I have used winscp to check this and realised i was using the sftp option to connect and that is what gives the user all access.
However now changing that to ftp user has only access to their folder.
But surely that can't be right, that using sftp they can have complete access. ??
Thanks for your help