Accidentally entered details on a fake EHIC website, now worried about identity theft

moonklash

Hello there,

I'm not sure if this is the best place to post this but I've looked and couldn't work out which forum would be most appropriate, so apologies if I'm in the wrong place.

This morning I realised I couldn't find my EHIC card and I'm going away in a week. Rushing, I jumped on to google, typed "EHIC" and ended up on https://ehic.com/. I didn't realise this isn't an official website and I entered all my personal details and paid for what I realise now should be a free card.

I'm now less worried about the fee and more concerned that my details could be used for identity theft.

Details entered include:

• Title
• Surname
• First name
• Date of Birth
• National Insurance Number
• Address
• Telephone
• Mobile
• Email

When I realised my mistake, identity theft didn't occur to me and I just thought of the £14.95 fee.

I found the real EHIC application form and applied, receiving email confirmation shortly later. I then looked on ehic.com for contact details and found there were none (which I believe isn't legal). I used the contact form to object and request my order be cancelled.

I called Barclays about a chargeback who said to call back in a few days because the payment was still pending.

A couple of hours later I received a second confirmation about my EHIC application - presumably this was "ehic.com" applying.

I called HMRC about my NI number but was advised it can't be used for identity theft so couldn't be changed.

Is that true? Is there anything else I should do? Should I be worried? Does the fact that ehic.com do appear to have applied for the card on my behalf (despite my emails) mean they're genuine(ish)?

I tried to find out who owns the domain name but the details are hidden.

Domain name: ehic.com

Administrative Contact:
AnonymousSpeech
AnonyousSpeech AnonymousSpeech ()
+81.09037462746
Fax: +81.09037462746
1-3-3 Sakura House
Tokyo, TOKYO 169-0072
JP

Technical Contact:
AnonymousSpeech
AnonyousSpeech AnonymousSpeech ()
+81.09037462746
Fax: +81.09037462746
1-3-3 Sakura House
Tokyo, TOKYO 169-0072
JP

Registrant Contact:
AnonymousSpeech
AnonyousSpeech AnonymousSpeech ()

Fax:
1-3-3 Sakura House
Tokyo, TOKYO 169-0072
JP

Status: Locked

Name Servers:
ns67.1and1.co.uk
ns68.1and1.co.uk

Creation date: 19 May 2000 23:02:00
Expiration date: 19 May 2015 23:02:00

wealdroam

You might like to read this MSE article.

Yes, they are 'genuine-ish'.
Just that they charge for providing a service that you can do yourself.

moonklash

wealdroam wrote: »

You might like to read this MSE article.

Thanks, that's appreciated! Sadly it looks like the refunds in that article only related to a specific one of these but an interesting read still!

wealdroam wrote: »

Yes, they are 'genuine-ish'.
Just that they charge for providing a service that you can do yourself.

Fingers crossed then it's just the one off fee I have to worry about. Seeing as these people get all our personal details though and they've already shown they're unethical I have to wonder if they won't use it for fraud....

InsideInsurance

moonklash wrote: »

I then looked on ehic.com for contact details and found there were none (which I believe isn't legal).

It would depend on a number of factors. If they are Japanese based as the whois on the domain suggests then they wouldnt be governed by UK legislation.

The site is deceptive though in the "our service" and the "terms and conditions" do say they are a separate third party company - but dont identify themselves - but a lot of people won't check these sorts of things.

Of cause you could report them to a number of different organisations - NHS potentially for the unauthorised use of their logos, ICO as I suspect they dont have the necessary data protection permissions etc but whether any of these would be that bothered to look into it I suspect not.

As to your own concerns, it could be their "scam" is simply charging a moderate fee for doing almost nothing, they dont necessarily do anything else.

Your card details also go directly to Barclays and arent entered onto their site and so your card details are probably safe and it may be worth just monitoring your credit report for any suspicious applications in your name

wealdroam

Why not ask for a refund anyway?
What have you got to lose?

Tell them that you are going to "make the OFT aware of their scam".

moonklash

InsideInsurance wrote: »

It would depend on a number of factors. If they are Japanese based as the whois on the domain suggests then they wouldnt be governed by UK legislation.

The site is deceptive though in the "our service" and the "terms and conditions" do say they are a separate third party company - but dont identify themselves - but a lot of people won't check these sorts of things.

Of cause you could report them to a number of different organisations - NHS potentially for the unauthorised use of their logos, ICO as I suspect they dont have the necessary data protection permissions etc but whether any of these would be that bothered to look into it I suspect not.

As to your own concerns, it could be their "scam" is simply charging a moderate fee for doing almost nothing, they dont necessarily do anything else.

Your card details also go directly to Barclays and arent entered onto their site and so your card details are probably safe and it may be worth just monitoring your credit report for any suspicious applications in your name

Thanks for that - you've really reassured me. Have to admit I was really worried but at least if the payment details they don't have access to that!

Indeed the entire site is very misleading in my mind, but as you say I don't know if it's dubious enough for me to be able to fight it. Stealing the branding, refusing to provide contact details, ignoring all my messages... certainly isn't right. I'm going to try and fight it and do a chargeback if Barclays will let me. If it goes through then I doubt they'd have the ability to fight it. Still a bit worried about my other personal details but I guess there isn't much I can do about that now....

moonklash

wealdroam wrote: »

Why not ask for a refund anyway?
What have you got to lose?

Tell them that you are going to "make the OFT aware of their scam".

I've tried that, however they offer no contact details and I've had no responses to the messages I've sent via the form. Gonna try for a chargeback. I called Barclays but they told me to call back in a few days, saying they couldn't do anything until the payment had processed.

moonklash

Hi all,

Thanks for your help! Just to say Barclaycard are giving me a refund and I sent the following to trading standards, hope it does some good (but I doubt it somehow).

Hi,

The website https://www.ehic.com purports to be a supplier of EHIC cards and charges a fee for a free item distributed by the government. Many have been stung by this scam but little has been done to prevent it.

I recently realised my EHIC card was missing and so I Googled this EHIC. ehic.com appeared from the branding and wording to be official so I gave my personal and payment details, before remembering EHIC details are meant to be free. I hunted through the website for contact information, however none was available. I found a form, told them to cancel the transaction (this was before they had done anything) but heard nothing.

I went to the real EHIC website, entered my details, received an email acknowledgement straight away. A few hours later I received a second acknowledgement which indicated ehic.com had ignored my instructions and entered my details.

I am now concerned that I have given my personal details to an unethical organisation intent on defrauding people. I called Barclaycard and HMRC but was advised there was little I could do. I obtained these details from Barclaycard:
Retailer number: 7882921
Business type: Management, Consulting, A
Town: North London
Country: Great Britain

The individual running EHIC.com appears to be based in North London which means they obliged to follow EU and UK law. Whilst it may be hard to prosecute them for their “service” (despite this clearly being fraudulent behaviour in my view), it’s also worth noting they are breaking the law by offering no company number, postal address and other contact details (I’m an internet marketer and so I’m aware of some of the legal issues in this area, and they have failed to comply). I also doubt they pay taxes so maybe you should look into that.

In my view, their entire activity is fraudulent, I am concerned about my personal details will be used, and they are calmly and easily breaking laws without anybody doing a thing to stop them. I hope this is of use and you can take action against these fraudsters. I’ll be out of the country from xxx until xxx however if you need to discuss this I can be contacted on xxx.

Regards,

Stuart Clark

wealdroam

Whilst I can understand your annoyance at having paid for a EHIC card that is available free elsewhere, is it really correct that they are "clearly being fraudulent"?

Ehic dot com do state on their Our Service Explained webpage...

We recognise the need for a complete service in offering our customers a variety of ways to apply for an EHIC (which is free) and at the same time offering a review and verification service which can check that all the required information is available - firstly that there are no omissions and secondly to check and identify any mistakes and manually correct them.

So they claim to be providing a service.

They go on to say...

Please note that the EHIC is available free of charge from the NHSBSA web site (www.ehic.org.uk) or you can order it from this site for a small charge and take advantage of our check and send service 24/7, 365 days of the year. YOU DECIDE. Free from NHS or just £14.95 from this web site.

They even provide a link to the NHS website.

I cannot see that there is much difference, other that the price, between this service and the Post Office's Check and Send service for Passport applications, and I don't hear many complaints about that 'fraud'.

As they say... you decide.

By the way, Whois shows the website registrant to be in Japan.

moonklash

wealdroam wrote: »

Whilst I can understand your annoyance at having paid for a EHIC card that is available free elsewhere, is it really correct that they are "clearly being fraudulent"?
By the way, Whois shows the website registrant to be in Japan.

Based on my understanding of fraud (to extract money through deception) then using my internet marketing knowledge, yes I believe it is, based on the positioning of the calls to action (apply now buttons), the unclear explanation that you can obtain the EHID card from the NHS, and the positioning of said text on the page.

There are 745 words on the home page including the rotating block of text on the home. When optimising a website it's necessary to ensure sufficient text is available for Google to consider the information worthwhile, however it's expected that the majority of people won't read this. Calls to Action ("CTA" - e.g. buy now, apply now, view related information) are a method of guiding people through a website to perform the next action before they leave the website.

Of the text on the home page, there are 500 words before the text referring to the NHS which is mentioned as NHSBSA - an abbreviation most consumers wouldn't recognise (most people only know of "The NHS" - myself included. I've NEVER heard of NHSBSA or NHS Business Services Authority.

So the NHS is referred to using a term most people won't recognise 67% of the way through the page, and at a point you have to scroll down to see (below the fold of the page). Before this the CTA (apply now) is displayed at least 5 times to make you navigate away before you read it.

Of the text referring to the NHS:
"The quickest way to receive your EHIC is to apply online. You can also obtain an EHIC by submitting your application by post to the NHSBSA or by calling the automated service."

- you would rather assume that the website is talking about itself and not a different site/organisation. By the time the second piece of text is shown:

"Alternatively, you can apply by calling 0845 606 2030 . If you are a non-EEA national you can only apply by post as you need to provide further documentation that supports your application. For information on applying, including how to obtain an application form, please visit NHS Choices at www.nhs.uk."

- We're now 80% through the page with numerous calls to action and your average user would have navigated away.

The user journey is the route you take through the site - the pages you load by following the calls to action. The journey for an average user in this case would ensure no text saying you can also obtain the EHIC card elsewhere is seen. Additionally, abbreviations that people don't understand are displayed, which means people assume they refer to the site. At no point in the user journey is there a message clearly saying: "We are not associated with the NHS, instead we are an external organisation who will apply for an EHIC card on your behalf for which an admin fee of £14.95 will be charged. You can also obtain this card for free on the NHS website."

The site is geared up to distract you from the truth of who they are. And that's another point, they don't say who they are - no company name, number, postal address or contact details - which isn't legal.

Maybe this wouldn't stand up in court, I don't know, but to me by the design of the website, this counts as fraud.

wealdroam wrote: »

By the way, Whois shows the website registrant to be in Japan.

No, I believe that refers to AnonymousSpeech who are used so the real perpetrator don't identify themselves. They're based in North London according to the merchant details I've received from Barclays.

Anyway, unless Trading Standards contact me back as far as I'm concerned the matter is concluded - Barclaycard have refunded the payment and I've reported the matter to the relevant authorities.