Personal debt info exposed through SA bill website

Well, Kudo's to them, a mistake was found, the immediately took it down, and commited to fix it. Well done [But erm... have a talk to your QA assurance and testing guy...]
 
“Most people pay their bills based on custom links we send them, and those are not searchable.”
Click to expand...

:eek: I fear for their users now. They are going to get phishing emails like crazy
 
What makes me wonder is how they even managed to get a Level 1 PCI compliance certificate. On another note, what gives them the right to pull my information onto their website without my consent. I would be highly pissed to see any of my bills being displayed on a 3rd party website. Shame on Edgars, Jet, Mr Price and others for allowing this without notifying users.

A prime example that there is absolutely zero regard for consumer privacy and data protection across some businesses in this country. Anyone is able to know your ID number and phone number - so I fail to see the "well done for disabling this feature" - TBH it should not be there in the first place without appropriate security (i.e. at least one-time-pin SMS).
 
This is just one (very small) example of what retail institutions, banking and insurance institutions thinks about consumers' personal identifiable information. South African businesses are dealing in personal information on a daily basis. Retail, banking and insurance companies make billions of Rands as additional income by selling consumer information among one another. I know for a fact that one bank will sell a list of 5000 confirmed consumers to another company at R1000 per consumer.

I also know for a fact that millions of Rands are being moved between companies each day in trading in consumer information.

What would the need for Edgars, Jet or any other company be to give their databases to a third party for consumers to see account info. Consumers should be able to do this at the companies where they have debt.

I am sure that millions of Rands have changed hands again in buying data here as well.

This should have been a service where consumers had the opportunity to sign up themselves and not a place where retail companies dumped all their information.
 
Last edited:
flashsa said:
Require a full ID number at the very least....
Click to expand...

Not in a long shot! ID Numbers are very easy to come by. If you know how the algorithm works assigning ID numbers you may very well guess correct ID Numbers.

What should happen here is:

1. The consumer must be afforded the opportunity to decide if they want to make use of the service or not.
2. The consumer must be in a position to sign up for an account at bills.co.za
3. The consumer can then decide upon their own Username and Password.
4. In order to make things more secure, additional logon security measures can be implemented.
 
And on the same note, here is yet another fu**up municipality website where residents simply enter their account numbers as the username and password to view their bills, etc. https://www.ebillrms.co.za/clientrms/

You only need to guess 6 digits, eg: 126*** to gain access to anyone's account and view all their information and actual bills.
 
Bizkit87 said:
Well, Kudo's to them, a mistake was found, the immediately took it down, and commited to fix it. Well done [But erm... have a talk to your QA assurance and testing guy...]
Click to expand...

Quality assurance assurance? :p
 
Damn thats pathetic.

Companies get hacked - it happens. However, intentionally providing a weak mechanism publishing confidential info is gross negligence plain & simple. We'll do better in future is simply not good enough. Imagine neurosurgeons operated on that basis...

Reynders emphasised that the site is secure and that payments made through it are done in a fully secure environment. The SSL details displayed by the browser when visiting the site appear to confirm this.
Click to expand...
Right, so this being a tech site I'm sure that everyone understand SSL provide zero extra protection relating to the matter at hand. This leaves two options:
A) They don't know this and thus stated it - further display of incompetence
B) They know it but stated it anyway - blatant attempt to deceive

Doesn't even matter which it is, both are equally bad.:twisted:
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X