"Your Individual Number is required in your contract. Please complete the form.
(Or please send us.) XYZZY, Inc."
Countless "phishing sites" are existing on the Internet. For example, appearance of the victims who are ripped off their "Credit card number" or "PIN code" is unending. Sooner or later, phishing sites that try to gather "Individual Numbers" will come out.
"Suppose if a phishing site that spoofing my company have emerged..."
For those companies utilizing many external freelance must rely on "online application". However, the situation will be a serious trouble if a spoofing phishing site emerged. Basically, there are no measures to prevent the ripping off other than to ask for confirmation of "data transmission destination" and "addressee".
- URL for the destination of verification file is "https://example.com"!
- Address for mailing copies of identification documents is "Anyplace street, nakagyo-ward, Kyoto city"!
In the example which I have presented in the latest article,
It was available to apply for freelance in remote location, lawyers or accountants. Moreover, it was excellent workflow that is capable of reducing the number of "person responsible for collecting the Individual Number" to very limited. As a result, it was possible to reduce the "risk of information leakage by human" to almost zero.
However, in that sample, it was required to attach "Individual Numbers" and "Image files of certificates".
- A). Image of "Driver's License"
- B). Image of "Notification card"
A: Can be substituted with "Individual Number card (front side)" or Government-issued photo identification such as "Passport", etc.
B: Can be substituted with "Individual Number card (back side)" or certificate on which Individual Number is indicated such as "New Residential certificate", etc.
That is, in terms of the fishing site side, it can be said that it is a "structure of easy to Rip-off." Risk assessment by qualified personnel of information security may vary, but at least it cannot be said that "the risk is zero". In the first place, I wonder if there is a way without exchanging sensitive information online?
The following Workflow is an Individual Number Application flow from a remote location that is characterized in;
- Not submitting neither "A; Image of Driver's License" nor "B; Image of Notification card" (!)
- Not submitting even "12-digit individual Number" (?!)
"Division of the information" is the keyword. Explaining this business process roughly, it consists of the following two Steps.
- Transmission of first 8-digits
- Verbal report of last 4-digit
Caution: Regarding to "it is clear that it is the same person", there is a risk of occurrence of "difference of opinion" between the government institutions, etc.! For more information, please confirm the enforcement regulations Act Article 3 (5) and the enforcement regulations Act Article 9 (4). (Or go to the Government office to confirm, preparing for red tape runaround.)
[Individual Number Application flow-5]