MACinations

As some of you may know, I’m in a bit of a kerfuffle with Telstra at the moment regarding the bills I have received for the last 5 months and their lack of correctness.

I spent over an hour on the phone with a very helpful lady in the CEO’s Complaints Team yesterday – that is after spending over 9 hours analyzing 5 months worth of bills and comparing it to WHAT I SIGNED UP FOR (something I should NOT have had to do), and I’m still none the wiser. More on that in the next rant.

So I get a call at 18:07 tonight – funny how they’re never there when YOU call them, but always when THEY have to call you – from a BLOCKED number, and a recorded voice saying;

“This is a call for from Telstra for . This is not a telemarketing call. Please press 1 to accept the call”

Normally I would have no idea who it was, but I’ve had them before, so I pressed 1. Next it said;

“We have your year of birth as 19xx. For identification purposes, please enter your day and month of birth…”

RIGHT !! Why do I have a problem with this ?

• There is NO INDICATION who the call is from. Yes, it may be genuine, but nothing on this screen indicates who is calling me. 

• Telstra (and many other companies, such as Foxtel) ask for an address and date of birth to “identify the caller”, but expect you to provide that information without them identifying themselves. 

• The information they ask for (generally name, date of birth and address or phone number) IS ALL PUBLIC KNOWLEDGE !! I have proven this, more later. 

• They will not identify themselves before asking for your information (AMEX are great at this, believe me) !! 

• And the most annoying thing about getting these calls is THEY DO NOT READ THE ACCOUNT NOTES !! If they had, they would have seen that my account is in dispute, it is being handled by the CEO’s office, and they should have referred the matter to that office.

As the very helpful Elizabeth from the CEO’s Complaints Team said yesterday;

“We ask you to state your name and mobile number. By doing that you are stating that you are that person. If you are not, you are making a false statement and that is illegal”

So – you are relying on me, the customer, to say who I am and are taking that as gospel for identification purposes. If I am trying to obtain information about someone else’s account, also ILLEGAL, do you think a trivial matter such as lying in said statement is going to worry me ?

You have not identified me as the account holder at all – all you have done is identify that SOMEONE is calling, knows a name and phone number that match your records, and is asking for information.

Section 4.1 of The National Privacy Principles, extracted from the Privacy Act 1988 as at 14 September 2006, states;

4.1 An organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

How the hell is asking for PUBLICLY AVAILABLE AND KNOWN INFORMATION “taking reasonable steps” ?

That is why, years ago, I demanded a PASSWORD on both my Telstra and Foxtel accounts – THIS IS SECURE (relatively speaking). Only the account holder or another AUTHORISED person would know this password, even if all manner of personal information was know.

And THAT is the only identification I will provide.

Telstra, Foxtel and any company that uses this identification methodology is being GROSSLY NEGLIGENT with my information, and yours.

To prove how pathetically easy their “identification check” is to circumvent, my wife and I performed a little test – I’m only sorry I didn’t record the call.

With the full knowledge and permission of oneone of our neighbors (who is also a good friend), I had my wife call Telstra and pretend to be this person. The story we gave is that one of her credit cards has been stolen and she wasn’t sure which one Telstra had on file, and could they please read it to her.

Name and date-of-birth questions were duly answered, and then the Telstra person started reading out the credit card number.

After the first 4 numbers, I took the phone, stopped her from giving out anything more, and the conversation went like this;

ME: “You were in the process of giving out a credit card number, CONFIDENTIAL INFORMATION, to someone who was NOT the account holder”

CSO: “What do you mean, X identified herself”

ME: “No, that was my wife giving X’s name. X is our neighbor, and has given her permission for her name to be used in testing this “identification” system of yours. You asked for PUBLICLY AVAILABLE information, do you not see how insecure that is ?”

CSO: “We have to have that under the PRIVACY ACT”

So it was all too hard for the poor woman. Not her fault, and I’m not complaining (this time) about the service I received, just that they have NO CLUE. You would think that, being Telstra, they would have looked at the phone number that was calling them (caller ID people !!), seen that the number was registered to an address next door to the one we were enquiring about, and refused to give the information – maybe offering to call back on the account holder’s registered number.

It’s all too hard for them, at a CORPORATE level.

I would STRONGLY suggest that for any account you hold with Telstra, Foxtel or indeed any company that allows you to make telephone enquiries, you DEMAND a password or PIN be placed on the account and give THAT AND THAT ONLY as identifying information.

I mean, Virgin Mobile and Vodafone do it – you’d think other companies could too ?