Want a fake ID? Check the trash

Johannesburg - Banks, retailers, cellphone stores and travel agents throw clients’ sensitive personal information in trash bins at shopping malls – giving fraudsters all they need to steal identities.

The revelation comes as the legislation that will provide consumers with recourse – the Protection of Personal Information Bill (POPI) – is still waiting to be signed into law. With the appointment of an independent information regulator, consumers will have access to a body that will deal with complaints about handling and processing personal information and impose sanctions.

Digging in bins at shopping centres does not only produce rotting food, but also quantities of bank details, credit card forms with signatures, copies of IDs and mortgage documents all supposedly on their way to a landfill.

The Saturday Star has seen evidence of personal information taken from bins around Joburg which includes complete original applications for retail accounts and cellphone contracts with signatures and ID copies.

Areas where the personal and sensitive client information was picked up include Cresta, Rosebank, Sandton, Protea Glen and Southdale.

The evidence came to light when a specialist fraud investigator, Duncan Waugh, took us on a tour of the bins. There we were able to find a number of documents, including a confidential affidavit to confirm an address with details of a homeowner, his ID number and signature along with certified copies of the client’s ID.

Then there were full details of an external transfer of money amounting to R400 000 with signed instruction forms, the ID copies of the sender, proof of address and the recipient’s full details.

The information gathered is enough for allow fraudsters to open bank accounts, buy goods, illegally apply for credit, or access medical aids in your name.

In a skip outside the Southdale shopping centre Waugh pulled out documents including stamped bank card applications and certified ID copies.

“It’s phenomenal what you can find in the bins,” he said. “This is just a tip of an iceberg. Depending on what day of the week, time or place you can get a lot more. All the ID thief or a fraudster has to do is look in the trash or recycle bin.”

Acting like a character in the BBC documentary The Real Hustle Waugh checks to see what businesses are throwing away.

He calls this action “raiding bins” and believes that this is what is behind SA’s identity theft problem.

“The big corporates are putting their customers at risk in direct violation of the constitution’s right to privacy.

“I don’t want to be sneaking around and exposing this or that company, but this has become a necessity.”

According to Carol McLoughlin, executive director at Southern African Fraud Prevention Service (SAFPS), there are 11 203 individuals recorded as victims of impersonation or identity theft on their database.

“These are only the individuals who are aware that they are victims and have contacted the SAFPS to apply for protection of their ID,” she said. “It can take quite a while for some people to realise that they’ve been impersonated, due to the fact that it is difficult for credit providers to track down the true owner of the account; the person whose personal particulars were used by the impersonator to open an account in the innocent victim’s name.”

She said you do not necessarily need to have lost your ID book for this to happen. Fraudsters will pounce on any available opportunity to use people’s personal information to commit fraud.

“Businesses can play a critical role in the prevention of fraud and need to ensure that they have stringent processes and controls in place to protect consumers’ personal information,” she added.

“According to Forensics4 Africa, identity fraud costs the SA economy approximately R1 billion per year. SAFPS finds it very difficult to quantify the value as we have no access to the actual figures that are being written off by companies as a result of this type of fraud.”

Kalyani Pillay, chief executive of the SA Banking Risk Identification Centre, said identity fraud is an element of most commercial crimes “and it is extremely difficult to quantify”.

“While Sabric is aware of the dangers associated with discarding records containing sensitive information without shredding them first, we do not have any details regarding the investigation referred to,” she said. “Banks have very robust procedures in place to ensure that the person that they are dealing with is in fact who they purport to be.”

Barry de Witt, CEO of FNB channel banking, said the bank took great care with confidential customer documents.

“Our regulatory retention standard has been developed taking into account all record keeping laws,” he said. “Our staff are trained on the protection, removal and destruction of customer records. All customer information must be securely retained or destroyed by the branch.”

Absa spokesman Byron Kennedy said the bank treated breaches of this nature in a very serious light.

“We implement and adhere to information retention policies and will ensure that client and customer information is securely disposed of at the end of the retention period,” he said. “We will investigate and take appropriate action.”

Saturday Star