Preventing Identity Theft

Advice for Reducing the Risk of Identity Theft or Data Breaches

Per the North Carolina Department of Justice website:

Avoid storing sensitive information when you can

• Limit the amount of personal information you collect from customers
• Never ask for social security numbers on first interaction from applicants. Only request such information after they have been hired
• Never include personal information on company websites or use it in passwords
• Assign unique account numbers rather than using driver’s licenses or SSNs
• Shred all documents that are no longer of use
• Destroy hard drives with sensitive information on them before discarding the computer or giving it to another party
• Avoid using personal information on bills or invoices when faxing, mailing or emailing clients
• Limit use of checks in situations where credit cards can suffice. These cards have protection limits in the event of identity theft.

Limit and monitor access to sensitive files

• Isolate sensitive information to as few locations as possible to make managing its access easier
• Password protect and use encryption software for files containing sensitive information
• Consider using unique passwords or login IDs for each employee to monitor individual access
• For physical files, keep them locked in a safe or filing cabinet with a secure padlock. Change the entry key or physical key periodically in case information is shared or copies are made
• Use monitoring programs to oversee network and computer activity
• Never send sensitive information via email, which can be easily hacked and stores on publicly-accessible servers
• Encourage all employees to limit access to social media profiles to only friends and family

Be wary of who has access

• Perform background checks on all prospective employees
• Change passwords and keys immediately after an employee with access leaves the company, even if they were likable
• Use network monitoring software in addition to firewalls, antivirus programs, and encryption. Update these programs frequently
• Research the measures your third-party system or software vendors take to protect data and limit its transfer across networks
• Use a separate router if you offer free public Wi-Fi. Do not have any business systems connecting to this router
• Follow through on any suspicious activity from unknown persons or employees
• Limit employee use of personal devices (BYOD) for the transfer of private business information unless your IT group can protect that information with the same level of security as your own systems

Realize that none of these measures is a guarantee that a data breach and subsequent identity theft will never occur, but rather a method to reduce their common sources.