Weird banking error and possible GDPR breach?

Sounds like a simple mistake made by the cashier whilst trying to assist your dad in carrying out his business.

Presumably the funds which were debited in error have now been returned to your account?

I’d leave it at that. I’m not particularly convinced from your summation that there was any data breach. There was a security failure within the bank for which they would be liable. It appears you have suffered no loss.

Did he not need to put in his card into the debit machine at the counter and enter his pin?

This is the normal practice in a branch for withdrawals at the counter.

That’s rather sloppy security breach. I’d start by reporting it to the bank. It sounds like they’re completely unaware of it. The cashier is not supposed to process a transaction like that without ID. The bank itself would have very tight protocols and procedures in place.

Giving out account information is a data protection issue too.

OP said their father has the same name so ID, if it was used, wouldn’t have avoided this problem. You’d imagine the account search would have given the cashier two possible accounts and they’d need something else like DoB (if it’s available to them) to confirm the right one.

This is the procedure to follow, if you have a complaint to raise against a financial institution.

State your case and concerns, and let them investigate and come to a conclusion.

I would expect some small amount of compensation from the bank (nothing huge) as a gesture of goodwill and admission of them getting it wrong.

Unfortunately the training of bank staff seems to be woeful. I know from personal experience with my own bank BoI if its not a simple answer they don't know and even then they may get it wrong.

In the last three years I've had three issues with UK banking institutions and got compensation after making a formal complaint each time. If it doesn't get investigated it will never be flagged for better training or policy change. No I don't go looking for compensation I'd prefer it if the banks got it right first time.

Not quite the same experience, but myself and partner have separate bank accounts, opened with same bank but different branches. The only connection between our accounts would be same address, and also as my partner doesn't use email, same email address. I had rung about a problem I had accessing my account online, and I was being sent a text message with a code. I received no text message, but my partner got one from the bank on his phone. This happened twice over two days of phone calls so seems unlikely to have been a coincidence, but I was told by the bank that it wouldn't happen. Add to this that instead of telling me that they were finished for the day, they just hung up on me before the problem was sorted, which is why I say phone calls over two days.

How do you reckon it’s a criminal offence?

What specific law was broken?

The most embarrassing one ever was when I was in college, and this was quite a few years pre GDPR but not in medieval times either.

I had a long standing bank account in one of the banks, but it wasn’t my main one and it had gone overdrawn by a small amount - empty account and they withdrew fees.

I’d opened a new account with the college branch that was doing some crappy promo offer.

My mam happened to be in the branch one day & the manager mentioned it to her and asked if she’d like to lodge some cash to clear the outstanding balance!! It was intended to avoid some kind of unauthorised overdraft fee but it caused a row!

My mam assumed I’d blown my entire borrowed budget, which they’d helped out with, on some wild party or something and I got a very awkward phone call and panicked voicemail about what the feck I was spending my money on …

I was over 18 and it was none of anyone else’s business. I’ve never banked with that organisation again.