Wow. They didn't mail it and require confirmation of receipt, they just required a (trivially forged) mail with that email address in From?
more likely just following an established policy that applies to all such information, to take personal judgement out of the equation. almost certainly absolutely nothing to do with your “file” in particular.
so our email providers can get all this data? They can DKIM sign such a mail and simply never have the relevant emails show up in your emails.
My goal was to make certain that if it leaked, the overtyped expiry date should make it useless after a certain point, and the company name should make any company other than that one question the source.
As a side effect, it'd also clearly identify the source of any leaks - but that wasn't my primary goal.
I moved the text so the name and address (which they already had) and date of birth (which isn't really a secret) were clearly readable.
>As a side effect, it'd also clearly identify the source of any leaks - but that wasn't my primary goal.
Wouldn't a malicious actor just add block text over your text saying "only for identity verification for SomeOtherCompany" ?
They could do the same for the expiration date, although I wonder if any company actually bothers to check the expiration date
One requested a copy of a photo ID or passport and were happy to accept a partly redacted copy with 'FOR PROOF OF ID ONLY - (company), (date)' over-typed on the scan in red.
Another requested I email them from an email address they had in their records, or log in to change it and resubmit the request.
Most of the others sent the data without any ID checks whatsoever.
Curiously the one who did the most ID checking used an exemption (I forget the specific GDPR Article number) to redact nearly everything which wasn't shown on their web portal. Their position was that "revealing this data (specifically messages on trouble-tickets and their staff's internal notes) would adversely affect the privacy of our staff".
Amusingly I could just log into their portal and view the trouble-ticket history (but of course, not the internal notes). I can only assume their refusal was because there were comments in the internal notes (on my or other tickets) they weren't comfortable disclosing.