I recently received an email outlining an order for an Internet service to a US mainland address from a US-based service provider. The order included an account number, order number and a street address and addressed me by my full name which can easily be determined from my email address. A little while later I received another email advising of a FedEx shipment to deliver some equipment to that address with a tracking link to a genuine FedEx consignment.
I am neither a US citizen nor resident, have never visited the US and do not hold any interests or rights in any US property, companies, etc., and barely know anyone personally who resides in the US - i.e. I have no reason to be placing such an order.
That night - and again two days later - I used the service provider's "chat" facility to talk with their customer support and advised them that I had not created that account or placed any order, and that the "Order Confirmation" email I received was the first time I became aware of the account or the order or even that company. I told them that someone was clearly using my email address and very likely my name to fraudulently place the order etc. In short their response was that the only way to deal with it is to mail (post) to their "Security Team" a fully completed "ID Theft Reporting packet". This "packet" demands the following:
- A fully completed and notarized ID Theft Form;
- Photocopy of a valid government-issue photo-identification card; (driver’s license, state issued ID-card or passport.)
- Proof of residency during the time of disputed bill or fraudulent account; must include name, date, and service address not a PO Box. (For example, a copy of a rental/lease agreement in your name, utility bill, or insurance bill.)
- A copy of the report filed with your local police or sheriff’s department, or a completed incident report from the Federal Trade Commission.
The "ID Theft Form" demands:
- Full Legal Name
- Date of Birth
- Social Security Number
- Current Address
- Daytime and Evening phone numbers
- Details and copies of police reports etc.
I would very much prefer to not assemble and post to a company that I have never heard of before a set of paperwork that would give someone all the information they would need to easily set about stealing my identity. Additionally they indicate that it may take some time for them to process the "packet" once received.
Are there any alternatives to having to supply all this information to them to get this account closed and recognised as being fraudulent? I attempted to have them cancel the order before the equipment got delivered but they declined, so that has now been shipped - and delivered without requiring a signature. I have lodged reports with the Australian authorities and with the FTC and I am currently working through the FTC's remediation steps. Nevertheless I feel that it would be prudent to get this fraudulent account dealt with as quickly as possible.
