FCA cracks down on finfluencers, CMA's first drip-pricing fine, and a Westfield data breach

A short, sharp daily update: three regulator stories, one breach to watch, and a reminder on car finance.

The FCA closes a year-long pursuit of illegal finfluencers

The Financial Conduct Authority wrapped up a five-day global "Week of Action" yesterday targeting illegal financial promotions on social media. The numbers are unusually concrete:

• A guilty plea from a Geordie Shore cast member for promoting unauthorised investments
• Criminal proceedings opened against two further individuals
• 4 targeted warning letters and 34 warning alerts (14 of which were updates)
• 120 takedown requests to social media platforms covering 1,267 illegal financial adverts that had reached at least 2.3 million UK accounts
• 17 regulators worldwide running parallel actions

What it means for you: the FCA's warning list is now the single best place to check whether a "trader", crypto promoter or BNPL recommendation you saw on TikTok or Instagram is actually authorised. If you put money into something pushed by a non-authorised promoter, and lost out, that promotion was, by definition, an illegal financial promotion under section 21 of the Financial Services and Markets Act 2000. You may have grounds to claim against the promoter, against the platform that hosted the advert, or both. EvenStance can help you check.

CMA uses its new powers for the first time: £4.2m for drip pricing

The Digital Markets, Competition and Consumers Act 2024 gave the Competition and Markets Authority the power to fine firms directly for breaching consumer protection law, without going to court. This week it used that power for the first time, imposing £4.2m in fines for "drip pricing": the practice of advertising a low headline price and then revealing mandatory fees only at checkout.

If you've ever been told a concert ticket costs "£40" and ended up paying £55 once "service charges" were added, that's drip pricing. Same for the hotel "resort fees", the "delivery and packaging" line on a takeaway order, and the airline that quotes one fare and adds another £30 of "convenience" once you reach the payment screen. The DMCCA explicitly outlawed it.

What it means for you: if you paid mandatory fees that were not disclosed in the headline price for a purchase made after April 2025, you can ask for the difference back. Start with the retailer. If they refuse, the CMA's new direct enforcement route is open, and EvenStance is adding a drip-pricing template to its retail and travel categories this week.

Westfield: cyber attack on the loyalty database

Westfield has warned customers that a cyber attack exposed personal information linked to its loyalty programme and newsletter database. The shopping centre operator hasn't yet said exactly what was taken, typically that means email addresses and names at minimum, and potentially purchase history, dates of birth or partial card numbers depending on what the loyalty programme stored.

If you were a member: Westfield should write to you. If they don't, you have the right under UK GDPR to ask exactly what was held about you and whether it was affected (a Data Subject Access Request). Where data has been compromised through a controller's failure to keep it secure, you may also have a claim for compensation under Article 82 of the UK GDPR, for material loss (fraud, time spent putting things right) and non-material loss (distress).

EvenStance is preparing a Westfield-specific DSAR + Article 82 letter template. We'll publish it as soon as Westfield confirms what was taken.

And on the motor finance front: keep complaining

The Consumer Voice challenge to the FCA's motor finance redress scheme (the £9.1bn-ish PS26/3) is still live at the Upper Tribunal. Martin Lewis was emphatic on MoneySavingExpert this week: do not wait. A complaint that's already in the system at the moment any wider scheme is ordered is a complaint that gets paid out. A complaint you haven't filed yet is not. We covered the underlying detail in yesterday's roundup. EvenStance will lodge your motor finance complaint with your lender for free in under five minutes.

Also this week: six product recalls

Quick scan. Six recalls hit the consumer press in 48 hours:

• GoodHome integrated fridge freezers (B&Q): fire risk
• TKMaxx XO Poppy 10,000 mAh power bank: overheating fire risk
• M&S Authentic Greek Yoghurt with Vanilla: undeclared gluten
• Saffron Pastries (multiple lines): possible rodent contamination
• KTL Kreative Kids! Jumbo Craft Box: sand may contain asbestos
• Matalan baby sleeping bags (range)

If you own any of them, stop using them and contact the retailer for a refund. Section 19 of the Consumer Rights Act 2015 entitles you to a full refund within 30 days; after that, you have a right to repair, replacement or refund depending on circumstances. The KTL asbestos and TKMaxx power bank recalls are the ones to act on first.

Get help

If anything in this roundup affects you and you'd like an EvenStance dispute pack, letter, escalation route, deadlines, evidence checklist, go to evenstance.com and start a case. The first one is free.