Business and Careers

Have you ever heard of the phenomenon known as ‘shoulder surfing’? If your first thought was to immediately imagine some kind of radical new water sport that your kids might be into, well, unfortunately you’re wrong. Turns out ‘shoulder surfing’ is actually much more insidious, as it is a term used to describe a type of identity theft (*’shoulder surfing’ is where a thief simply lurks behind you, but within close enough distance to simply glance over your shoulder to see what your pin number is). Identity theft occurs all the time; credit card numbers are stolen from your mail, your personal information can be stolen when a network or server is hacked into, phishing emails attempt to steal information by posing as a legitimate business or person, etc. Identity theft is everywhere and can happen to anyone. Also, more and more often identity theft leads into a much more damaging and serious scenario, where the stolen information can be extrapolated into full blown identity fraud. Imagine somebody, somewhere with enough of your personal information that they can actually impersonate you for further gain. Scary, isn’t it?

For a business owner, the threat of identity theft is something that must be taken very seriously. Personal information of clients or customers must be protected at all times from the potential threat of theft. New employees can be screened and an online background check can uncover anything unsavory before you’ve hired them. However, what about external threats? If a hacker gains access to your database and is able to steal all of the customer financial information you have – credit card numbers, etc. – you’re likely going to be in a potentially actionable position, as it is your responsibility and not the customers’ to safeguard your information on file. It’s pretty easy to understand how something like this could be potentially very damaging to the livelihood of your business. So what are the ways in which a business owner can protect themselves and their customers’ personal information?

Secure your business premises -

This is the first, most basic step you can take. An alarm system, monitored by a security company, is an effective and simple deterrent to criminals. Re-enforce the premises with deadbolts for all the doors, shatterproof glass for windows, etc.

Store all your records in a safe (and secure) place -

Any information that is stored on paper should be kept in a secure and lockable filing cabinet or similar storage vessel and make sure they are locked every night or any time you are away from your place of business. Some business owners may choose to forgo this and take the next step by using a locking safe. A secure cabinet or safe is a good place to keep back-up or duplicate copies of important information as well as back-up copies of database information.

Don’t need it? Shred it! -

It’s never a good idea to simply throw old, un-needed, or non-sensitive records into the recycle bin or garbage without shredding them first – a recycling bin outside of your business is a haven for identity thieves looking for information. Business records of any kind (*especially old bills or invoices), regardless of sensitivity, should be shredded. Smaller businesses and home based operations can buy shredders for home use; bigger establishments can enlist a professional service that picks up your recycling and shreds it too.

Be mindful when you’re on the phone -

The tried and true landline phone is likely where countless identity theft schemes have been executed – it’s a perfect tool for thieves since over the phone it’s easy to impersonate anybody. While there has been much advancement in technology that enables you to verify and confirm identity, it’s still fairly easy to conduct a telephone based scam. Never give out sensitive information on the phone about your business or your customers without being positive that the caller is who they say they are, regardless of how convincing they may seem.

Place limits on computer access -

Many “open” work environments such as hospitals, office buildings, etc., are easily accessible by just about anyone. For this reason, it is common practice for these places to have all computers on premises password protected, as it eliminates the risk of any person being able to access a computer when no one is around. However, it’s not just outside access you’re protecting yourself from because internal access is also a potential issue. It is likely that not every employee in the workplace will need the same level of access to information; passwords for sensitive information should only be given to those that need it on a regular basis and anyone else can ask for single use access when required.