I thought I'd raise this here as it might interest the group.
My sister recently saw a charge on her Bank App, from TFL for £4. She's not very tech savvy, so came to me for advice.
Had a butchers and the only TFL charge that I could find that was £4 is the Blackwall Tunnel charge. Regular payment.
Spoke to bank, they confirmed it was a genuine charge from TFL from Bridges and Tunnels. gave us a transaction reference.
To be clear. My sister had not used the tunnel since it became chargeable, and not paid for the tunnel for anyone else. She has a dormant TFL account, but this card is not associated with that account.
Contacted TFL. Call centre could not help, requested email communication. After a bit of to-ing and fro-ing, they asked for payment card details (some redacted) to identify transaction.
They finally said: Yes there was a payment on 4th November. Gave the impression that for them, the case is closed! Clearly not reading previous communications, said to provide receipt(!) details if they were to investigate further! Otherwise contact bank.
It seems to me that there appears to be only two possible explanations:
Her bank card details have been maliciously obtained and used.
TfL’s systems have incorrectly applied a genuine transaction to her card details.
Very curious.
It seems bizarre that a malicious agent would risk using a false card on a system from which they potentially could be traced, via reg number.
The second possibility is particularly concerning. This card was only issued in June 2025, and as an Oyster 60+ cardholder she does not use her payment card to 'tap in', so I do not understand how TfL would hold her bank card details at all.
We wrote back requesting:
What was this payment for?
How was this payment made?
Was her name used in the card payment details?
What vehicle registration was associated with this payment?
Which TfL account was linked to that vehicle registration?
Is her card linked in any way to any accounts or previous payments?
What steps are TfL taking to investigate this matter further?
Requested a refund.
We cancelled the payment card, so can't happen again.
Awaiting reply. It's only £4 but I just wondered what information TFL are obliged to give?
Let's assume that they map the payment to a transaction. And hence to an account.
If they can,
Are they obliged to pass on this detail to us? Or is this protected under Data Protection?
If they can't, can they legally charge for a service they cannot show she requested or benefitted from?
Where's the contract?
