Data breach worries.

ripplyuk

A company I made a purchase from emailed me today to tell me that they had a data breach and my details (including all credit card details) had been stolen. I immediately cancelled the credit card. They also offered a complimentary subscription to Experian’s Identity Plus service so I signed up for that and they mentioned something called a ‘Cifas’ registration which apparently can help prevent unauthorised credit. Is it sensible to sign up for that? Is there anything else I should do? I only used my credit card on that website but since they’ve now got my name, address, D.O.B. etc, I’m worried these fraudsters could access other accounts. Should I cancel my current account too? That’s the one I pay the credit card from so perhaps they could be linked. 

Brie

Why would they have your DoB?  Maybe it's just me but I don't think I've ever had to provide that when purchasing anything online.

I would certainly alert your bank that there was a breach so they can put a flag on your account in case of suspicious activity.  

CliveOfIndia

ripplyuk said:

 they mentioned something called a ‘Cifas’ registration which apparently can help prevent unauthorised credit. Is it sensible to sign up for that?

CIFAS is basically a national register that records fraudulent credit activity.  It has two basic functions.  On the one hand, if you were convicted of fraudulently obtaining credit then you'd have a CIFAS record, meaning it would be nigh-on impossible to obtain any further credit.

But the other thing it does is to register a "Protective Registration" against you - designed specifically for the situation you describe.  What that means is that any time anyone applies for credit in your name, the lender will carry out far more stringent checks than they normally would.  Makes it a bit more long-winded if it's genuinely you applying for credit, but obviously makes it much harder for a fraudster to impersonate you.  It's probably a good idea to get protective registration.

Here's the official website if you want to read up on it some more: https://www.cifas.org.uk/individuals

ripplyuk

Update: I contacted the Experian helpline that was listed in the email. I was asking them about Cifas registration and the agent said it was a good idea and gave me a number to ring. I checked that number on ‘Who called me?’ and it says it’s a scam! 

I then panicked and rang the company I made the purchase from (Biocare) and asked them if this data breach was real. They confirmed it was, apologised etc and told me that they have made an arrangement with Experian which means they can sign me up for Cifas registration for free. It’s normally £25. I told them that the Experian helpline number they listed put me through to an agent who asked me to call a known scam number. The Biocare rep was as confused as I am but said they’d get someone from Experian to call me back. 

Now I haven’t a clue what’s going on. Having an Experian employee trying to get me to call a scam number is very concerning and I have already signed up to view my credit reports so they now have all my data. What should I do? 

CliveOfIndia

You could try contacting CIFAS directly via their website?  https://www.cifas.org.uk/contact-us

ripplyuk

CliveOfIndia said:

You could try contacting CIFAS directly via their website?  https://www.cifas.org.uk/contact-us

They don’t seem to have a contact phone number. I know I can sign up for their service online but I was hoping to save the £25 by going through Experian (if it’s a legitimate offer). Also, since I cancelled my credit card I can’t actually buy anything online right now. 

I’ve just had a call from Experian who offered to send me the Cifas form to get free registration but they needed my date of birth and postcode and I’m so freaked out by all this, I didn’t want to share any details.