Cape Town - Internet users should assume that all information posted on online platforms can be compromised as a way to increase awareness of identity theft, an industry expert has asserted.
"Advances in technology and communication has produced some of the most dangerous and educated criminals in history, especially when it comes to personal identity theft. Identity theft criminals are invisible," Dawid Jacobs, head of the Independent Identity Verification Department at Forensics4Africa told News24.
The company, a division of Strategic Investigations and Seminars, specialises in forensic science, investigation and risk management.
Jacobs said that technological progress has been used to great effect by criminals.
"Since the beginning of the internet era, Identity Theft has grown with leaps and bounds and this trend will continue and increase as technology usage and advances accelerate."
Some criminals use so-called "low-tech" methods of stealing user data.
A common scam involves running job ads on classified sites like Gumtree with broad requirements that may attract many applications. Criminals then have a set of user-specific information which can be used to their advantage.
Another low-tech identity scam involves a phone call that the user has won a prize and needs to submit details for delivery. Scammers try to extract as much information as possible, including details like ID number and address.
"Obviously you have to protect your own ID, such as keeping your ID, drivers licence; passport secure at all times. Another important practical step is not to give out your personal information unless absolutely necessary and not without first ascertaining that the organisation that has requested the information has safe and secure systems to store that information," said Jacobs.
Forensics4Africa has patented an Independent Identity Verification process where IDs are stored on a server without direct internet access.
"The verification process of this pool of protected IDs will be done by the physical taking of an individual's fingerprint and the matching of those on our secure system. If it is no match, a fraudulent transaction can be stopped; this is pro-active toward preventing fraud by ID Theft," said Jacobs.
While some may argue that more layers of security are the only to limit cybercrime through identity theft or malware delivery, the nature of the internet mean that there will have to be compromises between security and functionality.
"No-one wants to bring anything to market that is insecure, but what it is always is - and it will always be - is functionality versus security," Michael Aminzade, director delivery EMEA, for Trustwave told News24.
The onus of proving negligence remains on the user to show that a company has not taken adequate measures to protect an identity, but it is hoped that the Protection of Personal Information bill will add a layer of protection for individuals.
"The Protection of Personal Information Bill will bring South Africa in line with international data protection laws and at the same time will protect personal information collected, processed and managed by public and private organisations," said Jacobs.
He warned though, that if companies did not secure user IDs, they would open themselves up to litigation.
"Should an organisation not institute ID verification as a basic minimum procedure it would open itself to possible legal action by the user."
- Follow Duncan on Twitter