Get 1-to-1 money guidance
Which? Money members can get impartial guidance from our experts, based on 350 years’ combined financial services experience.
Find out more‘How did a company I’ve never heard of set up an automatic payment?'
Every week, we help you with your money problems
‘I was on my phone when I saw an advert for a website selling lightning iPhone charger cables for £11. I ordered one via PayPal. Then I received two emails in quick succession, revealing that I had paid a seller called Thicc Fitts Ltd. They hadn’t taken £11, they had taken two payments of £27.57 and £50 for a wi-fi extender and car phone holder that I didn’t order.
‘My son tried for two hours to cancel this order online, but it kept sending him round in circles. I found out they had set up an automatic payment via PayPal, which meant they could take whatever they wanted from my bank account.
‘Later, I received a parcel with the tech stuff I didn't order. There was a cable in the package, but it wasn’t the iPhone lightning cable that I was expecting. I need help to return all this stuff and get my money back from this disgraceful company. Neither PayPal nor my bank has refunded me.’
Marilyn, 77, Hampshire
Chiara Cavaglieri, Which? senior researcher, says:
Cases like this suggest subscription traps are not being taken seriously by the payments industry. Your money went to a company called Winkoola, although the seller’s email address listed in your PayPal statement links it to a now-defunct site called thiccfittslimited.com.
The site winkoola.com gives conflicting information about who is behind it. It names Winkoola as the company, refers to a skincare brand called ‘Mederical (sic) Moltra Skincare’ on its About Us page, and lists a Hong Kong firm, Jungoal Limited, on its contact page. While this site claims goods are made and shipped from the UK, yours were sent from Wuhan, China, confirmed by the delivery tracking number you were given.
Both thiccfittslimited.com and winkoola.com have been accused of overcharging and taking unauthorised recurring payments by others on the review site Trustpilot.
The ‘authorised’ loophole
I secured a full refund for you after intervening with PayPal and your bank, Santander. Winkoola should also be blocked from taking any further card payments.
But your case highlights a much wider problem. Because you passed two-factor authentication checks, Santander and PayPal treated these as authorised transactions. This is despite you not agreeing to be charged for additional items or to any recurring payments.
I was disappointed to learn that Santander won’t be reporting Winkoola to Mastercard.
Santander said: ‘Due to receiving the items she was charged for, this complaint was not logged as a fraud case. We appreciate that we should have explained that the recurring card payment was still set up, and we have offered £50 for the inconvenience this subsequently caused, which she has accepted.’
PayPal wouldn’t be drawn on Winkoola specifically, citing privacy laws, but its response highlights the limited protections in cases like yours. You told PayPal the payments were unauthorised, which is accurate from your perspective, but you would have had better luck saying the goods didn’t arrive, or weren’t as described.
PayPal said: ‘We do have a robust process in place to help protect customers, called Buyer Protection. This covers purchases that don’t arrive or don’t match the seller’s description. In Marilyn’s case, the details were input incorrectly, which caused the claim to be denied. Upon review, the case has been resolved positively, and we have provided Marilyn with a refund and a gesture of goodwill.'
The industry is failing to acknowledge how widespread rogue advertising is, leading people to give their card details to businesses accused of impersonating reputable brands, or to routinely overcharge cardholders and set up recurring payments without their consent.
If claims such as yours aren’t even investigated as potential scams, rogue subscription businesses will never be stopped.
Which? contacted Winkoola using the email addresses provided in its invoices and on its main website, however, we did not receive a response.
