< Back to the advice centre

Protecting Yourself from Identity Theft

What is Identity Theft

Strictly speaking the term ‘identity theft’ is a misnomer, what actually happens is that someone finds out enough information to pose as you in order to do things like taking out a loan, or emptying your bank account.

How does it happen

There are two techniques which are widely used to steal your identity. Remember that stealing your identity means obtaining enough information to pose as you.

Phishing

The term ‘phishing’ is derived from fishing for people who will tell the criminal their details. There are several different approaches.
The social engineering technique is when a phisher sends you an email from an email account which looks like it belongs to a trusted organization. For example, if your bank is called ‘yourbank’ then the phisher might send an email from admin@yourbank.example.com. This makes it look like the email is coming from your bank but it is actually coming from www.example.com. Once opened the email will typically say they need certain information from you in order to update your account, or something similar. Most likely they will ask you for a username and password, you should never give these out. No organization would ask you for your username and password by email.
The fake website technique is much harder to spot. With this technique the criminal will create a website which looks exactly the same as a website which you trust, such as your banks website. They will then get you to go to that page, perhaps by sending an email with a link in it, perhaps by linking to the site from another webpage. The end result is that you end up on the fake website thinking that you are being sent  to your banks website. As the website looks exactly the same as the real thing you may not realize that it is not real, when you then log in the fake website will record your details and store them for the attacker to use later.

How do I protect myself from Phishing?

• Never send confidential information such as passwords, dates of birth, mother’s maiden name etc. by email. No organization will ever ask for this information by email.
• When you enter your username and password into a website check that the URL in the address bar of your browser is the address it should be.
• Read our guide to using secure websites.
• Turn on your browsers anti-phishing measures.

Trojans

A Trojan is a program which you download thinking that it is some useful piece of software, for example you might download a program which is advertised as a free tool for renaming all the files in a directory at once. However, when you run the program it will install a piece of software which sits on your computer and watches what you are doing. Trojans have a wide variety of different purposes, some are written so that the Trojan can use some of your computing power and internet connection to be part of a network of hijacked computers called a botnet, other Trojans will quietly sit and record every keystroke you make, sending them all off to a remote computer where an attacker will search through everything you have typed looking for credit card details.

What do I do?

Happily, Trojans are fairly easy to beat. Most antivirus software will be able to recognize Trojans. There are many freely available antivirus packages such as AVG and avast!
If you are still worried about Trojans you can get programs such as KeyScrambler which scrambles keycodes going to and from your browser so Trojans will be unable to steal information this way.

< Back to the advice centre