OT - CRAPITA and security

[David WE Roberts]

O.K. - Iam a capitalist red in tooth and claw. As witness the fact that I hold some National Grid shares.

I am also rubbish at administration because I keep forgetting to change my address details with the registrar, Crapita.

So the other day I went online with my dividend certificate (posted to my old address and brought round by the new owners) to see if I could register for an online account and change my address instead of doing it via snail mail.

It was remarkably easy. However there was a security process to check (presumably) that I hand't just nicked the certificate, or had received the certificate because I was living at the old address and fancied some free shares.

They sent a letter to my NEW registered address saying that they had recently been asked to change my adddress and could I contact them if I had NOT requested this change.

Uh, duh?

If this was a fraudulent request why would they change the adddress to the correct one?

I can see this would work for other changes, but address is a special case. Address change is always hard to confirm which is why identity theft is feasible.

So - with an established postal address, use this to confirm a request for online access. After that, manage online including address change.

Without an established postal address (e.g. when wanting to change address) at registration follow the traditional paper based system which is still not much good if your mail is being intercepted.

What you don't do is allow on online change at registration, then send to the new address for a negative confirmation. At least require a positive signed paper response to confirm the new address.

Grrrrr

Dave R

Oh, and the other registrar refused to allow online registration and change of address - required a paper confirmation of the new address before setting up online access.

[Martin Brown]

Be very careful if you have one of the card security features attached to your credit card then. You have to notify them *separately* of any change of address or they send the renewal notice and a complete list of all your credit cards to your previous address "for reasons of data protection" Xcard cannot share change of address notification with the independent provider that supplies its badged Xcard Security facility.

To be fair they might have sent a copy of the same letter to both addresses and you have only seen the one to your address as yet.

In the UK proof of identity is notoriously difficult. I have been asked several security questions that are completely unanswerable even by the householder. Name a street that connects to your street (our local roads have no names) and they didn't like "A19(T)" as an answer.

[Moonraker]

Produce a recent utility bill,must be original, not more than6 months old, not copied or on line. All my bills are paid on line with no hard copy. Rates bills and my electricity are all paid annually, it is getting harder and harder to fill the requirements. Even my bank & CC accounts have no hard copies.

[Martin Brown]

And I could forge one of those on my full colour laser printer using the right paper to a standard that would certainly fool a bank clerk although it would not stand up to proper forensic scrutiny.

I deliberately keep one household bill in each of our names to cater for this UK stupidity. I also have a passport.

[John Rumm]

They will probably have sent a matching mail to the old address as well... something else for the new owner to bring you ;-)

[David WE Roberts]

I think the main problem is that they do not require a response. If there is no phone call they assume everything is O.K. Again, fine for everything but change of address. I would expect to have to phone up and confirm I got the letter and do the usual date of birth, secret question etc. to validate.

[John Rumm]

I noticed last time I moved there were a number of organisations that worked on the letter to both addresses approach. It was interesting that many did not bother to mark the one to the old address as "not for redirection", so my mail redirect would deliver both copies here!

[David WE Roberts]

Second letter, to old address, just turned up. So which threats are being addressed?

(1) Stolen mail, and an attempt to redirect one item to a false address - covered (as long as the confirmation letter is not also stolen). (2) Moved without amending address - not covered. However the person who moved bears some responsibility.

However in both cases IMHO there should be a positive confirmation instead of acceptance by default. Yes - I have received notification of an address change request. Yes - I can verify my identity. Otherwise identity theft is quite tempting.

Cheers

Dave R

[Martin Brown]

It is. And therein lies the problem. Proving your ID in the UK is non-trivial.

[John Rumm]

Attempts to redirect mail without your consent or knowledge... If in reality you had not actually moved, the fact that you got a letter saying thanks for the move notification etc, would give you a chance to interrupt the process.

Well if you did not change the address, presumably they would carry on as normal sending to the old address.

and indeed it is...

[John Rumm]

Count yourself lucky we did not end up with a national identity register. Imagine the fun trying to prove that is wrong when every piece of identification you can access uses the same central database for "proof".

[Martin Brown]

The UK national identity register would have been a total disaster. But then the government can't do computer projects and deliver them at all so there was never any risk of the one ring to bind them all...

A national biometric ID card would have been a step forward. I have previously lived in Japan and Belgium where ID cards are mandatory.

[Dave Liquorice]

But they do seem able to evolve existing systems. The photo driving licence is slowly becoming a defacto national ID card. Wouldn't be a big step to add biometrics to it.

Of course they would reinvent the wheel rather than adopt what is already in use in passports...

[John Rumm]

ID cards are ok in some cases, but people seemed to have difficulty separating them out from the ID register... as "just another form of ID" they would be relatively harmless unless legally obliged to carry them.

[The Other Mike]

Couldn't you just sing "Where the streets have no name" ?

[tim....]

TV licensing used to have the same security if you paid (online) with a card registered at a different address to the TV you were licensing.

But they sent the confirmation letter to the TV address not the cardholder address. Uh!

tim

[geoff]

In message , The Other Mike writes

I had a problem with the DVLA last year and wasn't going to be fobbed off

So if anyone has problems with the DVLA, the person to call is Jackie Manser-Thomas - vehicle customer focus

Tel: [phone], fax: [phone] (or the other way around)

Strangely enough, they don't publicise this number