Originally Posted by Schultzois

I just went back for a look and indeed it’s true. My full billing address along with method of payment (but only last 4 digits of Card) is on there. I’ve also just noticed that as it was an Avios redemption, the cost shown in the email is just the fees, which do actually match up, I think, with what they were “offering” to refund me. So I’m increasingly convinced that it was an intercepted email. And their scheme makes use of the information they already have to draw you in, then tells you that the card on file can’t be used for the compensation (which, again, didn’t surprise me as I thought we were talking about EU/UK compensation, not a refund) but then they get to you give other cards that they use to set up an account with a transfer company. Clever but diabolical.
The confirmation receipt doesn’t have my phone contact, but I think MMB shows that info. They did phone me, which is one of the more troubling bits of this whole story.
I guess there are a lot of ways to get a phone number, so it’s hard to say if they got it from MMB or elsewhere.
Well as per advice above I did send an email to BA DPO basically laying out what I put in my first post about this here, and also giving them the phone number from which I’d received the call. I’m hoping they treat this seriously as it’s someone peddling off the good custom of BA and their reputation in order to commit a crime.
I think (thanks to my bank, really) that we’ve shut down the effort towards me, but I will be trying to give a call to my own paid data privacy service to let them know. Just have to find the bloody phone number, as I’ve not needed to contact them in almost 6 years!
But it is looking increasingly as though this could have been a data compromise on Apple’s email service, though it’s not easy to be certain.