• silicon.com
• Management
• CIO Insights

By Dan Ilett, 28 February 2006 13:15

NEWS

Just before Christmas, burglars broke into my flat and stole two of my most valued possessions - my Apple PowerBook and my identity documents.

The thieves sifted through drawers, taking utility bills, credit cards, statements and my birth certificate.

Within two hours the police arrived to dust for fingerprints. But none were found and the police have not been in touch since.

So far I've been fortunate in that there haven't been any attempts - that I know of - at fraudulent transactions using any of my information. But going through the process of protecting my identity has made me realise how complicated it is for an individual to keep their identity safe.

It is hard to calculate the cost of identity fraud in the UK - some estimates put it at around £200m per year. But as transactions are increasingly done remotely - by telephone or over the internet - levels of this sort of fraud are likely to rise further.

The first stop was my bank, which cancelled the stolen cards - and accidentally stopped all the others too. The introduction of chip and PIN has made it more difficult for people to use stolen cards in the high street. But that doesn't stop card-not-present fraud or signature fraud in countries that have yet to use chip and PIN.

I changed PINs and passwords for everything but the burglars still had enough documentation to apply for financial products and direct debits in my name.

Utility bills are sometimes the only identification necessary when applying for credit cards and mobile phone accounts, among other things. They are required for some passport applications and a number of other government services as proof of ID.

Next, I applied for a protective registration service from anti-fraud organisation Cifas. For £11.75, Cifas promises to scrutinise any credit applications made in your name.

Cifas, formed by banks, retailers and credit agencies, estimates member organisations lost £63.3m to identity fraud and impersonation in 2005.

One in three attempts made by fraudsters using the details of an innocent victim still results in the application being granted.

The National Consumer Council (NCC) has called for the government to put pressure on companies to take the stress away from identity theft victims. It argues that sector-wide helpdesks in banking and credit should be set up so victims can deal with one person during their ordeal.

Ultimately that could lead to a national ID theft help-point where consumers could report fraud.

An NCC spokeswoman told silicon.com: "We looked at people's experience and thought it would be helpful to make the process quicker and easier. The worst thing is going to the call centres and explaining yourself over and over again. It's as if people feel they are being criminalised."

In the event of ID theft, the Home Office recommends contacting credit reference agencies, such as Call Credit, Equifax and Experian to ensure no one has applied for anything in your name. You can password-protect these accounts to ensure no one can process an application.

Perhaps the most unpleasant thing about ID theft is the uncertainty of what thieves are doing in your name.

In my case, the burglars had credit cards and enough utility bills to prove they lived at my address. This meant they could apply for mail redirection to their address and steal the new cards I had just applied for.

At the time of the robbery I asked the Post Office to inform me if anyone tries to redirect my mail but I was told there was no such service and I would have to phone up and check.

But a spokeswoman from the Post Office later told silicon.com: "If someone sets up a mail redirect we would write to the address from where it's being redirected. The identification presented must be original, such as a bank statement or utility bill. There are a number of security checks."

Which perhaps underscores the greatest identity fraud weakness - the continued reliance on paper documents. My laptop - stolen in the raid - was encrypted so the data on it was probably inaccessible to the thieves.

But you can't encrypt a utility bill and few people would think about locking them away. But for as long as they are accepted as proof of identity, these sorts of documents will remain a weak link in the fight against identity fraud.