Here’s another case of identity theft. The victim was a finfluencer and he narrated his ordeal lucidly in a Twitter thread. You can go through the Twitter thread for a detailed account — https://x.com/b50/status/1796784315990491526
Here is the TLDR version:
- He started getting calls from recovery agents.
- Checked CIBIL report which showed a digital loan. Had received an alert from CIBIL at the time of loan enquiry but ignored the alert.
- Tried to refute that he didn’t take the loan. Did not help.
- Filed an online complaint with the police. Not sure how much it helped.
- Created noise on social media. Issued resolved within 4-5 hours.
Note: CIBIL alerts can be confusing unless you have subscribed for a paid service. More on this later.
In this case, the victim was an influencer and had social media reach. Raised alarm on Twitter (X). Since the twitter thread got a lot of engagement (thousands of likes and retweets), the lender quickly realized the reputational risk and offered relief to the victim. No further follow-up calls. Issued NOC and updated the credit bureaus.
You may not have such influence. The lenders will not offer such quick relief to you. Even with this victim, he had to take a barrage of calls from the collection agents and had to file a police complaint. Hence, it was not easy for him either. At least, he got quick relief. He first tweeted at 11:30 am (after being harassed for a few days) and got resolution by 4 pm.
Will you also get quick relief? Unlikely.
What can you do to avoid being a victim of identity theft? The fraudsters are growing smarter by the day and have all the tech tools at their disposal. Hence, it is almost impossible to completely eliminate the risk. However, you can use certain hygiene practices to reduce the odds of such fraud.
Keep an eye on your credit report
Lenders download the applicant’s credit report from a credit bureau before approving a loan and are required to report any loan sanctioned to all the credit bureaus. Hence, if an enquiry is made against your name (PAN), it will show up in your credit report. Or if a loan has been disbursed, it will show up too in your credit report. Therefore, it makes sense to check your credit score/report on a regular basis. If any loan has been sanctioned in your name without your knowledge, it will show up in the credit report. You can subsequently take remedial action, if required.
To make things easier for you, every credit bureau is required to offer one full free credit report per calendar year to any borrower.
And there are 4 credit bureaus. CIBIL, Experian, Equifax, and CRIF High Mark.
Hence, in a way, you can download 4 free credit reports in a calendar year.
In the case under consideration, the victim got an alert from CIBIL but chose to ignore it.
But I will not blame him for this oversight.
I keep getting messages from CIBIL too that my credit report has changed. This could be due to any reason. Loan enquiry. Loan sanction, loan utilization. Even a minor change in credit score can be construed as a change in credit report. Later, whenever I checked, I found nothing alarming in my report. Therefore, how do you know whether it is serious or not? Perhaps, the victim also ignored the alert because of this reason.
On CIBIL’s part, this sense of urgency is a nudge to subscribe to their paid services. Wont’ fault CIBIL because this is a widespread practice in any business, but sometimes important messages can get ignored if you get false alarms frequently.
Note: I do not have a paid subscription for CIBIL’s services. It is possible that CIBIL’s paid subscription would provide more descriptive alerts.
Regular checking of credit reports does not prevent frauds (especially with fast disbursal digital loans) because you will find the details in the credit report after the loan has been disbursed. However, the knowledge of a fake loan against your name helps you act swiftly. You can reach out to the lender with your complaint before the collection agents start banging on your door.
If there is a fake loan against your name, you must gear up for a fight. This is because even after you raise the issue with the lender, the lender won’t simply forget about its money and let you go. Additionally, you don’t expect the lender to acknowledge that there are flaws in the loan sanction and disbursal process.
You can file a police complaint and you must. This puts pressure on the lender and can play a role in resolution.
What can you do to reduce the chances of fraud?
Be paranoid about your KYC documents and cybersecurity
- PAN and Aadhaar are the two most important documents. All your financial information is linked with these documents. Do not share copies of these documents with anyone unless absolutely required. I have seen people sharing their Aadhaar card for cases (say hotel check-in), where any address proof will work. They could have shared a copy of driving license/voter id card/passport for such check-in.
- Even if you must share Aadhaar since you do not have any other proof (or because you must share Aadhaar), share only the masked version of Aadhaar. A masked Aadhar shows only the last four digits of your Aadhaar number, and it is a legally acceptable document.
- When you share documents with anyone, mention the date and purpose of the document. Don’t have to mention the purpose at the bottom of the page. Can write across the main portion/text of the document. While this may not be much help against an experienced fraudster and a compromised system, it is good practice.
- You can complete e-KYC using only the 2 documents (PAN and Aadhaar) And 1 Aadhaar based OTP. The fraudster needs to enter your Aadhaar number and sign using OTP received on the mobile number linked to Aadhaar. If you are doling out copies of PAN and Aadhaar card to anyone, you can be rest assured the copy will eventually find its way into the hands of a fraudster.
- I understand you still have the security of an OTP. If the fraudster knows your phone number, he/she can try to trick you into sharing the OTP. I know I am making it sound a bit scarier than it really is. For instance, apart from OTP, you may also be asked to join a video call or take a photo (selfie) during e-KYC. This works as an additional security measure.
- However, when the onboarding process has flaws or is compromised, you may face a serious problem. For instance, what if the loan is disbursed based on upload of documents on the website and no one checks those documents properly before sanctioning and disbursing the loan? Or what if there is a compromised insider in the loan sanction process?
- Don’t share OTPs with anyone.
- Follow safe cyber-security practices. Install proper anti-virus software on your mobile and desktop/laptop.
In this case, either the fraudster had access to identity documents of the victim, or the KYC process of the lender/agent was severely compromised. Likely, it was both. Don’t think we will find out because both the parties have reached an amicable settlement.
Being a bit paranoid does not harm. From my limited experience, the banks ask for all kinds of identity documents for the simplest of tasks. You are forced to. Most of us relent to save on time. For instance, I was asked to submit PAN and Aadhaar to update nomination in my PPF account. I know those documents will be scanned and uploaded in the system but what happens to the submitted copies? When you ask for so many paper documents, there is a good chance that some of these documents will be lost and later misused with zero accountability of the bank.