One way to prevent becoming a victim of identity theft is to get involved when sharing personally identifiable information with businesses and organizations. Ask questions concerning what they are doing with your information. How many times have you given a credit card number over the telephone for convenience? What did they do with that number?
Today, I received an invoice as an attachment to an email. Too busy to print the invoice, write out a check and print an envelope; I phoned the organization and asked if I could pay by credit card over the phone. As I was reading the credit card number and expiration date, I only heard silence, I did not hear typing on a keyboard at the other end of the line, which concerned me. The conversation proceeded as follows:
Joe: "Did you write down my credit card number?"
Jane (Doe): "Yes."
Joe: "Will you be entering that information online to charge me?"
Joe: "Would you do me a favor?"
Jane: "What's that?"
Joe: "Would you shred that piece of paper as soon as you enter my credit card number."
Jane: "Shred it, OK."
I could have gone farther with my line of questioning. For example, I could have asked if they will be storing my information on their computer. If so, I could have requested that my credit card number not be stored on their computer for future reference.
Regardless if they store it or not, the killer question is, "Are you PCI-DSS Compliant?" (PCI-DSS = Payment Card Industry-Data Security Standard). The answer is usually, "what's that?" This answer is a clue that you do not want them storing your credit card information.
If the organization is not PCI-DSS compliant, they should not be taking your card number to process on paper, by phone or by email. It may even be risky processing your credit card number with them online depending if they are doing the credit card processing or if they are using a third party PCI-DSS compliant vendor.
After the organization processed my credit card, I received a receipt by email with the following message,
"Please note, once the credit card was processed, your information was deleted from our systems and documentation."
As consumers we need to ask questions and be aware of how our personally identifiable information is being handled and shared by businesses, government, schools and not-for-profit organizations. Don't be afraid to ask questions and prevent identity theft, it could save you hundreds of hours of hassle and inconveniences as a victim.