated letter to their direct debit providers, I am guessing, for that to happen.

Andrew Bailey

Yes, absolutely. You have been closer to this than I have. Do you want to say something?

Sheree Howard

From the perspective of the CASS process, yes, it has gone through a number of issues and they are looking at it still. They have an area of looking at the end-to-end process based on current information. Exactly how that issue arose I could not comment. I am not aware.

Mr Jack

Does it undermine confidence in the CASS system—the Current Account Switch Service?

Andrew Bailey

It is another example of undermining confidence in the processes. You are right to say that, as the FCA, we do not want to see this happen for a system that has been brought in and it is a key point of our objective because it enables competition.

Mr Jack

Does it undermine potential competition benefits if people are then reluctant to switch away because they read stories about what has happened to others, and they have been in the newspapers?

Andrew Bailey

One of the questions we will be looking at when a slightly longer period of time has passed is, although I do not have a number in my head as to what I would expect the level of switching to be, whether the level of switching that turns out to have happened suggests either that it has been happening effectively or that it has not been happening effectively? That is a hard judgment to make in some ways. I have seen one or two other institutions that have got into of trouble. Ten years ago we were having floods of customers leaving. These days they do not switch as much.

Mr Jack

But is that because the system does not work so well? It is not the seven-day simple service we all thought it was.

Andrew Bailey

This will be a good test of it. We have not had many tests of the system so far. Again I will want to see evidence of whether customers have found it easy, difficult and whether they know about it, frankly, as well.

Mr Jack

Are you confident no other banks similarly write to other direct debit providers, the utility companies, the local authorities and say, “This person has died”?

Andrew Bailey

I think we would know about it.

Mr Jack

You are quite confident that has not happened

Andrew Bailey

I think we would know about that.

Mr Jack

I am putting it out there for anyone who has experienced it to come forward and tell us.

John Sutherland

I think this has been a fault unrelated to CASS but was linked to it.

Mr Jack

You think it was in the TSB software?

John Sutherland

Absolutely. It is a TSB issue.

Andrew Bailey

It is back to this end-to-end testing. Because the banks, as I said earlier, are connected to many outside systems, you have to do the full end-to-end test in a full test-bed to say, “If I put that fix in, is it going to cause other things to happen?”

Rushanara Ali

The focus of my questions is mainly about compensation. TSB has appointed Deloitte to devise a scheme for compensating customers. Are you satisfied with the progress that has been made?

Andrew Bailey

We have had quite a few discussions with them about it. We are pleased that they are bringing outside resources in because it goes back to the conversation we were having earlier about TSB being overwhelmed. Bringing in outside resources is helpful. It does not have the resources to do all these things in the situation that it is in. We are pleased that it is doing that. We have observed what Deloitte has been doing. It is taking it seriously but we want to see it get up and running.

Sheree Howard

Deloitte is in the process of recruiting a significant volume of staff to deal with the complaints. We have not yet seen an end-to-end execution plan.

Rushanara Ali

When do you expect to see it?

Sheree Howard

Hopefully not too far from now. We are in discussions about it.

Rushanara Ali

Will it be in the next week, or month?

John Sutherland

I have in my head that it is within the next week. We are getting to that stage, yes.

Rushanara Ali

Great. How long, in these sorts of circumstances, would you expect it to take for a compensation system to be established? What is the timeframe within which people can seek compensation?

Sheree Howard

They have already started to resolve and settle complaints. They will then be checked against that strategy that is finally agreed, to make sure that everyone is compensated fairly.

Rushanara Ali

Sure, but what would the FCA expect to be reasonable for those things to be settled?

Andrew Bailey

It should happen quickly because it is not complex in that sense. It is clear what has happened. I doubt many of the complaints are going to be stunningly complex in that sense, because the timeline is quite short in terms of when things went wrong.

Rushanara Ali

In your letter you set out the principles for TSB’s approach to complaints and redress. Can you say a bit more about how you will expect those principles to be adhered to in the compensation arrangements?

Andrew Bailey

First of all, we would expect them to be embedded in there. We will do our own testing and observation to ensure that they are and want to see how the scheme is operating. We have not yet taken a view on exactly how we would do that. We have got the team that we can put on site to do that, and in many ways that is a much quicker way for us of doing it than, for instance, commissioning something outside. The problem with commissioning something like a section 166 is it will take us some time to commission it. My natural reaction is: we have a team; we will go in.

Rushanara Ali

On the Chair’s questions about fraud, in response to her letter the numbers we were given goes up to 31 May, which was 2,200, and then there is a breakdown of that number. Do you have any numbers since then of any further complaints and how many others have complained about fraud?

Andrew Bailey

Since 31 May?

Sheree Howard

Complaints about fraud—

Rushanara Ali

Are they giving you a regular update? They are not giving you a regular update week-by-week.

Sheree Howard

I have the overall number of complaints but not the specific split out of fraud numbers.

Rushanara Ali

Is it the same as 31 May, or have you got some more recent numbers?

Sheree Howard

I do not have more recent numbers than that.

Andrew Bailey

Our total number is 93,700.

Rushanara Ali

This is in relation to fraud. I just wondered if there were more additions since that date. In the compensation scheme established by TSB, I understand that technically it is voluntary. What will you do to make sure that the design or operation of the scheme is appropriate and properly done?

Andrew Bailey

It is voluntary for TSB to do it but these people would be within the scope of the Financial Ombudsman, so they have that right.

Rushanara Ali

Okay, but we know from our work with the Financial Ombudsman that there are major issues. They have a lot of pressure on them. How confident are you that if there are lots of complaints going to the Financial Ombudsman’s Service they can cope with the pressure, given the pressures on them? There is an issue about public confidence.

Andrew Bailey

Indeed. We would want to observe the uphold rates. What ends up with FOS depends upon the TSB uphold rates. The higher the uphold rate the lower the number of complaints that could go on to FOS. We will be in conversation with FOS about the potential for complaints to come from TSB. I would hope in this case—more than “hope”; I would expect—that TSB would set up a robust process because, again, this is not something where there is a huge amount of uncertainty around what happened. There was no uncertainty around what happened.

Rushanara Ali

You would expect TSB to proactively identify those who were affected and ensure that they are seeking and they are getting the redress that they are entitled to.

Andrew Bailey

I would expect them to publicise it very widely to their customers, yes.

Rushanara Ali

I am asking about direct contact rather than publicising.

Andrew Bailey

We will have a discussion with them about how exactly they intend to get in touch.

Rushanara Ali

If they have contact details, emails and telephone numbers, why can they not do that when they put customers at such huge inconvenience and in some cases destroyed lives?

Andrew Bailey

Those are perfectly fair points and that will be part of the plan we will expect to see.

Rushanara Ali

That is what people would expect. In terms of the compensation, would you be setting out what the minimum level of compensation that customers should expect should be, rather than it being on a case-by-case basis? Do you have any expectations of being able to say they should be setting out a minimum level?

Andrew Bailey

We will want to see how they are setting it up and calibrating it. I am not sure we would have a fixed minimum level.

Rushanara Ali

I am not saying you should set it, but would you, in these circumstances, expect them to set out that there is a minimum standard and a minimum level of compensation for the inconvenience that they face?

Andrew Bailey

There should be a minimum standard below which compensation applies. We will want to look at how they then calibrate the compensation thereafter.

Rushanara Ali

You would not be asking them to set out the minimum amount of compensation people who have been affected should be expecting. You would not set that expectation.

Andrew Bailey

People are affected in different ways, depending on which bit of their service is affected. Their services have not been affected evenly by any means. This is one of the underlying issues here. I do not think there is a standard rate for it in that sense.

Rushanara Ali

I am not suggesting a standard rate. Sometimes people get the fob off, which is, “We will deal with it on a case-by-case basis”. They might put in a lot of time, effort and sometimes money, and not get anywhere, or they might be sent off to the FOS and it is a hiding to nothing and we cannot have that. It is important that the rules are laid down by the FCA and you will appreciate, Mr Bailey, given the evidence we have received in the past in relation to small businesses and the GRG scandal—even those who put hundreds of thousands of pounds of their own money into lawsuits got treated appallingly by that bank, and the FCA fell short—that therefore the public will not have confidence in these issues being dealt with adequately, unless you lay down the law and you set out what your expectations are.

Andrew Bailey

Can I give you another example?

Rushanara Ali

Do you understand that the evidence that—

Andrew Bailey

I understand the point you are making. The example that is much nearer to this in terms of the processes would be PPI, where we have been very clear with the banks and we have followed very closely what we tend to call the uphold rates and the way in which banks have handled cases. It is a big part of the work that we have done to establish the end of the PPI process. Yes, those cases do end up with the ombudsman if the uphold goes onwards. We have been very closely involved, so I can assure you, yes, we do get involved. GRG is very different in that respect because of the nature of the regulatory perimeter.

Rushanara Ali

With respect, the public do not really see it like that. The public hear evidence, as has happened in this Committee, about the way people have been treated. These are not individual customers. They were small businesses with money, in some cases, where they put money into cases and they could not take on their bank successfully, and the FCA fell short. That is how the public will have seen the evidence and, therefore, there is a public sense that the FCA is not fast enough at dealing with the concerns of consumers. We need reassurance that in this case that will happen and you will be breathing down the necks of TSB to ensure that happens, because that is not the public’s experience.

Andrew Bailey

I would hope you would agree about how much we have been involved in TSB up to now; we continue to intend to be involved in TSB. I would go back to PPI because it is a closer analogy.

Rushanara Ali

I am talking about something different, which is the most recent evidence that we have had about the way small businesses had been treated is the GRG case—appalling cases.

Andrew Bailey

Yes.

Rushanara Ali

You will appreciate that that is what the public will remember. They will remember the fiasco of years and years of this going on with the FCA, frankly, not rising up to the challenge and dealing with their needs quickly enough. Therefore, when something like this happens, where hundreds of thousands of customers are affected—and there is a further case from last weekend in relation to Visa—the FCA is falling short in standing up for consumers. That is the challenge. What I am asking is that, from the outset, you, using your powers, lay down exactly what your expectations are and ensure that they deal with this in a timely manner so that people do not have to continue to suffer.

Andrew Bailey

I understand that.

Rushanara Ali

I am just looking for reassurance.

Andrew Bailey

I hope you have got some reassurance by the degree of involvement we have had in this situation up to now, and that we intend to go on having it. We took a very quick decision to put a team on site because it was the only way we could get a close line of sight on it, which we needed to have. We followed this very closely. I hope you got that impression from the letter I wrote.

Rushanara Ali

I hope so. I have one final point, which is in relation to late payments in wage bills for those that were affected. Will they be included in the compensation process?

Andrew Bailey

I would expect that to be so, yes.

John Mann

Blimey, Mr Bailey; you have changed your tune from your pre-appointment hearing in front of this Committee. Originally you were going to be robust then, and now you have told us there will be no finger-pointing, so we will not know who is responsible. You will look at how they calibrate compensation. Everyone can go to the Financial Ombudsman Service. You seem to suggest that it was an option whether you sent a team into TSB. The last time we had this kind of IT meltdown was the Co-Op Bank. It was a different scenario but the Co-Op Bank basically collapsed. How many other banks are at similar risk to TSB, with antiquated IT systems that might not match up, or are they now the isolated example?

Andrew Bailey

Can I first of all disagree with something you have just said? I did not say there should be no finger-pointing. I said there should be no finger-pointing between the parties involved, i.e. TSB and Sabadell and Sabis. That is what I was saying. We will not tolerate that.

John Mann

That is much better.

Andrew Bailey

Sorry. I thought I was pretty clear on that but, if not, you have my assurance that that is the case. That is what I was saying. Our investigation will be our investigation. Please do not think that we are aiming off on this one. I have not changed my tune in that respect at all. In terms of IT systems, there are major IT changes going on most weekends in the banking system, particularly at the moment, because what has gone on during the course of this year has been the changes to implement ringfencing that have been very big in the major banks—much bigger than in the TSB case. It is a question that you should probably ask them to get a clear line of sight on this, but what is particular about this one is that it is a complete re-platforming of the banking system. They were previously on the Lloyds banking system, as you may remember. This was to come off the Lloyds banking system and go on to Sabadell’s. It is not the big bank but it is a much bigger piece of work in terms of scope. That does not happen very often. A lot of the big things that go on are reconfiguring of existing systems. It is the case that most institutions are operating on systems that they have evolved over the years rather than completely ripped out and put new ones in. That does not happen too often.

John Mann

Are there other banks that are at equivalent risk of this kind of problem?

Andrew Bailey

In the sense that this is a project that has gone badly wrong and mistakes have been made, I can answer that in two ways. First, you would hope not but you can never rule out that it would happen. You cannot rule out that it would happen.

John Mann

What are you going to do to find out whether there are?

Andrew Bailey

We do a lot of work on operational resilience.

John Mann

You missed this one.

Andrew Bailey

That is interesting because that comes back to some of the discussion we were having earlier, about the question of attestations, what we were told and what TSB management were told. There is a lot still to learn about this one, I would say. Quite honestly, you can ask it from our point of view and it is a fair enough question to ask: what would it take us to observe this in ways that the management of TSB could not or did not observe, and what level of involvement and intrusion would it have involved for us to do that? I am not suggesting we go there, because that would be a very different system of regulation of any country that I know has. That question is relevant. It is also relevant and something we discuss a lot, including with the other authorities, in terms of how we manage operational incidents. Ms Ali raised the Visa incident. It was a shorter incident with less of an impact. You have written to us and you have written to the chief executive of Visa. That is very good. You should do that. Again, we were involved in that last Friday evening through the weekend. We are closely involved in those incidents. That, as I understand it, was a hardware failure. We seek to learn from all these incidents but none of us can give you an assurance that these things will never happen again.

John Mann

I would not expect you to be able to give that assurance, but it is about the systems that are in place for mitigating it. Every day we are moving more and more to online banking and away from branches. The TSB branches and their staff appear to have performed heroically.

Andrew Bailey

Indeed.

John Mann

Thank goodness there were some left. It may well have kept the bank alive, if it survives this, because they kept branches that people go into and staff that people could talk to and sort out it. The trend is, by the day, online. It might be your operation—the people or the scale of it—is not big enough or good enough to get in and see, in terms of how we regulate the system. If you are running a system, which would be logical to me, that is reliant on effective information from the banks to you, to allow you to do your job properly, and something huge, with catastrophic consequences, goes wrong, somebody has to be held properly to account.

Andrew Bailey

Yes.

John Mann

I have not noted, in the years I have been on the Treasury Committee, many heads rolling. Even when they are, it is the odd head rolling when there has been a major problem in a bank. If you are not going to be the ones held to account as the regulator, because you are doing your jobs properly, in the right way with the right powers given, then someone is going to have to hold the bank fully to account, not just in saying, “Here is what went wrong”, in detail, which you need to do rightly, but there need to be consequences to it. In this situation, who should that be?

Andrew Bailey

That is why we are going to have the investigation. That is the purpose of the investigation. We have the powers under the Senior Managers Regime to do that now. As you know and as we have discussed many times, it has responsibility at its heart, which is right. That will happen. Meanwhile, going back to the beginning, the most important thing to do at the moment is to dig the way out of the hole, frankly.

John Mann

Absolutely. In terms of the lessons for the future, you have the powers under the Senior Managers Regime.

Andrew Bailey

We do.

John Mann

Will you, if you deem it appropriate, be using the full range of those powers in this situation, or indeed in theoretical other comparable situations? Are you going to use the powers given, or will we be at hearings in the future in which you are saying, “Here are the detailed reports we have got. Let’s all move on”?

Andrew Bailey

No, we will use the powers.

John Mann

Good.

Chair

Thank you very much indeed for your evidence this afternoon. That will be very helpful for the next session. We will see you next week anyway. There will be further questions on this in due course. I look forward to it. Thank you very much. Examination of Witnesses

Witnesses

Dr Paul Pester, Richard Meddings and Miguel Montes.

Chair

Thank you very much for coming back before the Committee again. We have a series of questions for you on events since your last appearance and what the latest is in terms of the issues following your IT migration. You have had the opportunity to watch the FCA session that has just taken place as well. I wanted to start with the issues around fraud, which a number of customers have obviously been suffering. I have some fairly straightforward direct questions. I will direct them mainly at Paul Pester, but if the others would like to intervene or have anything to add then please feel free to do so. Mr Pester, just to start, would you agree that the problems that TSB has experienced in the last few weeks have created the conditions for a spate of fraudulent activity for your customers?

Dr Pester

Yes. I am deeply sorry to say that the issues we created as a consequence of migration were an opportunity that was exploited by criminals to target TSB customers. It is a very sad fact that whenever banks go through changes, fraudsters tend to target customers. In particular, we saw a very, very aggressive attack on TSB about a week after migration.

Chair

It is true, is it not, that if a customer suspects they have been a victim of fraud, they have to call the dedicated fraud line?

Dr Pester

Yes.

Chair

It is no use them going online or into a branch or calling the general enquiry line to get that fraud issue resolved, is it?

Dr Pester

No.

Chair

The fraud line is also the route to them getting compensation.

Dr Pester

Yes, it is. Just to correct that, they can of course go to the branch and report the fraud should they choose to. They can go to any channel of TSB and report the fraud should they choose to, but there is a dedicated line that we have installed for fraud.

Chair

What would happen if somebody sends an email via their online banking or goes to a branch and says, “I want to report a fraud”? What is the next step?

Dr Pester

If they went to a branch then the branch would contact our fraud team and would register the fraud. If the customer went to the telephony centre then we would do the same thing.

Chair

Ultimately it all ends up at the fraud line.

Dr Pester

Yes, it all ends up with a fraud team, yes.

Chair

Is it a fraud team or the fraud line?

Dr Pester

I am sorry. I do not want to seem to be being awkward in the way I am answering the question. There can be different ways that that fraud team can be approached. They can come through the branch team or they can come through our own telephony line but they end up at the same place.

Chair

But they are all going to end up at the same place.

Dr Pester

Yes, essentially.

Chair

The fraud line is a core part of what TSB offers, is it not?

Dr Pester

Yes.

Chair

And when it is broken the bank is effectively broken too, because it cannot prevent frauds from taking place or compensate customers who have suffered.

Dr Pester

It can still prevent fraud from taking place because the system that prevents fraud from taking place is the system that tracks transactions, looks for patterns in transactions, looks for unusual movements in money, looks for a range of activities that lead to TSB putting blocks on accounts if we believe that there is a risk that that account could be subject to fraud. We have automated systems, and normally, for the sort of fraud we are discussing today, we would see 10 or so attacks a day. If we see many, many more then the automated systems will kick in and arrest these. There are other ways than just reporting of fraud from a customer, but a customer reporting fraud is very important, of course.

Chair

From a customer’s perspective, the ability to have the confidence to know, when they spot something potentially fraudulent on their account, they have someone that is going to take action and look into that is important. That system has not been working as it should for the last few weeks, has it?

Dr Pester

When we were subject to this attack, to give you a sense of the scale, the volume of the attacks went to approximately 70 times the normal level of attacks we would see. As Andrew Bailey said to you earlier, that overwhelmed TSB. Using the same number for customers to report fraud quickly turned out to be an unsuitable way. I asked the team to put in a separate line to report new frauds. I was, like you, distressed to see reports of customers trying to get through to us, seeing money moving out of their account. Fraud is a horrible, horrible experience for our customers. Fraud genuinely is the last thing we want our customers to go through. Even if we refund the money, the experience of having been defrauded lasts a long time. It is a horrible experience. I asked the team to put a new line in which gave priority to those customers reporting fraud. That line has consistently been being answered very quickly. At the moment it is about a two to three-minute wait time to answer those calls. We were overwhelmed. We saw 70 times uplift in the volume of attacks and then we responded by putting in new ways for customers to get to us. I apologise profusely to those customers that have been subject to fraud.

Chair

How was it that putting in another line was going to help? Presumably you had to then staff up that additional line. You effectively have two fraud teams now answering different lines.

Dr Pester

It is still the same fraud team. If a customer comes to the normal TSB number, they can press one of the digits on the automated system and immediately come through to the fraud line. We then took some of our operators off of our standard banking telephone line and added them to the fraud line. We had already recruited more partners to work on the fraud line. The combination of a specific number to enable customers to report a new fraud and adding more partners would enable us to respond to those frauds much more quickly.

Chair

Let us talk about how long it has taken people to wait to get through on that fraud line. The advice is, “Get in touch straightaway. We will take immediate action to secure your account”. How long have people waited on average over recent weeks to report online banking fraud?

Dr Pester

Recently since the new line has come in it is a very short waiting time. It is a priority line and, therefore, it is a matter of minutes that customers are waiting to get through to us. I should add that at the same time as putting that line in, we tightened up our fraud defences. I know Andrew Bailey at the FCA did not want to talk in too much detail about the exact operational detail of the frauds. Each fraud has a slightly different approach. This particular fraud enabled us to change our defences and reduce the amount of fraud. We saw the volume go from 70 times the normal level down to two or three times the normal level quite quickly. A combination of the falling volumes of fraud and our new telephony line means that we are answering those fraud enquiries very quickly now.

Chair

I asked you about recent weeks. I am sure you will be aware of the number of customers who would not agree with several minutes before a call is answered or dealt with for something as serious as fraud. People are talking about waiting on your line for hours.

Dr Pester

That was the case before we put the new line in. I apologise profusely for that. It is a completely unacceptable thing. Putting a new line in was the best way to get to a position where we could respond to that. We did not anticipate that volume of fraud attacks. To go up 70 times, as I put in my letter to you of yesterday evening, is an unprecedented attack across UK banking from organised crime. As you know, we are working with a range of Government agencies to attempt to track down the perpetrators of this.

Chair

Except it cannot be completely unprecedented because you say in your letter, “We planned for a quadrupling in the intensity of fraud attacks shortly after migration and this assumption was prudent”, but obviously it turned out to be bigger. In your planning you would have anticipated a migration of this size would lead to an increase in fraudulent activity.

Dr Pester

Absolutely. It is a sad fact that whenever there is a change that happens in a bank, as Andrew Bailey said himself in his letter to you, the uncertainty is used and exploited by criminals. We had recruited more people. We had prepared our defences. On the day after we migrated we had our fraud teams on high alert, ready to deal with exactly this sort of issue. When the fraud attack did come, it was 70 times the level we were expecting, not the four times level that was typical for this sort of migration.

Chair

Going back to the customer waiting hours on the phone, what is the longest you know of a customer waiting on the phone?

Dr Pester

Like you, I have been shocked to read of customers waiting for five hours, for seven hours or for nine hours on the phone. I apologise unreservedly. It is one of the reasons why immediately when I started seeing those reports I talked to the team and said, “We have to fix this problem. We are not willing to have customers sit there and see their savings being taken from their bank, see their life savings in some instances being taken from them. We have to resolve this”. Putting a new line in to enable customers to get to us quickly was something that was very important to us.

Chair

In your evidence when you came before us before, you talked about people waiting three minutes on the fraud line. Which fraud line was that and why did that not take account of the volatility? We heard before about the volatility in call-handling at different times of the day.

Dr Pester

When we came to see you earlier, we had not been subject to the fraud attack. The fraud attack started commencing on the first bank holiday in May, peaked by about 15 May and then came under control for us towards the end of May. When we came to see you first, which was right at the beginning of May, we were not subject to a high level of fraud attack. We were at the level we had expected or planned for.

Chair

When you gave evidence on 2 May and I asked you whether your fraud reporting lines had been hit in their response times by the IT problems and you responded that they had not and you were not aware of long times to access your fraud services, would you deem your evidence to be correct or incorrect at that point?

Dr Pester

That was the true statement of the situation at that time. If you would have asked us, as I said, at the time of the first bank holiday in May or soon after that, then I would have absolutely said to you that our fraud line was overwhelmed, which is why we made the change to the system.

Chair

On the day you gave evidence, average waiting times were five times longer than normal and a third of calls were being abandoned compared to 3% to 4% before the migration.

Dr Pester

Is this the fraud line you are talking about?

Chair

Yes, I am talking about fraud. Average waiting times were five times longer than normal and a third of calls were being abandoned. That does not sit very well, does it, with saying, “I am not aware of long times to access our fraud services”?

Dr Pester

When I came before you, I was not aware of long times to access our fraud services. I do not know whether the data you are looking at is data that we sent to you subsequently and that I did not have access to then. I am very, very sorry if in any way I appear to have been un-forthright in evidence. I gave you everything I had at the time.

Chair

I am going to come on and talk about a particular case in a moment, but in your letter to me of yesterday you talk about how, in the period of 23 April to 31 May, approximately 2,200 TSB customers experienced attempts to compromise their accounts. Of these, around 1,300 have resulted in financial loss. When we asked the FCA that question, they talked about 10,600 incidents. I am sure that both figures are correct, but for some customers this is not happening just once; this is happening several times. In terms of the questions that Mr Elphicke asked earlier about communications, is it not typical of TSB and the way they have handled this whole incident that every time you are asked a question about this you try to be clever with the numbers. It would have been more honest just to say there were 10,600 incidents, because it does not matter how many customers. Each incident is completely devastating.

Dr Pester

I am very, very sorry if it appears as if we are not being truthful and direct with you. It is not intentional and it is not the case. The two numbers you refer to are two very separate, very distinct and very different numbers. The number that the FCA referred to were the number of alerts that we put on accounts. Alerts are generated by automated software tracking transaction patterns and looking at transaction patterns and pointing out patterns that appear to be unusual. Those alerts then trigger a text message that is sent to a customer to ask them whether this was a valid transaction or not; if they do not respond, we will block the accounts until we are able to speak to the customer. The 10,000 number is alerts that were generated. The 2,200 number that I mentioned to you in my letter is the number of customers who have had attempts at defrauding them. It is different from the alerts number.

Chair

The 2,200 is attempts at defrauding. How many fraud incidents, where people have had money taken out of their bank account, have taken place?

Dr Pester

In my letter to you yesterday evening, I explained that 1,300 have resulted in financial loss. We have of course refunded every one of those customers.

Chair

That is different. “Financial loss” is not clear.

Dr Pester

Sorry, that is what I mean. To answer your question, they have had money taken out of their account. 1,300 people had money taken out of their account by fraudsters. I am sorry. I said “have resulted in financial loss to the customer”. I mean they have had money taken out of their account.

Chair

I think you could be clearer. We are going to talk about the case of Mr Catherall, who you have been alerted to. He is a self-employed print-maker who paid some funds into his account between 3 May to 14 May. He wanted to access the money on 15 May and could not log on to internet banking. Meanwhile telephone banking had problems verifying his identity because of the security questions and things not matching. On 16 May, while he is on the phone to TSB, he gets a call on his mobile from someone purporting to be from business banking offering him help to access the accounts. TSB staff advise him to take the call, and he is so desperate that that is exactly what he does. Later he suspects he might have been defrauded because he cannot clear security, he cannot confirm whether the call was genuine, what his balance was or if money had been transferred out. Basically he and his wife were begging for assistance. After hours on the phone he eventually speaks to the fraud team and is finally told that £24,550 has been taken from his account. He is told by TSB staff they do not know how long it will be before he gets his money back, not even whether it is days, weeks or months, because there is a “backlog of fraud cases”. On 17 May he goes into a branch and speaks to the manager, who is extremely helpful. He rang the fraud line from his office. Three hours and 20 minutes later he is still on hold. Eventually the staff member at the branch rings at 6.12 to say he now has to go home having been on hold for a total of five hours with no response. The manager said he had had customers in for days trying to do the same and had been on hold for hours at a time. Then the customer, Mr Catherall, received subsequent fraudulent emails and calls and attempts to report this new information to TSB but he could not get through. On 21 May he goes to his ATM, checks his account and finds that £24,500 is back in his account, but he is unable to check exactly why and whether that is a real number and what the reliability of that is. The next day he goes in and takes everything out of his account. I suspect, as I said to you before, he is one of many switchers. Yesterday he receives a letter from TSB, which accepts his description of events. It says, “TSB are not at fault in regards to the activity carried out on your account”. He has been offered £192 in compensation, of which £42 is for the cost of phone calls. It states that restrictions on the account cannot be lifted until he speaks to the fraud department. It does not say what those restrictions are, and he is obviously worried about the flag on his credit file. It offers that he should phone the fraud department, offering him £18 to cover the cost of him waiting on the phone to do so. So they obviously anticipate that there are going to be more delays if they are offering money up front. The letter states that TSB would review other financial losses, but only if Mr Catherall can find evidence that these were “a direct result of the restrictions we have imposed on your account”. Mr Catherall does not know what those restrictions are. You wrote in your letter to me yesterday that you would “ensure every customer receives a fair outcome”. Is that a fair outcome?

Dr Pester

The details you are giving me are deeply distressing to hear for Mr Catherall. It is true for any customer that goes through fraudulent activity. I deeply apologise for this. It is very distressing. As you quite rightly say, Mr Catherall was refunded on 21 May. The reason there are blocks on his account is to protect him against further fraud. We will look at this case. I would love to take the details from you and, as we have with other cases you provided to us, address it. I can only apologise to Mr Catherall. Unfortunately, he was caught up in that attack that we received. I can only apologise. We have refunded him in full and I would like to take his case further.

Chair

Mr Meddings, you told the Committee last time that the way compensation would work is that it would not purely be a financial calculation. It would take into account factors such as stress and emotional distress more than inconvenience. Do you think that Mr Catherall’s offer made by TSB takes those things into account?

Richard Meddings

Clearly not. I have heard your account of what has happened to this customer, for which I am deeply sorry. When we met, I said I believe these fraud issues are absolutely horrid. Imagine what it must be like to go through that. It is not even just the money going; it is the stress that goes with all that and the consequences.

Chair

That is the whole point, is it not?

Richard Meddings

That is why I answered as I did. The first important thing to say is that the bank is working very, very hard to compensate any of our customers who are defrauded. In Mr Catherall’s case, it is important to recognise that we have refunded him in full and to make the point, to reinforce what Paul said, about the block on his account. The block on his account is to protect Mr Catherall, because there is some vulnerability to his account that some fraudster has managed to get hold of, so the block has remained. In terms of whether the payments offered to him are sufficient for stress and inconvenience, it is very difficult to comment. They do not sound necessarily to be a correct calculation, to my mind, given the stress he has been under, with £24,500 as the amount that was taken and the hours taken either with our branch manager waiting on the phone or himself on the phone. For every minute waiting, that does not sound like a correct calculation, but we are attempting to set a framework of compensation that takes into account stress and inconvenience, and then, much more difficult than that, what we call consequential loss. There will be a number of cases where there is consequential loss that we need to consider.

Chair

Personally, I do not think £192 in compensation is nearly sufficient, given that some of that is for the cost of phone calls. The more important point—and this is where TSB is tone-deaf on these sorts of issues—is the tone of the letter, in which it is all about the customer having to prove that they did not do anything, when you know very well that the IT migration, which you and your board signed off on, has led to people suffering these devastating consequences.

Richard Meddings

I want to make sure we are very comfortable with the tone of the letter. I absolutely get it. I get your point. One of the really important features about the way the bank is managing this issue—attempting to manage this issue—is I think it is quite often the case in the industry where fraudsters raid accounts that the banks will attribute negligence or liability to customers and say, “You were negligent. You provided your memorable data and therefore got defrauded”. We are not doing that. We are, in these instances, compensating in full without any desire or attempt to attribute liability to the customers. We are compensating in full any customer of TSB who has been defrauded. Why is that? It is because we recognise that the uncertainties—the significant uncertainties—that have attached to the migration have caused and created a context on which fraudsters and criminal organisations can feed. We absolutely recognise that.

Chair

I want to move on, because I want to bring in other colleagues. I would just say that on 2 May, when you gave evidence, or the day before you gave evidence last time, the official Twitter account for TSB said, “Our fraud lines are currently experiencing a higher volume of calls than usual”. If the Twitter account knew that, Mr Pester, why did you not know that?

Dr Pester

I am very sorry if I appeared to give any impression that I was not across the numbers last time. To the best of my knowledge, the number I gave you in good faith was the number I had with me at the time.

Chair

I am going to bring Alison in in a moment, but there are people who have written truly horrendous stories online about their experiences. Does TSB deserve its new nickname of the Truly Shambolic Bank?

Dr Pester

This whole situation of the migration as TSB has been a terrible situation for TSB customers. The migration, the subsequent fraud attack and the fact that even when we send letters to customers we have managed to put more letters in a single envelope have all collectively created a terrible time for TSB customers. I apologise unreservedly for that. All I can do is to work flat-out with the teams we have to bring more resources into the business to fix these problems for customers for our customers as quickly as we can and to bring TSB back to a level of service that our customers accept. I deeply apologise again for those issues—those cumulative-effect issues—that we have seen across the business.

Alison McGovern

I hear your apology, Mr Pester, but I want to ask one question arising from the Chair’s questions, before I ask some specific questions about the treatment of customers, because I am concerned about this. The last time you came before this Committee either you knew about the scale of the issues on the fraud line, which had led to all of these delays and people sitting on the telephone line for hours and hours on end, and did not tell us the full picture, or you did not know there was a serious problem with your bank’s fraud line for which you personally are accountable. Which is it?

Dr Pester

I told you the information I had available at the time. My understanding of the reporting of new frauds was that the wait time was the number I gave you.

Alison McGovern

So it is the latter.

Dr Pester

Yes. Clearly I gave you the wrong information, for which I apologise.

Alison McGovern

There was a serious problem with your bank’s fraud line, the fraud line for which you are accountable, which guarantees the security of your bank, for which you are accountable, and you did not know about it.

Dr Pester

Yes.

Alison McGovern

Okay. I wanted it to be clear. The Payment Services Regulations require banks to refund customers if there are unauthorised payments from their accounts by the end of the business day following the day on which it became aware of the problem. Has TSB complied at all times with this part of the PSR since the migration?

Dr Pester

Again, we apologise to our customers where we have not done that.

Alison McGovern

A simple “yes” or “no” will suffice.

Dr Pester

We have not done that. The FCA explained that in their letter and we have explained that now we are making those payments back within time.

Alison McGovern

So you have not complied.

Dr Pester

No, we have not.

Alison McGovern

It is important that the consumer’s voice is heard in this session. I am sure you would agree with that, given what you have said. I was lucky, on Sunday 3 May, to listen to the Radio 5 Live discussion, and I heard David talk about his experience. He found it impossible to get through to TSB. He had a significant balance in his account, nearly £80,000, that he was expecting. The balance when he was finally able to log on was £43,000, and he spent the whole day in a branch where staff were on the phone for five hours. What would you say to David in that situation? He has had a horrific experience, has he not?

Dr Pester

I apologise profusely for the delays and distress that this has caused. I know this might sound strange, but I genuinely believe there is no one who feels more for TSB customers than me. I have spent eight years of my life trying to establish TSB. It is heart-breaking to hear these stories, so I deeply apologise to him.

Alison McGovern

Given that, Dr Pester, just looking at your Twitter feed, on 26 April you tweeted that you wanted “to reassure our customers that no one will be left out of pocket”—this was before David’s experience—and, “If you’re still experiencing issues please contact us via our website”. When you tweeted that, did you expect that people like David would be able to resolve their issues without five hours sat in a TSB branch?

Dr Pester

There is no customer who will be left out of pocket as a consequence.

Alison McGovern

That is not my question, Dr Pester. Why did you tweet that statement and then allow people such as David to get in the situation he was in?

Dr Pester

I am sorry for David and I am sorry for all of the customers who have experienced fraud. As I tried to explain, we were subject to an unprecedented fraud attack. When the fraud levels climb to 70 times, a business can only respond at a certain speed. We have tried to respond at the fastest possible rate. We got the whole attack under control very quickly but, unfortunately, there were customers—and we have explained the 1,300 who have seen money taken from their account—for whom this was a terrible experience. I am not trying to defend TSB. I am not trying to defend my position. I am trying to ensure that every customer receives the payments they are due.

Alison McGovern

Sarah was also on that 5 Live phone-in and she talked about her experience. She was always really careful with her data. She never answered any unsolicited emails or texts from the bank that she was not aware of. She complied with all of the phishing stuff and she was told, as you have said, when she tried to get through having experienced a serious fraud, that you had had this unprecedented amount of fraud. She was told, time and again, that someone would get back in touch with her and they never did. In the end, it took six days for her to resolve the issue, not 24 hours. Dr Pester, you came to this Committee and gave us unreliable information and you tweeted on 26 April that everything would be dealt with via the website, as clearly did not happen in Sarah’s case. How can people like Sarah possibly trust what you are saying now?

Dr Pester

I am very sorry if the last time I appeared here I gave the impression that I was somehow downplaying the scale of the issues that TSB is suffering and were created in the industry. That is not the case and there is no excuse for that. What I can say is what I have tried to explain to the Chair of the Committee. That is that, in the early days after migration, the fraud levels were not exceptionally high. They grew at the start of May very quickly, to 70 times the expected volume, so when I came to the Committee last time and when I tweeted on 26 May, we were in a different position than we were in mid-May, when we were the subject of an attack.

Alison McGovern

It is a simple question, Dr Pester: why did you not tell the public what you have just told us? Twitter works 24/7; why did you not tweet again? That was the last time you tweeted.

Dr Pester

We told the public through our websites. I am sorry if you think I am not telling our customers, but the best way to tell our customers is through our website. We changed the front page of our website on Thursday 26 April, and the front page of that website has a fraud warning, a Take Five warning, which is an industry-agreed warning on fraud and customers protecting themselves. Secondly, it has information updated twice a day on wait times on our call centre and access to our digital channels. We tried to change the way we communicate. We felt the easiest way to communicate was through our website and putting that real time on our website, rather than me tweeting.

Alison McGovern

You tweeted on 26 April and just left it there. That is essentially what you are saying: “Look at our website”.

Dr Pester

We have done a lot more than that. I have put apology letters in national newspapers. We have funded, with Action Fraud, a nationwide anti-fraud advertising campaign. We have worked with the police. We are working with the telephony and banking industries, for the first time ever getting the telephony and banking industries to work together to remove this sort of fraud. We are trying our damnedest to fix this for our customers.

Alison McGovern

We will come back to the same issues, but I just wanted to ask you a couple of very brief questions. Since the IT migration, in how many cases where there has been an investigation into potential gross negligence has that investigation led to a delay in compensation?

Dr Pester

As our chairman has said, we are not challenging customers or investigating customers for gross negligence, specifically because we believe we created the uncertainty and we believe we therefore put customers at risk.

Alison McGovern

The answer to that is zero.

Dr Pester

To the best of my knowledge, the answer to that is zero. If it turns out that we are challenging some, I will find out, but, to the best of my knowledge as I sit here today, the answer is zero.

Alison McGovern

Will you check that information and write to the Committee?

Dr Pester

Of course I will, yes.

Alison McGovern

Finally, given what we have heard and you have admitted your non-compliance with the Payment Services Regulations, which senior manager is ultimately responsible for compliance with those PSRs?

Dr Pester

That is a good question. I would need to check my team, but it would come through operations.

Alison McGovern

You do not know who is responsible for that.

Dr Pester

It comes through my chief operating officer.

Charlie Elphicke

Dr Pester, you received a letter from the FCA on 25 April about your communications with customers. That letter reminded you of the importance of ensuring that TSB’s communications were clear, fair, not misleading, and reflected the true position of your services. Do you accept that you fell short on that?