Your most valued asset for thieves: your ID
Major data breach means most South Africans are at risk
After the "Master Deeds" data breach, you should expect to be the target of identity theft - and you should be taking protective action, says Manie van Schalkwyk, the executive director of the non-profit Southern African Fraud Prevention Service.
Identity theft is the crime of getting the personal or financial information of someone so that the criminal can be approved for credit or make purchases in that person's name.
Described as South Africa's largest recorded data leak, the Master Deeds breach was made public almost a month ago - yet some credit bureaus are reporting no significant increase in the number of consumers checking their credit reports for signs of identity theft.
A file containing the ID numbers of 66 million South Africans (some deceased) was found to be available on a publicly accessible web server. The data included the names, e-mail addresses, gender, ethnicity and income estimates of South Africans.
Troy Hunt, the information security expert who exposed the leak, says the files were open to the public for, at best, seven months; at worst, for two-and-a-half years.
Before the information was removed late last month, "anyone with a web browser could ... see all the files hosted on the site", he says.
Describing the breach as "devastating, considering the degree and breadth", Brennan Wright, the marketing manager for identity verification platform ThisIsMe, says most South Africans seem to optimistically believe their identity will never be stolen.
"While we have tools to protect ourselves in the physical world, in the digital world we aren't as aware of the dangers to which we're exposed. Awareness is low because the digital economy has evolved so quickly, we haven't had time to adapt to it, even though we touch it daily," Wright says.
The golden rules of guarding your identity
Manie van Schalkwyk, the executive director of the Southern African Fraud Prevention Service, says you can protect your identity by observing these rules:
1. Shred all personal documents when you are done with them.
2. Treat your identity document like cash - don't leave it lying around and don't give it to people you don't trust.
3. Don't click on links if you haven't initiated the communication. Your bank will never send you an e-mail or an SMS asking you to click on a link to access your online banking platform.
4. Don't respond to requests to update your personal info over the phone. If someone is claiming to be from the bank, end the call and phone the bank.
5. When you're online, make sure you're on a secure site - look for "https" in your browser.
6. You have not won the prize, ever.
7. Always "take five". Don't be rushed into parting with personal information.
There are ways to protect yourself from identity theft - and your best defence is to monitor your credit report.
According to research by data manipulation company Experian's victims of fraud team, it takes an average of 292 days for people to discover that their information has been used for fraudulent purposes. But if you're checking your report regularly, you can mitigate your losses, even if you can't prevent identity theft.
Check your credit report
Van Schalkwyk says it's imperative that consumers check their credit reports with all of the consumer credit bureaus registered with the National Credit Regulator: Compuscan, Consumer Profile Bureau, Experian South Africa, TransUnion and Xpert Decision Systems.
In terms of the National Credit Act, you're entitled to one free credit report a year from each of the bureaus. Alison Magrath of the Credit Bureau Association says all of the consumer bureaus have made various free products available for consumers for three months - starting on November 1 - to help you monitor your credit profile to ensure you don't become a victim of fraud.
TransUnion, for example, is offering free alerts to consumers in the event of any critical changes to their TransUnion credit reports. To take up the offer, which is valid until the end of January, call 0861482482. You will be issued with a free credit report and alerts on your profile will be activated. However, if there is a sudden critical change to your report - such as the opening of a new account, an inquiry by a creditor, or a negative listing (when an account is handed over for debt collection) - you will get the alert only. To find out exactly what has happened, you will need to buy your report.
When checking your credit report, you need to look out for "suspect inquiries and new lines of credit", Van Schalkwyk advises.
Every time you apply for credit, a credit provider will check your report to assess your creditworthiness. This inquiry is recorded on your credit report. If you see that a microlender or a clothing retailer, for example, has made an inquiry, but you don't have any clothing accounts or microloans, it is time for you to investigate.
Van Schalkwyk says that if you find that fraudsters have attempted - or managed - to obtain credit in your name, you must notify his organisation, which hosts a database listing both the victims and perpetrators of fraud.
The Southern African Fraud Prevention Service has a "protective registry", which lists the ID numbers of victims of identity fraud. This alerts member companies to take extra precautions when dealing with anyone claiming to be you.
You can also subscribe to ThisIsMe, an online platform that offers subscribers a free, secure profile where you can store personal data. To verify yourself with ThisIsMe, you'll need to give the company your ID details, a mugshot, your residential address and cellphone number.
292 is the number of days, on average, that it takes people to realise their personal information has been used for fraudulent purposes, according to research by Experian
ThisIsMe, which clinched top spot along with EasyEquities in the 2017 Africa FinTech Awards, also enables you to check whether your personal information has been leaked online. And you can Fica yourself online when dealing with merchants who partner with ThisIsMe.
In future, subscribers will be automatically notified every time their e-mail account is found in a data breach and every time a change is made to your personal information held at the consumer credit bureaus.
Consumers who are in the market to rent a property can also opt for a credit report from Ekaya, another award-winning fintech and the developer of Verified Identity Profile, a tool that helps tenants and landlords connect and exchange information easily and securely online. Until the end of the month, Ekaya is offering a 50% discount on the VIP service, which normally costs R99. The profile service includes a credit report, which is unique in that it indicates to users whether their ID number appears on any fraud databases, employer fraud databases and the SAFPS's protective registry.