How London thieves exploit organisational silos

Photo by W A T A R I

It started out as a regular Friday night. Friends, drinks, food & enjoying the conversations. By 7:32 PM, my whole weekend and free time for next week was gone. I had to book an international flight to deal with authorities. Had to had dozens of phone calls in the next week.

Having worked in IT in large organizations, I’m very familiar with the pain of trying to get through something that does not quite fit with the pre-existing structures — from a perspective of someone on the inside. Last weekend, I got a taste of being on the “customer” side — as a victim of a crime. As I was getting dinner and drinks on Friday 22nd March, my bag got stolen, along with a stupid amount of my life.

I decided to write this after several of my friends suggested something like this, but I did not want it to be just: “Boo-hoo something bad happened to me. Help meeee.” It sucks a lot, but that’s life. I will go through the reasons for writing this — as well as caveats — towards the end, but I wanted this piece to be a bit of a cautionary tale and a case study if people want to be more cautious.

This story will begin, as all great narratives, with a timeline I reconstructed and sent to the London Metropolitan Police.

***

Over the weekend, I was able to reconstruct the exact timeline of what I believe has happened. As I may have mentioned — the key things for me are mainly the various forms of ID (national ID, passport, Driving License and Permanent Residency) and the laptop. Not the money, but the transactions are a helpful tool.

6:35 PM — last payment in the Scottish Stores (2–4 Caledonian Road) that was performed by me using a Revolut card.

7:32 PM — CCTV shows a white collared white looking male about 180cm that carries a backpack similar to mine in hand (not on the back) and leaves via the back entrance. The make of my bag is Delsey Quarterback. Pictures here and here. I was told by the bar staff that as of yesterday evening no one has stopped by to retrieve the footage. When someone makes it there, you want to see the backdoor camera first, which is the one in the direction of the Tesco Express.

7:37 PM — CCTV shows me starting to look for the bag from the shared pile of bags that me and my friends all put our bags in a corner, which we have body-blocked. This corner is unfortunately in a blindspot of the CCTV. But all the exits of the pub are covered with a camera.

7:45 PM — first fraudulent transaction. This was in the “TESCO STORES 6187”, which I have confirmed with Tesco is the Caledonian Road Tesco Express. The manager did not let me see the footage but says at that time there is someone looking around and shuffling various cards in an attempt to make 20 GBP contactless purchases.

Purchase history:

1st: 20 GBP Revolut Card (succeeded)

2nd: 20 GBP Revolut Card (succeeded)

3rd: 20 GBP Revolut Card (declined)

4th: 20 GBP Curve Card (declined) — more about Curve here

5/6th: 20 GBP Revolut Card (declined)

5/6th: 20 GBP Curve Card (declined).

Finished at 7:46PM.

Note all of these happened at the TESCO STORES 6187, NOT THE 131 ALDERSGATE TESCO as previously indicated. This was due to Revolut providing me with incorrect information, which is the registration of the merchant, not the address of the purchase.

7:49 PM — two more fraudulent transactions, likely at TfL machine labelled “LUL TICKET MACHINECALEDONIAN RD”, near Kings Cross — not the Caledonian Road Station.

One 326 GBP for my Amex and another one 163.3GBP on the Curve. Both declined.

7:54 PM — TfL Tube Touch in for the Curve, travel to Finsbury Park (likely via Victoria line ~6 minutes + wait).

8:10 PM — Three more transactions attempted at “TESCO STORES 5487”. I confirmed with Tesco that this is the Seven Sisters Road Express near Finsbury Park tube station.

Attempts: 2x Amex for 20 GBP, 1x Curve for 20 GBP (all declined)

I asked the manager if he could at least go take a look himself, but he declined to even check the CCTV footage himself to see if such a thing occurred.

8:31 PM — TfL Tube Touch in with Curve card & Amex.

8:58 PM — Bus touch in Revolut (declined).

These two transactions above make sense. The fastest way from Finsbury Park to the next location is via Victoria and then Bus. (LINK REDACTED)

9:16 PM — Declined Amex Transaction for 9.20 GBP.

9:17:22 PM — Declined Revolut transaction for 9.20 GBP at the Local Express (LINK REDACTED). The employees confirmed that the CCTV includes a video matching the person from the pub, coming in prior to this time, he is seen standing the corner shuffling what looks like cards. Then attempting to make a purchase. The wallet matches my description of my wallet — brown with a thick leather stripe in the middle.

The transactions are both declined and he pays with cash.

Notes for Local Express:

* The in-store camera is about 3 minutes late so you actually want footage starting from about 9:13 PM.

* The store staff claims to know this person, he likely lives there.

* I have confirmed with the staff that this is the only store they own and they are not a franchise, so this is the only address possible with this merchant registration.

Summary of contents of the backpack:

• Mac Book Pro (serial number: REDACTED)
• Number of scientific academic publications
• My wallet including
• Amex Card (ending in 1008), Curve Card, Revolut Card
• Lounge Club Card
• 10 EUR, some GBP change
• National ID
• EU-CZ driving license
• My workplace (REDACTED) entry card
• Possibly some other cards
• UK Permanent Residency Card
• Czech Passport
• Water bottle
• Hygiene bag & some medications
• Sony Wireless Headphones
• Silver Lock
• Notebook & pens
• Mac Book Charger & power adapter
• Other misc. items — can provide a more detailed summary, if that helps.

Overall notes:

More than happy to provide full card numbers, CVV codes, address and expiry dates for all of my blocked cards.

I attempted to see travel history via TfL, but as TfL themselves confirmed this is not possible for me to do if a card has been blocked. They said that the Met may be able to recover them with the card details though.

If you do contact Amex about the transaction times, they will likely provide you with times that are off by an hour. I believe that is because they have incorrectly factored in daylight savings time — either the American or the UK one.

Hope this helps. Please keep me up to date. I understand that this is just another case for you guys, but for me, it was a stupid amount of my life in that bag, so I would love to do anything I can to help.

All the best,

Jakub

***

I spent an entire weekend creating the report of this clarity. From the email, you can see that I spent a lot of time on the transactions. Precisely because that would be the optimal way to conduct this investigation, assuming you had (a) enough resources, (b) really good IT. Now obviously both of these assumptions are false. The police is not known for their level of IT sophistication — and the level required would be much higher than most IT organizations I have seen.

First of all, let’s look at the intelligence of the theft.

• I have two recordings of the suspect. But the only one that matters is the one from the pub. He isolated where the CCTV is and where the blind-spots are. He purposefully used the back entrance where upon leaving his face will never be revealed. Though, again, with enough resources you may be able to trace this person depending on when they entered. But according to a friend of mine, it takes eight weeks for police to get footage at this level of analysis. Not worth for this type of theft, I suppose.
• He picked a busy pub and by 730PM Londoners were likely to be smashed. I was quite quick in blocking my cards and even running into the Tesco’s where he was, just a couple of minutes late. In hindsight, I am pretty sure he also waited for the friend opposite me to leave, then reaching around the corner and grabbing the bag. That way, there may be no one who will see him coming from that angle.
• He shopped mostly at Tesco’s where it is impossible for someone like me to get the footage.
• He waited for long enough between the theft and the usage of the card so that the Met can reasonably say — it may have not been the same person. So these are two separate claims and the transactions are useless.
• He likely knew that this is the case so he was even bolder. Ultimately, the amount is quite small compared to all the material goods, time and effort. Not to mention the ever-looming issue of identity fraud.
• The audacity of someone who does this regularly is palpable. He knew that the transactions will never be prosecuted. So he could try as many cards as he wanted with impunity. Remember that had he just took the bag and made no payments, I would have absolutely no history. He knows he can do this with impunity.

Despite the difficulties, let’s take a look at what an optimal system might be able to do, without the silos and with enough resources.

• Integrate the TfL CCTV and the payments data. Did I mention I also have a full travel history on the Oyster card?
• Integrate facial recognition & matching into the CCTV recordings, to enable the police officer to just map out the face of the person once and then have their movements mapped out throughout the pub. There likely is a shot in the pub, where his face is visible.
• The Met police would be able to spike up/down resources depending on the likelihood of being able to catch the person. I am not sure how does my case stack up against the cases they typically receive, but if they catch him now, that could be fewer several thefts a week. His Oyster card travel history suggests, he does this several times a day.
• (In a perfect world, no one would have to have to do this running around and get the data I had to have several conversations with Amex, Revolut, TfL and Curve. Individual pubs may be tough to integrate)

On another note, isn’t it insane that all this can happen with more than a half a million CCTVs? Data integration is a key issue here.

Before I want to mention institutions that I feel have genuinely been helpful in the aftermath:

• Revolut, Curve and Amex (in that order) have had good customer experiences where I feel they really tried to help me.
• Czech authorities have been actually very understanding and helpful. Czechs like to complain a lot, but the authorities have improved a lot.
• The Local Express store owners and employees were actually incredibly helpful and understanding, although skeptical at first. Regardless, I redacted the links to their store, because I did not want them getting any bad rep.

On another note, a couple of dishonourable mentions:

• The Met police. The whole exercise reminded me of a Kafkaesque exercise of trying to get to someone. One operator was not only unhelpful but rude as well. She ended the call with “well take it up with the Home Office.” After I suggested if it is not possible to at least go gather the CCTV so that it does not get deleted forever after the 28 days.
• Tesco’s — the fact that they may not let me see the CCTV is somewhat understandable, but they could at least extend the effort of checking themselves. The police clearly won’t do any of the running around — they already closed the case twice, within 24 hours — but that leaves any victim rather powerless.
• TfL — not only did they not cancel my Oyster card on the first or the second attempt, but also do not talk to the Met Police at all. I feel like a greater TfL and Met integration would go a long way. They all have CCTV. I understand IT integration projects are not cheap, but this would make the CCTVs that we already have actually useful.

Overall, I understand that the Met police has gone through some ~10% cuts recently, so I understand this may be a resourcing issue. But there has to be a better model, especially that given there are about 27 thefts per 1,000 people in the Met regions of London alone, that could be ~£250M per year. (Assuming ~£1,000 of economic damage per theft — of combined lost value of property and time sorting out new documents, bags, phones, laptops & setting them up. In my case, of course, it is a lot more). Given that ~£250M is just under 10% of Met budget, that would suggest we are also underfunding this problem.

There also has to be a better model, because I — as an individual — am incredibly invested into this case, whereas they are not. My aspiration behind all this running around and figuring things out was so that the Met does not have to. I also briefly considered getting a private investigator, but the trail is likely too cold now and I am not sure if they’d have access to the CCTV either. But there has to be a middle ground to help co-fund the investigation?

Caveats & FAQs:

• You were stupid! Why did you carry all that around?

Well first of all, yes. But secondly I recently was dealing with a lot of governmental proceedings around the residency just a couple of weeks ago and I forgot to unpack it. I did not spend too much time at home. Also, I almost never put my wallet in my bag. I did this time. Oh well.

• Did you cancel your cards?

Yes.

• Did you get anything back?

Not yet, but I will probably be reimbursed for the card charges — the part I care less about.

• Were you insured?

The laptop and the headphones should be covered. Nothing else, unfortunately. That is despite having 3 separate insurance policies that apply to this situation. Some data is lost.

• Why did you write this?

Hopefully a reminder that people should be extremely vigilant in central London. The bag is gone, but for me writing is a catharsis & maybe a sense of closure. Also I am worried about identity fraud and I am hoping this will provide me with something to point to.

• Is the case closed?

Yes, the Met closed the case almost instantly assuming there was no CCTV, which I think they may have just misheard. Upon informing them that there is CCTV, they closed it down again in 24h due to the resource constraints.

• Can I have the recordings and/or travel history?

Get in touch and explain the reason :)