Driving License. National Insurance Number

Transcription

1 STAR has teamed up with Prevention of Fraud in Travel (PROFiT) and the Fraud Intelligence Network (FIN) to offer our members the best advice about fraud prevention. We recognise the increasing threat of fraud against our members and therefore have engaged with experts in the field of fraud prevention to ensure your organisation is in the best place to minimise the threat of fraud. IDENTITY FRAUD Why secure your identity? Fraudsters generally hide behind another person s identity to obtain anonymity and avoid detection. Identity Fraud enables criminals to carry out employment and payment fraud and many other scams safe from detection. Once someone has compromised your identity they can use your personal details to commit crime, smuggle people across borders, open bank accounts in your name, buy goods and services on your account, steal money from your bank account and generally act as if they are you, and typically it can take an average of 12 months for you to find out. For these reasons criminals place high value on stolen or compromised identities is such that they trade them internationally across the internet. This makes identity one of the most important enablers to fraud. As the economy moves away from its cash base, people have access to modern financial instruments such as credit cards and bank accounts. As a result there is now a clear need for an objective means for an individual to prove his or her identity to others. Because this need did not appear overnight, but rather evolved over time, institutions ranging from banks to shops have adopted ad hoc approaches to the problem of verifying identity, usually involving the use of already existing documents. The fundamental security problem with this kind of function creep is that many of the documents used to prove identity were never designed to do so. Some commonly used identity verification documents are listed below along with their true purpose. Document used to verify ID Driving License National Insurance Number Actual Purpose of the document A token to show that you have permission to drive a vehicle on public roads. Used to administer the National Insurance or social security system and for some tax purposes in the UK.

2 Passport Utility Bills A token to show that you have your Government s permission to cross national borders. Designed to tell you how much you must pay the electric, gas, or water supplier. A token is a physical or electronic object that may be given or shown as a demonstration of a fact or event such as an Oyster card or train ticket. What is Identity? A report by the Cabinet Office in 2002 defines three basic elements of identity as: Biometric identity: which are attributes that are unique to an individual, i.e. fingerprints, voice, retina, facial structure, DNA profile, hand geometry, etc.; Attributed identity: which are the components of a person s identity that are given at birth, including their full name, date and place of birth, parents names and addresses; Biographical identity: identity which builds up over time. This covers life events and how a person interacts with structured society, including: Registration of birth; Details of education/qualifications; Electoral register entries; Details of benefits claimed/taxes paid; Employment history; Registration of marriage or civil partnership; Mortgage account information/property ownership; Insurance policies; History of interaction with organizations such as banks, creditors, utilities, and public authorities (including receipts, bank statement and ATM mini statements). All of these elements are part of a person s identity and are sought by criminals to use for crime including fraud. The problem arises when tokens are created such as ID cards and database records for the purpose of identification and comparison that biometric identity becomes vulnerable to attack. Encouraging Staff To Report Any Compromise Of Their ID If anyone who works for you has had their Identity or Security compromised this could affect t you so you should always encourage them to report this to you as soon

3 as they become aware, and take steps to help them deal with it. This is because once someone has been compromised they could have had their passwords and usernames stolen, cloned or changed. In addition if they have been the subject of a malware attack and they access work systems externally, they threat to your systems is increased and potent. The attacker may use an employee to place a cryptolocker or other malware on company systems. It is better that you know about it and help deal with it, rather than getting a nasty shock in the near future. How Identity Thieves Gather Information Identity thieves acquire the information they need through an incredibly wide range of techniques. But ultimately the sources of this information fall into two categories: the victims themselves and the people they trust. No matter how closely we guard our personal identifiers we will always have to share them with others, from time to time, in order to function in society. People freely give identifiers when buying goods online and through call centres often without knowing who or where the other person or company are based. Some people do not recognise the dangers of not protecting their personal identifiers and willingly give some details over the phone or in the street to people conducting surveys. Examples of the people we trust directly can include our employer, our bank or credit card company and our family and friends. In some cases trusted organisations such as banks will quite legitimately share this information with other organisations within the circle of trust, such as credit reference agencies. Many of these organisations will then outsource some of their data processing or other back-office functions to other companies who are also deemed to be trustworthy. By now the information that you may have provided to one trusted organisation has gone a long way, yet remained inside a secure, trusted environment. However not every company has robust security or employs staff in an environment that reduces the threat of identifiers being misused. Recognising that you are a Victim of Identity Theft Although there is a great deal that we can do to reduce the risk of becoming a victim of identity theft, we can never eliminate it altogether. Even if you follow all the precautions outlined above you could still become a victim.

4 Most identity theft crime is eventually discovered. But while the amount of damage the criminals can do is limited, to an extent, by the time between starting their spree and discovery there is another equally important time window. That is the time between your personal information being stolen and its first being put to use. By minimising these two intervals we can limit or eliminate the damage. 1. Check your statements as soon as you receive them. 2. Know when your bills and statements are due. 3. Keep records, including copies of your card details and especially telephone numbers. Put these in a safe place. The first step in dealing with identity theft is recognising the signs that indicate you may be a victim. There are three types of warning sign: Things going missing 1. Your wallet, purse or handbag is stolen; 2. Your home is burgled; 3. Important documents, such as your driving licence, passport, credit card or bank statements or utility bills go missing; 4. Cheques go missing from your chequebook. Problems with your mail 1. Your bank or credit card statements don t arrive when you expect; 2. Other mail, such as utility bills, doesn t arrive; 3. You stop receiving mail altogether; 4. Royal Mail contacts you regarding a mail redirection request that you did not make. Unexpected things turning up 1. Your bank or credit card statement shows charges or withdrawals that you didn t authorise; 2. You start receiving bills or statements for purchases you did not make or from businesses you don t shop at; 3. You receive credit cards or credit card statements for cards you didn t apply for; 4. You receive letters or calls saying that you ve been approved or declined for credit you didn t apply for; 5. One of your creditors tells you that they ve received an application for credit in your name, which you didn t make; 6. You are contacted by debt collection agencies for debts that you did not occur; 7. You apply for a loan, mortgage or credit card and are turned down for reasons that

5 do not reflect your true financial position; 8. Your credit report shows information about accounts you did not open, searches by companies you did not apply to or information about addresses you have no connection to; 9. Your bank or credit card company contacts you about suspicious transactions on your account; 10. You become aware of criminal or civil action against you for things that are nothing to do with you. What to do if you Become a Victim of Identity Theft In the UK it is estimated that it takes an average of 300 hours to repair the damage done by identity theft. When dealing with an identity theft against you the steps to take are: Keep records; 1. Make notes of telephone conversations. Write down the date, the organisation, the name of the person you spoke to, and whatever they told you. 2. Where appropriate follow up any telephone conversation in writing. 3. Keep copies of all letters or forms that you send, along with details of the date posted. 4. Keep the originals of any documents where possible. 5. Create a file or filing system for all paperwork and records. Establish the facts; Things do occasionally go missing, so it is important not to over react but to take time to establish with the organisation that sent the item that has gone missing what is happening. Check with Royal Mail whether there is a general issue with post in your area. In many cases it will possible to put your mind at rest with just a few cases. Establishing all of the facts is likely to be an ongoing process, with more information coming to light at different stages. Contact financial institutions; Most banks and financial institutions will have their own forms and paperwork for dealing with identity theft cases. Ask them to send you the necessary forms and complete and return them promptly. Keep copies for your files. If the organisation does not have its own forms you should write to them disputing all of the fraudulent activity and providing sufficient information and evidence for them to investigate it. 1. If you have had debit cards, credit cards, cheques etc. stolen call the

6 issuing bank and ask for the cards or cheques to be cancelled. Ask the bank for a transaction history and inform them of any transactions that you did not make. Always examine your bank statement and if you notice any transactions that you did not make call the bank or credit card company immediately to report unauthorised activity. Ask for the card to be cancelled or the account to be frozen. If you receive bills or statements for goods, services or credit that you know you did not ask for contact the issuing organisation to alert them to the fraud. If you re called by someone claiming to be from your credit card issuer or other financial institution regarding suspect transactions on your account ask them for their name and the name of their department but do not speak to them directly. Then call the organisation on a number you have for them that is either printed on your card or on a statement and ask to be put through to the appropriate person. Once you have established that you are really speaking to your bank work with them to identify suspect transactions. If you receive an purporting to be from your credit issuer or other financial institution regarding account matters do not open it. Call the organisation on a number you have for them that is either printed on your card or on a statement and ask to be put through to the appropriate person. Once you have established that you are really speaking to your bank work with them to identify suspect transactions. Contact credit reference agencies; Contact each of the three credit reference agencies Experian, Equifax, and Callcredit to request a report so you can check the extent of the fraudsters activity. Your file will show all credit accounts opened in your name, plus recent applications for credit made using your details and any checks made upon your creditworthiness. If you find evidence of further fraud contact the organisation straight away and request they remove the data from your credit file. If money or goods have been obtained you should repeat the process described above. You may request that a note is added to your credit file to state that you have been a victim of identity theft. In addition you could register a protective entry with CIFAS which will enable CIFAS members undertaking checks prior to granting credit to see CIFAS DO NOT REJECT REFER FOR VAIDATION and prompt further checks rather than just rejection of your application.

7 Report the crime to the police; Use Action Fraud to report the crime to the police by dialling or via the form on the website at If you believe that mail theft is involved you should also report it to the Royal Mail Customer Enquiry Number If any of your government-issued ID has been lost or stolen report it to the appropriate issuing authority and request new documentation; If any government issued ID has been stolen such as a driving license, passport or national insurance number card then you should report this to the issuing agency in addition to reporting it to the police. Restore your credit rating if it has been damaged; One of the worst side effects of identity theft is damage to your credit rating. The thieves take out loans and buy items on credit cards taken out in your name and then leave you to take the blame. All of this negative information can end up on your credit report. You have the right in law to have incorrect information on your credit file corrected. If the file contains mistakes, the agency must correct them and inform you that it has done so within 28 days. Free advice on how to do this is available from the local Citizen s Advice Bureau. If associated with the thief s criminal record, work with the police to clear your name. In some rare cases the identity thief commits a crime using your identity and you are held responsible. If you are lucky the policed will have the thief s fingerprints and picture which will help establish your innocence. The thief s signature may also be present on paperwork. You need to work with the police to establish the true facts and clear your name. Contact us Prevention of Fraud in Travel (PROFiT) - contactus@profit.uk.com Fraud Intelligence Network (FIN) - contactus@fraudintelnet.co.uk