Fonehouse request PII via email

gbzrjy

I recently applied for the iPhone SE deal via Fonehouse. All went through ok until they asked me to send a photo of my driving license and a pdf of a recent bank statement via email which is very insecure. I asked if the had a more secure way of doing this but they didn’t so I cancelled the order. As an it security professional I just want to warn people not to send personally identifiable information via email as it can easily be intercepted by hackers. Better to encrypt the files but then you need to share the password with the recipient via another channel e.g. text message. In this case it was not possible to do that

sdduk

Don't blame you and understand the security issue but if you don't have a driving licence or passport like me how do you get deals like this or any other thing if they ask for them documents any idea?
I don't like cashback deals anyway and have sim-only deal 

PixelPound

The government has the service to share license info - why can't this be used. It would give them the info they need without having to send copies of docs. I've had prospective employers ask for this by email too in the past, so it's not just mobile companies!!

Harald

sdduk said:

Don't blame you and understand the security issue but if you don't have a driving licence or passport like me how do you get deals like this or any other thing if they ask for them documents any idea?
I don't like cashback deals anyway and have sim-only deal 

Mobile operators can do credit check without demanding such documents. I remember buying camera with 12 months finance also based on my debit card, name and address. No sensitive documents required. 
Also, there is GDPR requirements to use only necessary personal data. Looks like it's something for ICO 

Jon_01

nic_c said:

The government has the service to share license info - why can't this be used. It would give them the info they need without having to send copies of docs. I've had prospective employers ask for this by email too in the past, so it's not just mobile companies!!

Tends to happen when a fraud flag is tripped.  The point is to prove you are who you say you are. If you send in the required docs that's proof you have them.  If the Networks just used the share service it doesn't proof that the customer is who they say they are...