Original URL: https://www.theregister.com/2013/05/13/apple_passport_privacy/

Apple asked me for my BANK statements, says outraged reader

Want a shiny iThing? Get your passport out

By Jasper Hamill

Posted in Security, 13th May 2013 09:58 GMT

Exclusive Apple is believed to have asked some online shoppers to hand over copies of their driving licence, passport and bank statements to verify their identity.

A concerned Reg reader alerted us to Apple's data-slurp requests after she received one herself - and was told by her bank that they had never heard of private companies asking for this information.

After ordering an iPad for her young son, our reader - who works in the IT industry and does not want to incur the fruity firm's wrath by revealing her name - received a suspicious email purporting to be from Apple, but looking like the sort of dodgy call for information we're all told to strenuously avoid.

It read:

We perform security checks on our customers' credit card orders due to the fact that the cardholder is not present to sign for transactions. The Apple Online Store's Terms and Conditions state that Apple reserves the right to verify the identity of the genuine credit card holder by requesting appropriate documentation. Please note these checks are a security measure designed to protect your information.

The email continued:

Please scan a copy or take a photo of the following documentation in jpeg format and email it to eurofinance@euro.apple.com:

1. Card holders Drivers license or National Identity Card or Passport and 2. Recent Credit Card / Bank Statement showing card holder name, address and card number.

As our reader had scans of the documents to hand, she emailed over copies of them... and then immediately began panicking.

She phoned the police and her bank, who both told her the email was more than likely a fraud. She feared her identity was about to be stolen due to the amount of personal information she had just handed over.

But after Apple wrote back to her and told her they had checked the documents with a notary, she began to realise that it was a genuine, Cupertino-endorsed email. The letter said that Apple understood "her concerns" about sending over bank statements, but asked her to do it anyway, as well as ensuring her passport copy was in colour.

A quick scout through the Apple forum reveals similar complaints - and when we phoned the fruity firm's customer services branch posing as a fanboi, they confirmed that agents did indeed ask for copies of customers' driving licence, passport and bank statements.

The ability to do this is written into Apple's terms and conditions, as mentioned in the letter quoted above.

Our source said: "When I found out this was a genuine Apple request, I immediately cancelled the order. They've basically turned me into a future Android user.

"Apple told me they carry out spot checks for security reasons. But I don't think any private company should have the right to ask you to send over such personal documents by email.

"It's Apple's arrogant way of saying: 'Tell us everything about yourself or we won't sell you our products'. What's next? Will they ask for my inside leg measurement or a chest X-ray?

"I'm so angry. After sending that information, I thought I had been hacked and spent days worrying. The police told me I had definitely been phished, whilst my bank told me they had never heard of private companies asking for this information. Then I found it was genuine, because Apple had the cheek to ask for a colour scan of my passport. I'm shocked by what they've done."

El Reg recently wrote about a German court's decision to make Apple tighten up the way it uses customers' data. The ruling hinged around Apple's policy of "global consent" to its terms and conditions over how personal data is gathered and used.

Campaigner Nick Pickles, director of privacy and civil liberties campaign group Big Brother Watch, believes that Apple is seeking far too much information from consumers under the auspices of combating fraud.

He said:

It’s very concerning that a private company feels entitled to demand and store sensitive identity documents for [users] to purchase something from Apple.

This is a totally over-the-top approach to fraud and I would be astonished if there isn’t a better way of combating fraud than intruding on people’s privacy like this. Customers are apparently allowed to black out "sensitive details" on the copied documents, according to our source. Apple appears to offer no detail on how long the data will be held for, nor offer the customer an alternative way of verifying their identity. This heavy handed approach only undermines consumer confidence that companies respect their privacy and potentially increases the risk of identify fraud or people stealing identity documents to facilitate purchases.

Apple told El Reg it does not comment on individual cases. Apple's terms and conditions say: "We reserve the right to verify the identity of the credit card holder by requesting appropriate documentation." ®