RACV 'system error' empties bank accounts, credit cards

Insurer RACV has blamed a “system error” for causing the company to repeatedly direct debit customers, maxing out their credit cards and draining their bank accounts sometimes to the tune of tens of thousands of dollars.

Angry customers hit social media and the airwaves complaining in some cases that a single payment had been taken out hundreds of times within hours.

This is a developing story. Click here to find out more about the current situation and what went wrong.

While the number of people affected by the incident so far appears relatively limited (at least compared to a major bank outage), the sheer scale of repeated deductions is unusual in terms of the high cumulative values deducted.

Repercussions for affected customers have been severe. Many have been left without access to funds, mortgage and loan payments have been missed, accounts overdrawn and credit cards erroneously booked up to the max.

On Wednesday morning many customers said they had still not received refunds for very large deducted sums and RACV had still not updated its public statements on the incident.

While the cash guzzling malfunction was publicly acknowledged by RACV on Tuesday afternoon  in a brief statement, the insurer did not return calls from iTnews.

The incident appears to have started on Monday night.

“Last night a system error caused a select number of RACV members to experience a direct debit issue,” the company said on Tuesday.

“We are working to fix this and reverse all incorrect transactions as quickly as possible.”

"Select" policy holders are understandably ropeable.

Banks and the payments industry are understood to be privately furious at RACV management over its incident response management and the negative effect on already bruised institutional reputations in the wake of the Royal Commission into bank misbehaviour.

Banks will also have to mop up the mess caused by financial distress flags being tripped on many accounts.

A RACV customer who contacted iTnews said more than $50,000 had been "drained" from their account and requests to Westpac to freeze their account had not worked.

"This whole thing is a joke," the customer said.

Another customer on Tuesday told 3AW that RACV took $21,000 from his bank account, repeating a direct debit for car insurance over and over.

Things got worse on RACV's Facebook page, where a customer complained they had been “charged 188 times and had been left with no money in my account”, while another said 50 transactions had drained their account.

"Can I have my $30,000 back please? My staff haven't been able to process orders today and it's caused major business interruption having a maxed out credit card!" another angry customer post said.

Another customer told The New Daily that 95 payments were taken from his account, totalling $7900.

Bank executives contacted by iTnews squarely laid the blame at the feet of RACV. 

It was suggested the most likely cause was a batching error that would be reversed out.

One bank source, who spoke on condition of anonymity, questioned why RACV's transaction monitoring had not picked up the anomalous repeated transactions and quarantined them.

A failure to detect such transaction behaviour did not bode well for RACV's cyber readiness, the source suggested.

The high-profile batch-based incident will increase pressure institutions, especially banks acting as merchant acquirers, to shift the the New Payments Platform (NPP) that in the near future will allow billing customers to authorise individual transactions.

A specific feature of the NPP's architecture is that so-called 'pull' payments that move without customers' specific authorisation have been designed out of the system so that payment while automatic requests can be made, the still need approval. 

In the mean time, customers are counting the damage done by the bad batch run.

Although the erroneous deductions must ultimately be refunded quickly, RACV is yet to clarify what if any compensation will be offered for business disruption or personal losses - think missed repayments or bounced cheques - incurred by customers.

"Thanks RACV it’s the first time in 20 years we missed a mortgage payment since you drained our account," said an angrily impecunious poster on Facebook on Tuesday night.

"...send me a paper bill I’m happy to pay the extra $2 for the inconvenience I will forgo the 7 eleven coffee once or twice a month instead of forfeiting on my mortgage."