Good points made, especially the pc scam which is a widespread horror.

The important point to note is that one has to always be on one's guard when undertaking any type of commercial transaction. There are no fool proof ways of confirming a stranger's identity, other than verification by a known friend. This essentially rules it out for commerce these days, which is mostly undertaken with people we have not met before.

Providing a string of digits to accompany a telephone call does nothing to change the situation; many companies one knows are not averse to scams.

Quote:


This is indeed a scam, where you are directed to download some software from a website. The caller even talks you through it. Once installed, the caller has compete control of your machine and will steal all your passwords, alter the passwords of all your email accounts and take control of them, access all your online bank accounts, change the passwords for those and then empty all the funds.

Since the passwords for your bank account have been changed, you cannot access your bank account. Requesting a new bank password is also futile as you won't be able to access your email to get the see that new password, because the password has also been changed on your email account.

This was recently featured on TV. Not sure if Watchdog, some consumer programme, or just the news.

Oh, and the "callcentre chatter" in the background?  It's played from a recording, there's probably no-one else in the room.

I had a call this morning purporting to be from from my electricty supplier.  My Caller Display showed 'WITHHELD' but the woman asked for me by name and said she was calling about my email.  

I remembered sending a meter reading in via their website a few days ago so said, "What did I say in my email then?"

She immediately said, "I'll have to ask you some security questions first" and I replied, "No, you're calling me, remember?  You tell me my account number and the last 4 digits of the bank account I use to pay you monthly direct debits" (it would have taken me a few minutes to find that informastion myself but she should have had it on her screen).

She went silent and eventually said, "I'll have to reply by email then."

Now why could she not have done that in the first place?

Dave wrote on Nov 29^th, 2010 at 7:15pm:

They only follow "rules" to protect themselves.

The rules are designed for their protection, so they can avoid taking serious responsibility. This also enables them to assign important tasks to incompetent staff.


My personal reaction to the electricity supplier scenario would have been quite different. A telephone call can be a more useful way of making contact than an email - it depends on the nature of the transaction.

On being asked a "security question", I would have returned the question - "do you suggest that I answer that?". This could have led to an interesting discussion about the security policy of the company. If they invite customers to give certain information to telephone callers then clearly it cannot be considered as "secure".

We must always be careful to distinguish between "identity" and that which is considered by some to represent adequate "proof of identity" for particular purposes.

If any set of items of information that could be considered to be proof of "identity" are made available to agents of an electricity company then that "identity" has already been stolen by the electricity company. Obviously agents have to handle information that is itself confidential, but they should never have access to a complete set of information that is considered sufficient to prove identity. If this were so, then every past and current agent would have to come under suspicion in the event of any case of fraud - it is quite unacceptable to place employees in such a position.


The other point is to question what information provides an effective assurance of the identity of a person able to provide it. My date of birth (age and birthday), my mother's maiden name, my bankers and my preference for Direct Debit are all items of information that are in the public domain in one way or another. I would certainly expect anyone who is able to answer my home or mobile telephone to be well aware of them from memory. This data may be adequate for the purpose of distinguishing me from someone else with a similar, or identical, name and as such it provides a means of establishing an identity - i.e. which person with a certain name one is talking about. It cannot however offer proof of the status of any person who knows this information, nor any protection against deliberate deceit.

The apparent belief that I am the only person able to present a printed copy of an electricity bill bearing my name and address is quite absurd. If asked to show such a document, it is most unlikely that I would accidentally present that of someone else, so it would provide a useful and convenient means of seeing a printed version of someone's name and address. It is however no protection against fraud.

No company can arbitrarily declare what it believes to be adequate "proof of identity" and expect this to be accepted by the world. It can only do its best to avoid being deceived and then suffer the consequences for any failure. I simply cannot understand how we have allowed ourselves to get into this position where citizens are expected to take action to prevent our identity being stolen by some financial institution to be applied to transactions that we have not personally authorised. It is the same, or similar, financial institutions that try to take money from us to provide protection against this danger. The explanation is perhaps there for all to see; it is simply a protection racket.

---

The issue of withheld CLI is raised. CLI is perversely and wrongly seen as being relevant to the issue of Silent Calls, so I will address this briefly, in the context of the case that is being discussed, by posing two questions:

• If the well known customer service telephone number of the electricity company in question had been presented as CLI would this have provided proof of the identity of the caller?
• If invited to call back to the number given as CLI, should that have left one content to go through the normal "security" procedure, when the call was answered?

I must urge everyone to answer "NO" to both of these questions. CLI proves nothing. It has its uses, but they are far more limited than is widely assumed, and are in fact quite different.

Please nobody suggest that scammers should be put under a regulatory requirement not to use fake CLI - they are already. Alternatively, it could be suggested that honest callers be compelled to give CLI and scammers compelled to withhold it. This might seem to be a brilliant idea, because then everyone could be sold caller display devices for each telephone handset and the associated service for the line, so that they would be able to detect scammers without even having to answer their calls.

I am sorry to say that any regulation that has the purpose of forcing those intent on deceit to declare themselves requires a little more thinking through.

---

Returning to the topic, more directly.

Ofcom provides "rules" so that companies can hang up in silence, whilst being able to say that they are compliant with the "Ofcom persistent misuse policy". This enables them to evade their responsibility to use the telephone properly.

There are some similarities with the data security issue.

Here is an extraordinary story.

  http://www.dailymail.co.uk/news/article-1342398/Businessman-bombarded-calls-30-s...

Those following the Silent Calls story may be interested to watch BBC1 / BBC News at 7:50 AM on Tuesday 1 February.

SilentCallsVictim wrote on Jan 31^st, 2011 at 11:43pm:

Coverage of the silent calls issue was eventually broadcast on BBC Breakfast at 6.50 am and consisted of a brief interview with an Ofcom representative following a short introductory video.

The answers offered by Ofcom were extremely disappointing as the Ofcom attitude is that some silent calls to members of the public is quite acceptable and would be technically difficult for commercial companies to avoid.  I called the BBC on 0370 0100125 and complained about the Ofcom attitude to this utterly unacceptable anti-social behaviour.   I urge others to do the same to let both the BBC and Ofcom know that Ofcom are failing in their duty to the public.

Both Ofcom and the BBC seem to have missed the point that by allowing one silent call per day to a private phone number it is possible that one individual member of the public might get 5 or 50 or 500 silent calls in one day all from different companies who according to Ofcom are doing nothing wrong.

When are Ofcom going to stand up and protect the public from this abuse?????

There is no excuse.

The BBC have now published a video of the Ofcom interview which was broadcast at 6.50am today within an item titled  "Ofcom introduces new measures to limit silent calls".   The interview may be seen here :---


http://www.bbc.co.uk/news/business-12333661