Why is Virgin Media asking customers for their passwords?

hamba

Inactive User
Joined
May 24, 2005
Messages
8,704
Reaction score
1,345
Location
Down Here
Why is Virgin Media asking customers for their passwords?

Because either it is stupid, or thinks its customers are, or both. Actually, that's slightly (but only slightly) unfair.

The company says that it has indeed been calling customers and asking them to confirm their identities by giving up their passwords and home addresses in order to comply with the Data Protection Act. Which, of course, is the kind of thing a company says when it doesn't have a proper grasp of Data Protection Act compliance.

So what's going on? If you're a Virgin Media customer then you may recently have received a call from someone claiming to be a Virgin Media employee conducting a customer services review on behalf of the company. So far, so believable. Then, this unexpected caller will have asked you to confirm your identity by revealing your password. Or your home address. Or both. How do we know? They called me.

At this point, your identity-theft alarm bell may have sounded at the possibility that you were being phone-phished, socially engineered or otherwise being taken for a berk by someone from Nigeria with 419 similar calls already under their belt. Ringing up and asking for such details is a classic scam.

Except that this isn't a scam. It's real: Virgin Media has actually been doing this. But it must, to comply with the Data Protection Act, remember? What does the Data Protection Act say on compliance? Well, it says a quite lot - around 37,000 long, dull and tedious words - but it doesn't say that companies should call customers unexpectedly and ask for their passwords. That would be stupid.

How stupid? Ask the security-meisters at the Home Office: "Never give personal or account details to anyone who contacts you unexpectedly. Be suspicious, even if they claim to be from your bank or the police."

Admittedly, the Home Office advice doesn't say to be suspicious of callers who say that they're from Virgin Media, so perhaps it's okay to be reckless with your personal data in this instance? Well, actually, no.

When asked to explain the company's policy, Virgin Media said that many major organisations call customers and ask them to confirm their passwords as part of Data Protection Act compliance procedures. This review is, we're told, an ongoing process that could involve any customer at any time. The chap at Virgin Media cited his own bank, NatWest, as an example of another major organisation that does this.

We called NatWest: it doesn't do this. Indeed, NatWest's advice for customers answering unexpected callers is handy: "Be cautious if you're asked for personal information. Remember that they have instigated the call and should already know who you are. NatWest will never ask for your full security number or password." Virgin Media, take note. (Spokesman, check your bank account.)

Our advice is never to give out these details - because it could really be conmen (or women) on the phone trying to get your details.







Scott Colvey
The Guardian, Thursday February 21 2008
guardian.co.uk
© Guardian News and Media Limited 2008
 
Back
Top