Protect yourself from identity theft

It is estimated that identity theft costs the South African economy around R1 billion a year.

Consumers who manage their accounts well and stay on top of their repayments may believe that they have a good credit record, only to find that they have been compromised by an impersonator when their request for credit is denied.

The South African Banking Risk Information Centre (SABRIC) warns that your personal information can be used by criminals to assume your identity and acquire retail accounts or bank accounts, or even defraud your insurance, medical aid and Unemployment Insurance Fund. In some instances, they impersonate you, and using social engineering, access your bank accounts and do transactions.

The following are the most common ways for fraudsters to gain access to your personal information:

Dumpster diving: Criminals rummage through trash, looking for bills or other papers that contain your personal information.
Skimming: Your credit or debit card number is stolen by using a special storage device while your card is being processed for payment at a store.
Phishing: Criminals pretend to represent a legitimate financial institution or company and send spam or pop-up messages requesting you to provide them with your personal information. Most cyber criminals use Trojan, a crimeware computer package used to obtain unauthorised access to a potential victim’s personal information.
Changing of address: A criminal diverts your billing statements to another location by completing a change of address form.
Mail theft: Bank and credit card statements, offers of pre-approved credit cards and the like may be stolen from your mail.

It is recommended that you consider the following precautionary measures when you are required to provide personal information for security verification purposes:

Do not use any information that may have been compromised. Rather use other personal information that you have not used previously to confirm your identity in future.
Register a new email account. Implement dual authentication for all accounts and products, especially for financial services products.
Register for SMS notifications to alert you when products and accounts are accessed.
Conduct regular credit checks to verify whether someone has applied for credit using your personal information and if so, advise the credit grantor immediately.
Investigate and register for credit related alerts offered by credit bureaus.
Check your bank statements regularly.

Should you suspect that your data has been compromised, SABRIC advises that you take the following steps:

Where can I check if my data has been compromised in a breach?

You can check when and where your information may have been compromised on free data breach websites created by cybersecurity experts. These websites aggregate data breach information into a searchable format. All you need to do is check by entering in your email address or your username.

Is there somewhere where I can complain if I discover my data is compromised?

“The Protection of Personal Information Act, 2013 (PPI Act) aims to promote the protection of personal information processed by public and private bodies by, among others, introducing certain conditions for the lawful processing of personal information”. Should you suspect that there has been interference with the protection of your personal information, you may lodge a complaint with the Information Regulator at IR@justice.gov.za

What are the legal responsibilities towards me by the person that lost my data?

The party responsible for losing your data is, by law, required to report this to the appropriate regulatory authorities such as the National Credit Regulator and the Information Regulator of the incident. They will be required to report the breach to law enforcement and initiate a formal forensic investigation. Failure to do so or delaying this could result in massive fines or penalties.
The party responsible is also obliged to tell you that your data has been compromised.

What do I do if I discover my identity has been used to create a bank account or subscribe to a service without my consent?

Immediately report the identity theft to the South African Police Service and the company, bank or financial institution where the fraud occurred.
If a bank account has been fraudulently opened using your identity, close your existing bank accounts and the bank accounts opened by the thief. Request new accounts and PINs.
Also, apply immediately for a free Protective Registration listing with Southern Africa Fraud Prevention Service (SAFPS). This service alerts SAFPS members, which includes banks and credit providers that additional care needs to be taken to confirm that they are transacting with the legitimate identity holder.
Consumers wanting to apply for a Protective Registration can visit the SAFPS website – http://www.safps.org.za/ – under the “Fraud Prevention” Tab, click on “Apply for Protective Registration”, and “Register Now”.
If you have any concerns about your data you can check your credit report by visiting any one of the following credit bureaus websites: TransUnion, Compuscan, Experian, XDS and mycreditcheck.
If your username and password and for your online account has been breached, change these immediately. Use a strong password and remember to also change your security questions and answers. Update usernames and passwords for any other accounts if they were similar to those that were breached as well.
Remember, never disclose personal information such as passwords and PINs when asked to do so by anyone via telephone, fax, text messages or even email.

The information contained in this article is of a general nature and intended for information purposes only.