An episode of identity theft left Lara Wilson in the same boat as many of the people she usually serves with debt collection papers.

The Te Puke-based process server says a photo was taken of
her driver licence. She suspects the perpetrator took it out of her handbag while she was up getting food at a buffet restaurant.

The ID thief then used the photo of the licence to open an account in Wilson’s name with Nova Energy – then proceeded to rack up a series of unpaid power bills, totalling around $1000, from May to November last year, in Wilson’s name.

They went on to open accounts with a series of other providers including Contact Energy (where another $1000 or so in unpaid bills were racked up), buy now, pay later provider Genoapay (around $600) Vodafone NZ (now One NZ) and Electric Kiwi.

“I have served documents on people for electricity accounts who have told me they have had their identities stolen in the same manner, often for substantial sums,” Wilson told the Herald.

Suddenly, she had joined their ranks.

“My credit record was ruined,” Wilson said.

Given her profession, she knew how to go about getting it restored – but even so, she says the episode underlines the hurdles that victims have to jump through, and she has some recommendations for how to improve things.

New licence, old number

“A photo of my driver’s licence was taken without my knowledge. This was all that was needed for the person to open multiple power accounts, phone accounts and obtain other credit in my name,” she says.

The process server says her new licence arrived with the same driver licence number as the one it replaced.

“Driver licence numbers remain with licence holders throughout their driving history and are used as a key identifying feature for enforcement purposes. A person’s traffic offence history is linked to their driver licence number,” Waka Kotahi spokesman Felix Marwick says.

“While Waka Kotahi has no current plan to review current systems, it does have processes in place to ensure licence holders can be protected in situations like this.

“As soon as we become aware of fraud or theft, we cancel the existing driver licence card and issue a new card that has a new version number – a randomised three-digit sequence, like the CVV number on a bank card, and changes each time a person’s licence is issued or renewed.”

Wilson says in her experience, some service providers ask for the version number when using a driver licence for ID, but some don’t. She says she could apply for an international driver licence without being asked for the version number. (A replacement passport comes with a new passport number.)

Wilson would like to see replacement driver licences issued with a new number, and all service providers ask a new customer to snap a pic on their webcam or mobile phone, so it could be matched to the one on their licence or passport. “If the two photos don’t match, it’s not the same person. I told all of the power companies this but they weren’t convinced it’s a good idea.”

Another issue: Wilson gave Nova dibs for discovering the ID theft and alerting her to it – after seven months of unpaid bills, one of the power company’s credit managers ran a Google search and discovered the account holder’s details did not match Wilson’s.

Yet Wilson could not simply contact each of New Zealand’s three credit bureaus (Centrix, Equifax and Illion) to explain events. Instead, Nova and the other service providers involved had to contact the bureaus to explain the situation.

Another setback was that while restored, Wilson’s credit rating was not as high as it had been previously. As someone in the business, she was aware of this quirk from rebuilding a rating, but it still rankled that her credit score had dropped from 680 to the mid-500s.

“The best way to describe it is that it’s like a scar. Even after the creditors ask for those transactions to be removed, the stain still remains,” she says.

Wilson said police were helpful but, overwhelmed by similar cases, unable to make any headway. The ID thief is still at large.

The good news is that Wilson is not out of pocket.

But even with all her expertise, “It took me several weeks and a lot of hours away from my business to sort this all out,” Wilson says.

The cavalry

For Wilson, the only positive from the episode was that it underlined that ID Care is a useful service for ID theft victims.

The non-profit was founded in 2014 by a former executive director of the Australian Crime Commission, with support on this side of the Tasman from then Justice Minister Amy Adams. Today, it draws funding from law enforcement authorities, government departments and private firms across Australia and NZ. It’s one of the go-tos referenced in the Department of Internal Affairs’ site for those grappling with stolen documents.

“There are two things one of our case managers can do for you,” ID Care’s head of New Zealand operations Mark Rowley says.

“We can tell you what an ID thief is likely to do next, and we can tell you how to protect yourself.”

ID Care’s service is free.

First step: Freeze your credit record

The first thing to do is to freeze your credit record, Rowley says.

The key tip here is that as soon as you alert one of the three credit bureaus (Centrix, Equifax or Illion), they will alert the other two, who will also freeze your record.

But he confirms that restoring your credit record is a case of approaching the three bureaus individually.

The bureaus are legally obligated to investigate an individual’s case within 20 working days, Rowley says.

If you want a faster resolution, then you will have to get the service providers involved in each instance of a fraudulently opened account to confirm it with each of the three providers.

Rowley says a service provider that has suffered a data breach has “a moral obligation, but not a legal obligation” to pay for replacements for a driver licence or passport that was stored on its systems, then spilled.

But if the Office of the Privacy Commissioner finds that an organisation failed to take proper steps to protect your data, and you can prove harm, then you could receive a payout.

If a power company or other utility is slow to help out, you can approach a free mediation service Utilities Disputes.

With a phone company, the free Telecommunications Dispute Resolution can referee.

‘No single door’

After Wilson reported to police that her stolen driver licence had been fraudulently used to open a Nova Energy account, it was still used to open accounts with other companies.

“The unfortunate thing with our response environment is that there is no one single door that can prompt enacting all possible prevention measures,” ID Care community outreach manager Sarah Cavanagh says.

“A police report unfortunately doesn’t prevent wider misuse. This is where a credit suppression [your legal right to ask bureaus to freeze your credit rating] comes into play and can prevent wider spread misuse.”

It’s important to enact your legal right to “credit suppression” – or asking the three credit bureaus to freeze your credit record, which can help prevent further offending.

A couple of wrinkles

The Office of the Privacy Commissioner warns that although you have the right to see how your information was used by an alleged ID thief – that is, how they used your credit card, and the amounts charged to it – the alleged offender has a degree of protection under the Privacy Act 2020. That means you’re not entitled to request, say, CCTV footage of them, or request specifics about what goods or services they’ve charged to your plastic.

Another is that power accounts don’t fall under the Credit Contracts and Consumer Finance Act, which – even after the recent tweaks following howls about snooping on Netflix and Uber use – requires a service provider to take a deeper dive into a potential customer’s profile. Wilson thinks it should, but the political winds are blowing in the other direction.

There has been some movement on the “single door” issue, however.

GCSB Minister Andrew Little recently told the Herald, “The current system is fragmented, creating a ‘merry-go-round experience for business victims’ of cybercrime.”

Cert NZ (the Computer Emergency Response Team) is being folded into the GCSB’s National Cyber Security Centre (NCSC).

And, wearing his Public Service Minister hat, Little proposed in an August 15 Cabinet paper that Netsafe – currently an independent non-profit – shift to Internal Affairs funding “consistent with DIA’s role in digital safety and online harm”.

The Privacy Commissioner’s ID theft protection tips

Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.