N-Power, Unilever and TalkTalk are among the many companies sponsoring a survey which has been delivered to a million households in the UK. They want you to fill in the questionnaire detailing your personal information and leave it on your doorstep, in an unsealed paper bag. But Watchdog has spoken to security experts who say it's gold dust to burglars and identity thieves.
And if you're wondering what the reward is for putting your most sensitive data at risk? Why, it's a box of chocolates...
The questionnaire is five pages long and contains one hundred and eighty six questions, plus space for additional personal details. It was put together by the postal giant TNT, with the help of several reputable big-name companies. So what's the big deal? According to Will Geddes, CEO of International Corporate Protection, is an expert who companies employ to check their security systems:
"This is a criminal's charter. I mean, if I was an identity thief, I could take over your life with this. The only thing that's missing here is a bank account number and a sort code. Once I have those two pieces of information, I have your life completely".
The problem is not what you are being asked to fill in, but what happens to the information once you've filled in the form. Strict data protection laws demand that it's handled securely so that criminals can't get hold of it. At least that's what should happen. But that doesn't seem to be the case with this survey. Respondents are being asked to put their completed questionnaire into a very eye-catching bag, plonk it on their doorstep and leave it to be collected by a courier. TNT promise to collect the Household Insight Survey from your doorstep by 9am the day after they drop it through your letterbox and then leave you a free bag of Thorntons for your trouble. But what happens if it's not a TNT driver who picks it up?
Watchdog met up with Mike Fraser, an ex-burglar and home security expert who used to work on BBC One's 'Beat the Burglar' series. He told us:
"It's a survey and it's actually asking every bit of information that anybody would want if they wanted to burgle a house".
When we asked Mike what the key bits of information as far as a thief is concerned are he said:
"You've got motoring, what cars do they drive, what vehicle. I mean, I know I could come here, look for the spare key when I'm in there, and take the vehicle as well. Eating out, how often, what restaurants, all they're doing is asking all the sort of questions the opportunist would want to know".
There is another type of criminal who would be delighted to get their hands on this information, namely, identity thieves. Security expert Will Geddes told us he's alarmed at some of the questions on the form. Whilst they don't ask you for passwords or mothers' maiden names, they are asking you to give up information such as: your name, address and postcode, your email address, landline and mobile phone number. As well as the dates of birth of your children, and details of your partner or spouse.
We asked Will Geddes how easy it would be for all the information to fall in to the wrong hands. He told us:
"With the current collection process, when you've filled it in you leave it unsecured on your doorstep so it's incredibly easy".
He added that an identity thief would be able to use the information "to pretend to be you... with this information I could even pretend to be your bank. I could pretty much take control of your entire life".
We wanted to find out if this fear was legitimate so we asked two members of our team to complete the surveys. We then gave two other members of the team twenty-four hours to see what they could do with the information on the form. They discovered that they could set up a store account, change the password on a mobile phone account, order a new mobile to be sent to the address of their choice and get copies of a utility bill sent to an entirely different address. Will Geddes commented:
"This is terrifying, what you've just proven here is that someone with no criminal record or previous experience of identity fraud has managed to achieve all of these things. And these are the real foundation stones to any identity fraud".
And according to Will, one of the biggest foundation stones is the utility bill:
"This is almost the most worrying. Utility bills are so often used as a proof of residence and identity, you create and collect enough of these, you can start applying for all sorts of things that can prove or seem to prove that you are who you say you are".
And we were able to do this in just twenty-four hours, and we're not professional identity thieves.
So we have a survey that asks you to leave information lying on your doorstep. And this is information that old-fashioned burglars could use to empty your home, and more up-to-date criminals could use to steal your whole identity. That bag of chocolates they promise you could turn out to be very expensive...
The companies featured in the report told Watchdog:
TNT Post/Doordrop Media:
Mark Davies, managing director, Doordrop Media: "The Household Insight Survey is a long standing consumer market research questionnaire delivered, collected and analysed by Doordrop Media, part of TNT Post.
"Doordrop Media is committed to ensuring the highest standards of data security and the
Household Insight Survey is fully compliant with the Data Protection Act. The collection process has been refined working with the Information Commissioner's Office and it is regularly reviewed by leading independent security consultants to ensure that we are following best practice.
"As a result, the survey has now been running for 12 years and more than two million people have responded. In that time we have not had one recorded incident of data theft."
Doordrop Media clarification on comments:
1. Does TNT Post consider its method of survey collection to be safe? Does TNT Post accept that its collection methods could have serious implications for respondents with regards to identity theft, fraud and burglary as the surveys are left on the doorstep?
The survey adheres to Data Protection Act guidelines and incorporates recommendations and feedback from both the Information Commissioner's Office and independent security advisors.
2. Does TNT Post run any checks on its survey distributors prior to contracting them to collect the completed surveys?
All Doordrop Media staff are recruited through traditional advertising. Applications are
received and reviewed with interviews conducted by Area Managers. All appointed staff undergo training before undertaking survey distribution and collection work of any kind.
3. What checks does TNT Post carry out to ensure that the surveys are only collected by its survey distributors?
The Household Insight Survey provides clear guidance to consumers on the response process including a specified collection date and time and the option for postal response. Doordrop Media staff collect from their allocated street at the allotted times and replace collected surveys with chocolates. This process is overseen by the local Area Managers who report directly back to head office.
4. How does TNT Post ensure that every single completed survey is collected by TNT Postemployed drivers and passed to the company which processes the data?
The Household Insight Survey provides clear guidance to consumers on the response process including a specified collection date and time and the option for postal response. Doordrop Media staff collect from their allocated street at the allotted times and replace collected surveys with chocolates. This process is overseen by the local Area Managers who report directly back to head office.
5. How are the completed surveys passed to the company which processes the data?
Surveys are collected by Doordrop Media staff and then collated by the Area Manager and sent back to our head office by secure mail. The surveys are quality checked at the head officers before being sent via secure mail for data analysis.
6. How long has TNT Post been managing door drop surveys of this nature?
Doordrop Media has been successfully running this survey for 12 years.
7. We note from promotional material that the paper survey is set to increase in size to around one million surveys. When is this planned increase due to take place?
Doordrop Media has now delivered over one million surveys in 2010. This is consistent with annual volumes in the last 12 years.
8. We understand that the collection methods employed by TNT Post has attracted scrutiny from the media before and that in response to a 2007 investigation by the Observer, the Information Commissioners Office stated that 'it is clearly not best practice for organisations to ask people to leave forms containing personal information on the doorstep.' What is TNT Post's response to this comment?
Doordrop Media worked in 2007 with the Information Commissioner's Office to respond to concerns. We continue to work with security experts to ensure our processes and procedures meet best practice standards.
Thorntons:
"TNT is a customer of Thorntons, whereby Thorntons supply chocolates to TNT in response to an order. TNT uses the chocolates as they wish but Thorntons has no involvement with this. Nor do Thorntons have any involvement with TNT's surveys."
TalkTalk:
"TalkTalk are able to confirm that we will not support any future surveys that require information to be left on the doorstep."
Information Commissioner's Office:
"These surveys usually require people to provide a large amount of personal information - ranging from whether they have any outstanding medical conditions, to details of their household income. Anyone approached to fill in one of these surveys should think twice before leaving information like this on their doorstep. They should be aware that anyone could potentially pick it up, opening the way to identity theft. People completing these forms should also understand who will have access to their information and what it will be used for."
A survey that may lead to foul play...
And if you're wondering what the reward is for putting your most sensitive data at risk? Why, it's a box of chocolates...
The questionnaire is five pages long and contains one hundred and eighty six questions, plus space for additional personal details. It was put together by the postal giant TNT, with the help of several reputable big-name companies. So what's the big deal? According to Will Geddes, CEO of International Corporate Protection, is an expert who companies employ to check their security systems:
"This is a criminal's charter. I mean, if I was an identity thief, I could take over your life with this. The only thing that's missing here is a bank account number and a sort code. Once I have those two pieces of information, I have your life completely".
The problem is not what you are being asked to fill in, but what happens to the information once you've filled in the form. Strict data protection laws demand that it's handled securely so that criminals can't get hold of it. At least that's what should happen. But that doesn't seem to be the case with this survey. Respondents are being asked to put their completed questionnaire into a very eye-catching bag, plonk it on their doorstep and leave it to be collected by a courier. TNT promise to collect the Household Insight Survey from your doorstep by 9am the day after they drop it through your letterbox and then leave you a free bag of Thorntons for your trouble. But what happens if it's not a TNT driver who picks it up?
Watchdog met up with Mike Fraser, an ex-burglar and home security expert who used to work on BBC One's 'Beat the Burglar' series. He told us:
"It's a survey and it's actually asking every bit of information that anybody would want if they wanted to burgle a house".
When we asked Mike what the key bits of information as far as a thief is concerned are he said:
"You've got motoring, what cars do they drive, what vehicle. I mean, I know I could come here, look for the spare key when I'm in there, and take the vehicle as well. Eating out, how often, what restaurants, all they're doing is asking all the sort of questions the opportunist would want to know".
There is another type of criminal who would be delighted to get their hands on this information, namely, identity thieves. Security expert Will Geddes told us he's alarmed at some of the questions on the form. Whilst they don't ask you for passwords or mothers' maiden names, they are asking you to give up information such as: your name, address and postcode, your email address, landline and mobile phone number. As well as the dates of birth of your children, and details of your partner or spouse.
We asked Will Geddes how easy it would be for all the information to fall in to the wrong hands. He told us:
"With the current collection process, when you've filled it in you leave it unsecured on your doorstep so it's incredibly easy".
He added that an identity thief would be able to use the information "to pretend to be you... with this information I could even pretend to be your bank. I could pretty much take control of your entire life".
We wanted to find out if this fear was legitimate so we asked two members of our team to complete the surveys. We then gave two other members of the team twenty-four hours to see what they could do with the information on the form. They discovered that they could set up a store account, change the password on a mobile phone account, order a new mobile to be sent to the address of their choice and get copies of a utility bill sent to an entirely different address. Will Geddes commented:
"This is terrifying, what you've just proven here is that someone with no criminal record or previous experience of identity fraud has managed to achieve all of these things. And these are the real foundation stones to any identity fraud".
And according to Will, one of the biggest foundation stones is the utility bill:
"This is almost the most worrying. Utility bills are so often used as a proof of residence and identity, you create and collect enough of these, you can start applying for all sorts of things that can prove or seem to prove that you are who you say you are".
And we were able to do this in just twenty-four hours, and we're not professional identity thieves.
So we have a survey that asks you to leave information lying on your doorstep. And this is information that old-fashioned burglars could use to empty your home, and more up-to-date criminals could use to steal your whole identity. That bag of chocolates they promise you could turn out to be very expensive...
The companies featured in the report told Watchdog:
TNT Post/Doordrop Media:
Mark Davies, managing director, Doordrop Media: "The Household Insight Survey is a long standing consumer market research questionnaire delivered, collected and analysed by Doordrop Media, part of TNT Post.
"Doordrop Media is committed to ensuring the highest standards of data security and the
Household Insight Survey is fully compliant with the Data Protection Act. The collection process has been refined working with the Information Commissioner's Office and it is regularly reviewed by leading independent security consultants to ensure that we are following best practice.
"As a result, the survey has now been running for 12 years and more than two million people have responded. In that time we have not had one recorded incident of data theft."
Doordrop Media clarification on comments:
1. Does TNT Post consider its method of survey collection to be safe? Does TNT Post accept that its collection methods could have serious implications for respondents with regards to identity theft, fraud and burglary as the surveys are left on the doorstep?
The survey adheres to Data Protection Act guidelines and incorporates recommendations and feedback from both the Information Commissioner's Office and independent security advisors.
2. Does TNT Post run any checks on its survey distributors prior to contracting them to collect the completed surveys?
All Doordrop Media staff are recruited through traditional advertising. Applications are
received and reviewed with interviews conducted by Area Managers. All appointed staff undergo training before undertaking survey distribution and collection work of any kind.
3. What checks does TNT Post carry out to ensure that the surveys are only collected by its survey distributors?
The Household Insight Survey provides clear guidance to consumers on the response process including a specified collection date and time and the option for postal response. Doordrop Media staff collect from their allocated street at the allotted times and replace collected surveys with chocolates. This process is overseen by the local Area Managers who report directly back to head office.
4. How does TNT Post ensure that every single completed survey is collected by TNT Postemployed drivers and passed to the company which processes the data?
The Household Insight Survey provides clear guidance to consumers on the response process including a specified collection date and time and the option for postal response. Doordrop Media staff collect from their allocated street at the allotted times and replace collected surveys with chocolates. This process is overseen by the local Area Managers who report directly back to head office.
5. How are the completed surveys passed to the company which processes the data?
Surveys are collected by Doordrop Media staff and then collated by the Area Manager and sent back to our head office by secure mail. The surveys are quality checked at the head officers before being sent via secure mail for data analysis.
6. How long has TNT Post been managing door drop surveys of this nature?
Doordrop Media has been successfully running this survey for 12 years.
7. We note from promotional material that the paper survey is set to increase in size to around one million surveys. When is this planned increase due to take place?
Doordrop Media has now delivered over one million surveys in 2010. This is consistent with annual volumes in the last 12 years.
8. We understand that the collection methods employed by TNT Post has attracted scrutiny from the media before and that in response to a 2007 investigation by the Observer, the Information Commissioners Office stated that 'it is clearly not best practice for organisations to ask people to leave forms containing personal information on the doorstep.' What is TNT Post's response to this comment?
Doordrop Media worked in 2007 with the Information Commissioner's Office to respond to concerns. We continue to work with security experts to ensure our processes and procedures meet best practice standards.
Thorntons:
"TNT is a customer of Thorntons, whereby Thorntons supply chocolates to TNT in response to an order. TNT uses the chocolates as they wish but Thorntons has no involvement with this. Nor do Thorntons have any involvement with TNT's surveys."
TalkTalk:
"TalkTalk are able to confirm that we will not support any future surveys that require information to be left on the doorstep."
Information Commissioner's Office:
"These surveys usually require people to provide a large amount of personal information - ranging from whether they have any outstanding medical conditions, to details of their household income. Anyone approached to fill in one of these surveys should think twice before leaving information like this on their doorstep. They should be aware that anyone could potentially pick it up, opening the way to identity theft. People completing these forms should also understand who will have access to their information and what it will be used for."
A survey that may lead to foul play...