Telco's handling of identity fraud case ruled 'inadequate'

File photo / Thinkstock

A telecommunications company's processes have been criticised as inadequate when a client, who was the victim of identity fraud, was registered with a debt collections agency.

The woman complained to the unnamed telco after receiving a notice from a collections agency that a debt had been lodged against her name, the Privacy Commissioner said in a recently released decision.

She then discovered someone had opened a mobile telephone account using her name and date of birth. No bills had been paid on the account, and the telco sent the debt to the collections agency.

The telco told the collections agency to remove the debt from the woman's name, and helped her to make an identity fraud complaint to police. The telco also helped the police in their investigations, the decision said.

The woman then wrote to the company and asked about the process it used to confirm the identity of the person who opened the account.

The telco explained its process had been followed, but it would not share what that process was, because it considered the process confidential company information.

The woman was not satisfied with the explanation and complained to the Office of the Privacy Commissioner.

The company told the commissioner it had updated the policy since the account had been wrongly opened in the woman's name.

It now required a driver's licence number or other form of identification, the decision said.

The telco said it was trying to balance getting enough information to ensure a person was who they said they were, with the obligation not to gather too much information.

The decision said the office believed the company had breached the privacy rule where agencies were required to take reasonable steps to test the accuracy of the information they held before using that information.

"We agreed that the telco's process was reasonable in testing that the information was accurate, and that it was about an actual person.

"However, we did not think that the company had taken reasonable steps to ensure the information was being provided by the person to whom it was related," the decision said.

"We told the telco we believed the extra step it added to its verification process was appropriate, but that the process had not been adequate before."

The telco offered to pay the woman's legal fees and it also mad a further payment for stress and inconvenience, which was accepted by the woman.