All you need to know about ID fraud

HM REVENUE and Customs' loss of the details of virtually every family in the UK with a child under 16 is undoubtedly the biggest and most serious breach of personal information the country has ever seen.

The admission by the Chancellor, Alistair Darling, has unleashed widespread fear that the details could fall into the wrong hands to be used for criminal gain.

It has also thrust into the public glare the issue of identity fraud, which has been burgeoning over the years, alongside legitimate technology, and now costs the UK an incredible £1.7 billion a year.

Information has long been easy to obtain - through, say, hastily discarded bank statements or paper applications for the likes of store cards.

But with the proliferation of social networking websites, the growth in online banking, and the explosion of internet shopping, our personal details are much more widely disseminated than ever before.

Here, The Scotsman looks at what identity fraud is and who is committing it against whom. We also explain how you can do your best to protect yourself - first by preventing your details from falling into the wrong hands and, if that does happen, how to prevent the details being used for criminal ends,

Q & A: GUARD YOURSELF AGAINST IDENTITY THEFT
Wh

at

is identity fraud?
It

is using information belonging to another person for gain - be it monetary or in the form of goods or services. It starts with identity theft - when the information is stolen - and becomes fraud when it is used for profit.

What

are the key pieces of information thieves want?
Id

entity theft can be committed if a third party has only a name and address, but the more details they have, the easier it is for them to adopt the identity. These could include date of birth, place of birth, bank account details and credit card details.

What

will this information be used for?
On

ce thieves have accumulated enough information, they can approach financial institutions with it and apply for credit. They can also try to access existing accounts.

How

else might an identity thief use my details?
It

is becoming increasingly common for the thief to sell on the details to a third party, rather than using them directly. This would see the details go on the information black market, where hundreds of thousands of people could potentially access them.

Who

are the identity thieves?
In

97 per cent of cases, the perpetrator is unknown to the victim, making identity theft a highly unusual crime. The thieves often start by rummaging through people's rubbish to find out personal details. However, there was the high-profile case this summer of Jeannie Smith, 45, of Denny, near Falkirk. She pretended to be her sister, Linda Cowan, 35, obtaining £123,000 of goods in the process.

Who

are the identity theft victims?
Am

ong the groups most at risk are graduates renting private accommodation; young couples with children and high outgoings; young, reasonably affluent single people in shared, rented accommodation; successful people from very wealthy households, and high earners who live in premium city addresses.

Londoners are four times more likely than the UK average to become victims of ID fraud - of 54 areas classified as very high risk, 20 are in London. Fraudsters have used birth certificates to impersonate dead people - a crime known as jackal fraud, after the novel The Day of the Jackal.

How

does identity theft happen?
Of

ten, people are too eager to give personal information away. Research has shown that many do not think twice before answering surveys or filling in forms. Social networking sites such as Facebook attract members who reveal their most intimate secrets. Experts are concerned that we do not employ the same safeguards in the virtual world as in the physical one.

How

else can it happen?
Fa

ke websites, purporting to be those of banks, have been set up to steal account holders' details. The organisations which hold data can also physically lose it, such as the HMRC auditor who lost thousands of investors' details.

What

happened in that case?
A

computer belonging to an HM Revenue and Customs employee was taken from his car in London. He had been using it for a routine audit of tax information from several investment firms. It contained details of customers from companies including Standard Life and Liontrust.

Have

there been any other major information security breaches recently?
As

ide from the catastrophic loss of the entire child benefit database this week, a CD containing the personal details of thousands of Standard Life pension holders went missing from HMRC, leaving them at heightened risk of identity theft. Nearly 15,000 customers were warned to be on high alert for potential scams after their data was lost in transit by a courier.

How

can I protect myself?
Be

fore you give out personal information, stop and think who you are imparting it to - and why. Are they a respected body or not? If you are filling in a form, either on the internet or on paper, check the box which says you do not want your information to be passed on.

Also, if you buy goods online, use only one card, and make it a credit card rather than a debit card.

My c

hildren use social networking sites - should I be worried about their identities?
Tr

y to educate youngsters to behave in the virtual world as they would in the physical world - by not passing on information about themselves to strangers. They should also be aware of what information they are allowing to be viewed by anyone.

Are

there any other steps I can take to guard against identity theft?
Yo

u could make sure your bank and credit card account passwords do not relate to the data that could be compromised.

For example, do not use details such as your children's names or your street name. Fraudsters are likely to make a good guess at such passwords - so make sure you update them on a regular basis.

Can

companies sell on my personal data?
Ye

s. If you do not tick the box on the form you are filling in which prevents them, they can either sell it on or swap it with companies they deal with regularly. They can sell it on to mailing lists which are used by other firms, although the information is not worth much.

How

easy is it to access bank accounts?
No

t very. Someone could either try to go into a branch with a sort code and account number and withdraw cash, or they could hack into the account on the internet, using online banking.

Have

banks got any protection in place to stop this happening?
Ye

s. Online banking security is improving and there are now normally two levels of checks in place before a user can access the account. In the bank, users will normally have to enter their personal identification number to withdraw cash.

How

will I know if someone has accessed my account?
Mo

dern fraudsters are moving away from the "smash-and-grab mentality", which dictates they get in and out as quickly as possible with as much cash as possible. They are now more likely to siphon off small amounts of cash over long periods of time. This means that any changes to an account may not be very obvious. Bank accounts should be checked carefully.

Will

my bank notice if my account has been compromised?
Mo

st banks will contact you if they notice any suspicious activity on your account to confirm that it has not been hacked into. If there is a known identity theft, they will also step up monitoring of accounts.

How

else might I know if my identity has been appropriated?
If

you receive any suspicious letters congratulating you for signing up for a loan you know nothing about, or thanking you for your application for a credit card, do not ignore it.

It could be a clue that someone else is out there masquerading as you. Call the company concerned and get to the bottom of it as soon as possible.

Similarly, watch out for hoax calls trying to extract more information from you. A criminal may have got some of your personal details but needs more to execute a fraud.

How

likely is it my information will be lost from a government department?
On

e in four data breaches in the UK occur within government departments - and government departments hold all manner of personal details, from pension funds to child benefit accounts.

Will

I be told if my data has gone missing?
Th

e government recently dismissed the idea of a breach notice instrument proposed by the House of Lords. This would have required organisations to disclose when information security had been breached and how they proposed to protect the victim against fraud and identity theft following the loss of their information.

What

about the Data Protection Act?
Th

e Data Protection Act regulates how your personal information is used and protects you from misuse of your personal details. It provides a set of eight data protection principles, which prohibit the misuse of your personal information without stopping it being used for legitimate or beneficial purposes.

A "data controller" - someone who holds your information - must abide by them. There are also stronger protections for sensitive information, such as that which relates to religion and sexuality.

What

are the principles?
Th

ese require personal information to be: fairly and lawfully processed; processed for limited purposes; adequate, relevant and not excessive; accurate; not kept longer than necessary; processed in accordance with your rights; kept secure, and not transferred abroad without adequate protection.

What

rights am I afforded by the act?
Th

e act, with some exceptions, gives you the right to find out what information is held about you by organisations. This is known as the "right of subject access". On written request, you are entitled to be supplied with a copy of all the information an organisation holds about you.

The organisation may charge a fee for providing the information, up to a maximum of £10 in most instances and up to £50 in the case of manual medical records.

To see what information is held on you by credit reference agencies costs £2.

Does

it have any provisions for instances when my information is misused by the data controller?
Pe

ople who suffer damage because of a breach of the act are entitled to compensation from the data controller. They can also claim for any distress they have suffered.

If I

am a victim of identity fraud what will the consequences be?
Th

ey could be very wide-ranging, depending on what your identity is used for. At the worst end, you could find you are implicated in a criminal investigation. You could be turned down for a mortgage and lose out on a new home while the mix-up is sorted out.

Your credit rating could plummet and it will take time to fix. If your bank account is accessed, you will have to spend time sorting it out.

It takes an average of 539 days to discover that you've become a victim and it can then take a further 300 hours of work to clear your name.

How

big an issue is identity theft in the UK?
Ma

ssive - and growing all the time because the amount of information out there is vast and easy to access. Last year there were 178,000 victims in the UK.

How

much is identity fraud costing us?
La

st year - £1.7billion. Average losses ranged from almost £2,000 on a credit card to more than £7,000 on a current account.

Is t

here a greater cost?
Ye

s. A lot of the sale of information is used to fund other crimes.

The identities adopted can be used to pursue terrorist agendas. Identity theft was a factor in the 9/11 attacks.