Trace + Search

My wife and I have been dealing with the fallout of a service companies use to try and identify people liable for unpaid bills. A few months ago, we were forward a bill from Ovo Energy, sent to our old address.

We were in a strong position to deal with this: there was no conceivable way we were liable and the due amount was small. But extracting information from Ovo about the trace and search process was tricky, and internet searches didn’t reveal much.

This account is to help others who might find themselves in a similar position and provide some transparency on what I’ve been able to discover about trace and search.

The episode also unveiled some data protection concerns: it shows how data is shared between third parties and the actions they might take. All without a subject’s knowledge or consent.

The invoice we received showed a billing period that started roughly nine months after we’d moved out: we weren’t Ovo customers when we left.

Our initial suspicion was identity theft. We knew that some mail hadn’t been redirected to our new address and wondered if a someone had tried to get away with dodging some bills.

We did a credit check to see if anything had changed on my wife’s account and called Ovo to ask about the bill. I was told my wife would be removed from the account and I should hear from someone within a few days...

Trace and search

Two weeks later, the only communication we’d received was a debt collection email sent to the address I’d provided in the initial phone call. Following up with Ovo, I was eventually told this wasn’t identity theft but a process called trace and search.

Ovo said trace and search had identified my wife as financially responsible for this address. Their debt collection department said this involved a credit check and someone visiting the address to verify this.

This wasn’t identity theft but a process called trace and search.

I was told my wife would have to prove she no longer lived at the address by providing a tenancy agreement for the previous address or a council tax bill at the new address.

This seemed odd, not least as a tenancy agreement would do nothing to prove we no longer lived at the property. Our agreement only stated the months of our initial year, after which we moved to a rolling tenancy.

The most concerning aspect of this was it revealed Ovo had fraudulently created an account in my wife’s name and put the onus on her to prove she shouldn’t be associated with it.

On top of this, Ovo had acquired details about my wife and wanted further details to cancel this account. Without the slightest hint of irony, Ovo used these details – name, date of birth, supply address – for ‘data protection’ each time I called.

Ovo had fraudulently created an account in my wife’s name and put the onus on her to prove she shouldn’t be associated with it.

When I pressed for details about the trace and search process – particularly who they had spoken to at the address – none were forthcoming. Customer services stuck to a script and reiterated that it was my wife’s responsibility to demonstrate she was not financially responsible.

Resolution

It took several weeks before we were contacted by an Advanced Resolution Specialist. In the meantime, we’d checked my wife’s credit report again.

The report showed she had a couple of accounts associated with our old address. One was a bank account she didn’t use and another was a credit agreement for a phone – the bank was easily changed, the other not so much.

It can’t be unusual for people to forget to update an address or two – the house we’ve moved to still receives plenty of mail for the previous occupant. Yet it seems any active credit linked to an address is enough for a trace and search to:

1. Determine a person currently lives at an address
2. Arbitrarily assign the financial responsibility to that person
3. Create an account in their name
4. Require that person to prove they don’t live there

The Advanced Resolution Specialist spoke openly about how this situation had occured. But there was no satisfactory explanation of why the account had been assigned to my wife. Our previous address comprised of several flats: any of the other occupants could have been deemed responsible for the bill.

They also explained that this was an entirely automated process – no-one had been to the address – and the active credit was the sole link between my wife and address. This confirmed my assumptions about trace and search.

In the six weeks between initially contacting Ovo and speaking to the Advanced Resolution Specialist, we received debt collection emails from Ovo’s attack dogs. These emails were punctuated with the following threat:

Please know, we share data with credit reference agencies, which might affect your credit rating. So the sooner we sort this, the better.

Nice.

Ultimately, Ovo sent us £50 as a resolution and the following apology:

On behalf of OVO Energy I would like to apologise for the recent trace and search that identified [your wife] as still updating credit at the address. This led to OVO Energy assigning charges in her name.

And that was the end of it, or it should have been...

Data concerns

As part of the resolution, I submitted an erasure request to remove my wife’s details from Ovo’s systems. A few weeks earlier, we’d also submitted a subject access request to find out what data Ovo held about her.

A couple of days later, I received an email from another Advanced Resolution Specialist to say the erasure request had been “rejected as it technically needs to be requested by the person who's details need to be erased”.

Throughout this entire debacle, I’d wondered what the the legal basis for collecting, storing and processing my wife’s data was. Ovo had created the account without her knowledge or consent and made no effort to contact her apart from the initial bill.

Ovo’s pushback on the erasure request raised further questions:

1. What was the legal basis for continuing to store and process her data now Ovo acknowledge the account was incorrectly associated with her?
2. In the case of an incorrectly created account, is an erasure request necessary?
3. If my wife decided to submit erasure request herself, how would Ovo expect her to prove her identity?

Ovo don’t have our address or my wife’s email address. As far as I can tell, they only have her name, date or birth and supply address: all information I was able to provide to get her case this far.

Would Ovo seriously be looking for her to provide more information: data they can’t verify?

One month on and Ovo haven’t responded to these questions. The 30-day deadline for the subject access request has passed, too.

I’ll update this article when I have answers regarding their basis for processing my wife’s data.

Summary

The last time I spoke to Ovo, I was told the Advanced Resolution Specialist I originally spoke to has left the company and the second has taken a different role. Apparently, our complaint is in a queue waiting to be reassigned: you couldn’t make it up.

Trace and search is an aggressive and opaque practice for companies to recover funds. With next-to-zero effort or evidence, companies are able to:

1. Create accounts for people
2. Issue bills for whatever they feel they are owed
3. Threaten their credit rating

We only received Ovo’s invoice because of our mail redirection. If that hadn’t been in place, Ovo’s actions could easily have affected my wife’s credit rating and we would have no knowledge about the incident.

The worst part about this was how long Ovo took to remove my wife from the account. Matters like this should not take months to resolve: the company has unilaterally created her account.

Ovo made no effort to contact my wife before sending the invoice, nor did they verify the data they received. But as Ovo deem the onus is on her, there’s no incentive for them to move quickly.

Ovo told me that someone has subsequently taken over the energy supply for address. One would think that might be a good place to start making enquiries, but why bother when you can outsource the work to an automated credit check with no accountability?