Received email titled "Travel Irregularity" By Greater Anglia

[Summer96]

Hi all. Received this email this morning.





I've done a lot of research on here and seen the usual strategy is to send a fairly structured and remorseful email in hopes that the company in question will offer an out of court settlement, but it seems I may already be at that point. In the interest of not accidentally incriminating myself or laying it on thick for no reason, is it worth just sending something simple like this?


Dear ,

Thank you for your email.

I can confirm I would still like to settle the matter outside of court, and I am happy to pay any fees.

Yours sincerely,


Any input would be greatly appreciated!

 

[SargeNpton]

Appalling grammar for an official communication. Have you checked that this is genuinely from a Greater Anglia email address?

Does it go into any greater detail of what you were stopped for?

 

[Huntergreed]

Hi all. Received this email this morning.


View attachment 144947


I've done a lot of research on here and seen the usual strategy is to send a fairly structured and remorseful email in hopes that the company in question will offer an out of court settlement, but it seems I may already be at that point. In the interest of not accidentally incriminating myself or laying it on thick for no reason, is it worth just sending something simple like this?


Dear ,

Thank you for your email.

I can confirm I would still like to settle the matter outside of court, and I am happy to pay any fees.

Yours sincerely,


Any input would be greatly appreciated!

This is unusual - did this definitely come from an official, company email address?

 

[Summer96]

This is unusual - did this definitely come from an official, company email address?

The address was formatted as [email protected], so I believe so.

The name itself checks out. I actually spoke to this person at Cambridge station as he was there when I was stopped - he specifically told me an out of court settlement was possible.

Does it go into any greater detail of what you were stopped for?

It doesn't, this is all I was sent:

 

[jamiearmley]

This seems odd.

The person who stopped you would NEVER be the same person who processes your case.
The person who took your details does not have the authority to suggest or offer an out of court settlement. This is a process which is handled by investigative staff in an office, not the officer who reports the issue.

Notwithstanding the appalling wording of the email and poor use of English.

I would contact Greater Anglia directly, using contact details you have verified from another source than the email, to ascertain it's validity.

 

[Summer96]

Sorry, I should have been more clear.

I was stopped by a plain clothes police officer who questioned me and handled the report. He was firm but fair with my situation being a student with little money and that I was very distressed during the incident. He suggested that I speak to the fraud manager who was stood near the exit to the station so "he can put a name to a face", and ask to settle things outside of court, supposedly to increase the chances of an out of court settlement. The fraud manager in question is the one who is now sending me this email - I did a quick google search and it is the same person.

I do believe this adds up, but that being said I very much appreciate all your thoughts so far.

 

[Mcr Warrior]

@Summer96. Welcome to the forum. A clarificatory question... What was the reason for you having been stopped by staff at Cambridge station? Not having a valid ticket for all or part of your journey? Maybe travelling on an inappropriately discounted ticket?

 

[Summer96]

Thank you @Mcr Warrior

I had a ticket, but it was only valid for the final portion of my journey. I had a valid railcard.

 

[Harpers Tate]

Absolutely the FIRST thing I would do with that is:

If the Email client I use allows it I'd look at the raw source code of the message to see if it actually came from an authentic GA address. The headline "from" can be spoofed.
If not (or possibly even so) - I'd contact (as another has suggested) GA using an independently sourced EMail address or contact form or online chat on a genuine site and confirm that there is a case to answer here on their books.

Then and only then - if confirmed - would I engage with them on the matter at all.

On the face of it, that sniffs of a scam in the making. Give your card details to pay the penalty - bye-bye money.

 

[Haywain]

The person who stopped you would NEVER be the same person who processes your case.

Are you absolutely sure about that?

 

[Adam Williams]

It's good practice to make sure the DKIM and/or SPF headers in the email check out (and if you're able to do this, I'd recommend it), but I strongly suspect the email client would've already marked it as spam if they did not.

I would be surprised if this wasn't legitimate. Slightly unconventional/informal, perhaps - but they already know you're open to a settlement and you've spoken to what sounds like a fairly senior employee already - so what's the point in making this more drawn out than it needs to be? GA are one of the most pragmatic TOCs I've dealt with, frankly - so it wouldn't surprise me if this extended to their fraud team.

Obviously you can re-evaluate if they ask for the payment details in a suspicious way or do something else that makes you worried about phishing.

 

[skyhigh]

Absolutely the FIRST thing I would do with that is:

If the Email client I use allows it I'd look at the raw source code of the message to see if it actually came from an authentic GA address. The headline "from" can be spoofed.

Agree with this.

On the face of it, that sniffs of a scam in the making.

Disagree with this. The OP spoke to someone apparently senior, then got an email from that person regarding the matter they discussed in person. If the email is from the address shown, it's a very unlikely scam.

 

[fandroid]

Scam email addresses can be made to look authentic (to a degree), but that one looks very much like a standard corporate employee email address. If, when it comes to payment you use bank transfer, your bank should flag up the actual owner of the account before you finally confirm payment. If it's anything but a Greater Anglia account, stop there.

 

[AlterEgo]

The OP was stopped by the police who then referred them to a named member of staff conducting the revenue block, who they spoke to, and then got an email from the very same member of staff.

There’s nothing at all strange or suspicious about that.

 

[Y Ddraig Coch]

This is easily sorted call the TOC and ask if the person and mail are legitimate. No need for guessing games.

 

[BigCj34]

Did this plain clothes officer have any official ID on them? Sounds like an elaborate scam where someone is taking email addresses then sending them a bogus payment portal. My understanding is an address would be taken form what I have seen.

Would 100% check the validity independently. Also surprised the fraud and investigaiton team would be at Liverpool Street station.

 

[skyhigh]

Sounds like an elaborate scam where someone is taking email addresses then sending them a bogus payment portal. My understanding is an address would be taken form what I have seen.

They can and have also previously contacted people via email.

It would be an extremely elaborate scam to have a group of people inspecting tickets at a station and sending emails from the genuine domain.

Also surprised the fraud and investigaiton team would be at Liverpool Street station.

Why is that? It's obviously worth their time...

 

[AlterEgo]

They can and have also previously contacted people via email.

It would be an extremely elaborate scam to have a group of people inspecting tickets at a station and sending emails from the genuine domain.

…And to have either a fake copper or somehow dupe a real copper into sending the fare evaders to them. In the middle of one of GA’s busiest stations!

Regrettably very fertile imaginations which don’t constitute good advice.

 

[BigCj34]

They can and have also previously contacted people via email.

It would be an extremely elaborate scam to have a group of people inspecting tickets at a station and sending emails from the genuine domain.

Why is that? It's obviously worth their time...

Elaborate financial scams can and do happen, certainly phone number spoofing is very much a thing. Also would have guessed Fraud and Investigations would be outside of a train station, in their head office maybe.

However the highly unprofessional email gives reason to question its validity, and to double check as stated before.

 

[SCDR_WMR]

Elaborate financial scams can and do happen, certainly phone number spoofing is very much a thing. Also would have guessed Fraud and Investigations would be outside of a train station, in their head office maybe.

And yet, being under the same Transport Group, our Digital Fraud team are often involved with station blocks etc having previously been Revenue managers themselves.

Just be sure at payment stage, at this point I see no reason to not engage as you plan to.

 

[Summer96]

Thank you all for your input so far.

Inspect element on Google Chrome and the "View Source" function on Outlook both displayed an email address which matched the one in the original email.

I have responded, being careful to only confirm what they stated in the email.

I will be extra vigilant when it comes to any sort of payment, if that is offered to me. That being said, at this point I feel it would be odd and slightly dishonourable for them to change course and take me to court after this.

Did this plain clothes officer have any official ID on them?

Yes, the officer showed me their ID early on in our interaction.

Will update as things develop!

 

[skyhigh]

Also would have guessed Fraud and Investigations would be outside of a train station, in their head office maybe.

Whereas I would suggest that it would be likely to find their inspectors at one of their busiest stations.

Elaborate financial scams can and do happen, certainly phone number spoofing is very much a thing.

In this case the OP was stopped and spoke to a person who presented ID. That is completely different to a cold call from a spoofed number. The inspector suggested they would get in touch via email, and they did so. There is a healthy level of scepticism to have around financial matters but suggesting that they'd go to the extent of posting bogus inspectors about the place is frankly unhelpful.

 

[Haywain]

In this case the OP was stopped and spoke to a person who presented ID.

And subsequently sent them an email which reflected the in person conversation.

 

[Deafdoggie]

Normally this section of the forum offers sensible advice, but this thread seems to have got itself caught in a rabbit hole of unhelpful speculation.
The OP was stopped inside a barriered major station by a BTP officer and a fraud manager and what they said would happen has happened. If these two individuals were bogus and inside a ticket barrier area of a major station and not one person reported it, the railway needs to take a good long hard look at itself and certainly needs to stop the "see it, say t, sorted" message as clearly their own staff ignore it!

 

[Papyrus]

There’s one sure fire way to find out if it’s someone impersonating an official account.

They have invited you to reply to that email address, at that domain. When you click reply does a GA domain show in the To: field?

If so, it can’t be a scammer unless the scammer is using an official account.

I think the worst that can happen is it turns out effectively to be a bribe to an employee who seized an opportunity to make a few quid off the books and who will destroy your report on receipt.

If you arrange a settlement with the sender I can’t see any successful prosecution if it turns out it wasn’t authorised. It was ostensibly official and you would be reasonable to trust it.

 

[talldave]

There’s one sure fire way to find out if it’s someone impersonating an official account.

They have invited you to reply to that email address, at that domain. When you click reply does a GA domain show in the To: field?

If so, it can’t be a scammer unless the scammer is using an official account.

So a scammer couldn't spoof the Reply To field in their email? Sure, the reply will go to the GA account, but a scammer with a plan would presumably have already compromised the email account.

Unlikely, of course, for such low financial returns, but let's not make such confident assertions on matters of IT security which can all be bypassed on payment of sufficient money.

 

[Papyrus]

The reply goes to GA is the point. If actual GA accounts are sending this correspondence then I can’t see what could go wrong with trying to settle by replying (unless eg an unusually high figure is demanded).

Just not sure it’s necessarily in OP’s interest to ring the main head office when they seem to be being offered a more straightforward deal than that office is usually in the habit of.

 

[Summer96]

Received a response. Looks legitimate and lines up with other things I've seen.

They've provided bank details of "Abellio East Anglia Ltd" and given me until Wednesday 25th to pay via bank transfer with a specific RPD reference.

The amount is more or less what I calculated, if a little high. That being said, I plan to pay it today and close this chapter for good!

Grateful for the continued discourse.

 

[ChewChewTrain]

Presumably, your bank will ensure that the account belongs to Abellio when you add them as a payee. I appreciate you’re already satisfied that this is legit, but another layer of security can’t hurt (unless you’re programming it).

 

[Huntergreed]

Glad to hear a settlement has been achieved and agreed to.

I wonder if this is an approach that we will see more of from GA/Abellio going forward.