My husband was recently a victim of ID theft, and the experience highlights how easy it is for fraudsters to use your identity to open accounts.

The number of ID theft victims continues to increase. The trend is exacerbated by data breaches – including at credit bureaus – which compromise our personal information.

We need to ask whether banks and service providers, such as cellphone companies, are doing enough to protect their customers’ money.

Last month my husband noticed that a debit order from Vodacom had gone off from his bank account. He checked his credit record and saw that a new contract had been taken out two months before.

Someone had used his personal information and bank details to take out a cellphone contract in his name.

His information was most likely part of a data leak from a credit bureau, or leaked by a bank official, yet the onus was on my husband to prove that he had not taken out the contract.

The starting point was having the debit order reversed by FNB at a cost of R47. He then placed a permanent stop which cost a further R80.

Vodacom required an affidavit and three specimens of his signature. He needed to inform the credit bureaus, and because someone clearly has all his personal information, he registered for Protective Registration through the South African Fraud Prevention Services. This will alert credit providers that his ID has been compromised.

The credit bureaus also offer a service where you receive an immediate alert on any credit record query. Unsurprisingly they charge for this service, even though the credit bureaus themselves are one of the main culprits when it comes to data breaches.

Cellphone contracts – particularly those that include a phone – are popular with fraudsters. Both Vodacom and MTN confirmed that they have experienced a recent increase in fraud related to identity theft. However, MTN added that this is still less than the amount of identity-theft fraud that was experienced in 2022.

Questions need to be raised about the due diligence undertaken by companies like Vodacom and MTN, especially when allowing contracts to be taken out via online channels.

Other victims report a similar modus operandi. All the contracts were taken out online and in two cases the same dealership was used. The dealership, Like Minds, issued the same contract for the same rand amount. The phone is delivered to a building where the fraudster waits outside. The courier, who is supposed to check the identification documents of the person taking out the contract, does not do so.

Neither Vodacom nor MTN requires proof of bank accounts for online applications. They only verify that the account is indeed a valid bank account. According to Vodacom, given that customers invariably want same-day shipment, debit order verification is sometimes completed after delivery is completed.

This raises another question as to why the cellphone companies do not use the DebiCheck system which was created to authenticate debit orders.

According to FNB there are two options available for debit orders: an EFT debit order or a DebiCheck debit order.  The service provider (in this case the cellphone company) decides which option to use.

DebiCheck debit orders require a customer to authorise the debit order with the bank directly. The debit order would reflect as a DebiCheck debit order with the corresponding mandate information. The EFT debit order system is not an authenticated debit order system.

According to MTN, DebiCheck implementation started this year and is being implemented in a phased approach.

While being a victim of ID theft is extremely frustrating, the cellphone companies are the ones ultimately losing out and they will need to improve their security processes.

MTN says it is putting further protection in place. For example, MTN makes use of biometric authentication via the South Africa Fraud Prevention Services to eliminate identity-theft fraud.

“While we were gearing up for biometric authentication in all channels, the Covid-19 pandemic had set us back with the reluctance on the part of customers to make use of the apparatus due to touch being required.”

Vodacom says it continues to implement numerous initiatives in an attempt to reduce instances of fraud related to ID theft.

“Unfortunately, we cannot discuss these publicly as this can provide criminals with information that might be helpful.”

Steps to take if you are a victim of ID theft

The main lesson from this experience is that we need to assume that our data is compromised and take steps to avoid becoming a victim of ID theft.

Checking your bank statements regularly is a good first step. Also check your credit record frequently.

If you do become a victim, here’s what you need to do:

• Inform your bank and stop the debit order;
• Contact the service provider and provide the required paperwork to cancel the contract;
• Inform the credit bureaus;
• Register for Protective Registration at safps.org.za.

All of this admin is frustrating and time consuming, so book some time out of your diary – you will need it!

This article first appeared in City Press.