A mammoth undertaking

It feels like I ought to award the IcyJumbo Prize for Appalling Customer Service at least monthly, as there is such a high standard of competition! Today I’ve fallen out with AXA about my home insurance renewal.

AXA, or at least someone purporting to be AXA, sent an unsolicited email over the weekend to one of Christopher’s email addresses that hasn’t been used for two years. In it they said that my home insurance was about to expire, and to renew it I should click on a link within the email (which when I hovered my mouse over it was a very long link with lots of hexadecimal in it), answer some security questions and pay online. It’s true that my house insurance is due to expire, and indeed I’ve had another of those spooky reminders from Chris telling me to do something about it. But that email, although probably genuine, had all the signs of a classical phishing attack. All it would take would be for someone to hack the confused.com database, and they’d have a full picture of who I was,where I lived and when my various insurances were due for renewal.

So I phoned AXA up on the number in my policy details and asked them how stupid did they think I was? It’s an absolute first principle of cybersecurity never ever to click on a link in an unsolicited mail and then enter your security details or credit card number! It turns out that AXA have unilaterally moved my insurance policy to a web-only service, no doubt to keep costs down. I’ve no particular problem with that in itself – but they need to write to me to tell me, so that I know it’s genuine.  An email is not secure enough. Apparently they have written a letter telling me how to log on to the AXA website – but haven’t actually sent it out yet, so the email of course arrived days in advance.

I told the chap on the phone that AXA was training people to respond to phishing attacks, and that their behaviour was completely unacceptable. He seemed completely unaware of the basic principles of cybersecurity and struggled to grasp why I wouldn’t want to click on a link in an email that they had sent me. The concept that it might not have been them, but rather someone impersonating them, seemed completely alien to him! I have got him to promise that he would raise the matter with his management, but I have little hope that they will listen.