On personal identification numbers, privacy, and false pretenses: part 2.

Part 1 (I suggest reading this first): [https://lnkd.in/gXCkcKaw].

3️⃣ How should organisations use NRIC numbers, moving forward?

Given:
(a) the Government's public stance that NRIC numbers are public information;¹ and
(b) that for many of us, our NRIC numbers may well already be out there in the wild;²

I suggest that as an urgent priority, all organisations which presently use NRIC numbers to authenticate customers should switch to alternatives.³

And this is a risk-management issue not just for customers. It's also for the organisation itself.

Because:
- if an organisation chooses to drag its feet, and continues to use NRIC numbers alone as an authentication method for an extended period;
- even after this recent saga and the various advisories to shift way from the use of NRIC numbers as authenticators; and
- a customer ends up getting scammed because a bad actor was able to impersonate the customer using their NRIC number...

...let's just say that it is, at the very least, not a good look for the organisation.

--

Short post this time, to close off this topic, and ahead of the final installment of my annual income tax guide (December 2024 edition) - coming on Monday.

Also, some other exciting⁴ news to share next week - stay tuned.