Security24.05.2013

Personal info exposed through SA bill website

By Jan Vermeulen

Mobile payments provider POCiT has drawn the ire of South African consumers today (24 May 2013) as it has been discovered that its Bills.co.za website exposes personal debt details.

In e-mails forwarded to MyBroadband, consumers expressed their displeasure at some of their bill totals being available for anyone to see by simply entering a cellphone number or e-mail address, and corresponding date of birth.

According to the reports from users, they did not sign up for POCiT’s services, and MyBroadband was able to confirm that bill totals of people not registered with POCiT were available through the site.

Asked about the privacy concerns raised over the site, new business development director at SureSwipe (a new brand that POCiT is being rolled into), David Reynders said that they reacted immediately to reports from concerned users.

bills.co.za original landing page

“We take this kind of stuff very seriously,” Reynders said. “So the minute people contacted us we took the site down.”

The site has been live for around 3 years without complaint, Reynders said, but added that they are constantly responding to feedback from users.

When they received a single complaint from a concerned user, Reynder said they “jumped on this” and decided to remove the manual search facility. Other parts of the site are still available, and attempts to access the search function following its removal from the site’s landing page were unsuccessful.

“We’re busy working on how we can do this better,” Reynder said. “While we work on this the search facility is down.”

Reynders said that the system offered manual search of Edgars, Jet, and Mr Price bills, with the purpose of giving people the minimum information needed to make a payment. “We are also in limited pilot with healthcare bills,” Reynders said.

Bills.co.za landing page taken down after complaints

The system didn’t display a full invoice or itemised break-down, but only bill totals, Reynders explained.

Reynders emphasised that the site is secure and that payments made through it are done in a fully secure environment. The SSL details displayed by the browser when visiting the site appear to confirm this.

He added that the manual search is a lightly used part of the site that does not generate much traffic, but that does not mean the privacy concerns are unimportant to them.

“Most people pay their bills based on custom links we send them, and those are not searchable.”