ID cards could be a conman's paradise, fraud experts warn

The Government's plan to introduce compulsory identity cards could create a fraudster's paradise, according to leading software security and data experts.

Steve Gal, co-founder of ID Analytics, a US firm which specialises in studying fraud behavioural patterns for banks, warned it would be very difficult to prevent fraudsters getting genuine ID cards.

"My understanding is that the method of authentication will be matching of data to credit agencies' files," Gal said. "The problem with this is that criminals can get access to these files - we know of 50 million cases of personal data breach reported in the US this year."

In the US, crooks have been able to bribe staff in credit reference agencies or hack into the databases maintained by banks and other financial companies.

Experts are also concerned that government agencies' records on UK citizens may not be up to date or accurate. That would make it harder for agencies to share information in order to catch out the criminals. Barry Stamp, joint managing director of Credit Reporting Agency, said: "It's only good if you use the information and it is right."

For example, fraudsters currently find it easy to get a new driving licence simply by filling in a form and providing a photograph and basic birth certificate or passport details. Conmen obtain the details of people who have died to apply online for a birth certificate from the General Register Office. This register does not supply other agencies with details of people who have died.

"If you don't link the records to the births, deaths and marriages register, how do you know when someone dies?," Stamp said.

While there are 44 million people eligible to work in the UK, more than 60m national insurance numbers are in circulation, according to Stamp.

In fact, a wide range of different public sector agencies hold an estimated total of more than 150m records on UK citizens, with little cross-checking taking place.

National insurance numbers are held by the Department of Work and Pensions, birth certificates are lodged at the General Register Office while motoring details are maintained by the Driving Vehicle and Licensing Agency. HM Revenue and Customs holds tax details and criminal records are held by each of the UK's 43 police forces. Electoral roll data is held by over 450 local councils.

Mark Jones, a former director of fraud prevention at Direct Line, said: "The government needs to get its act together with the databases they have - there is no cohesive strategy."

Dr James Hart, commissioner of the economic crime unit and chairman of the Association of Chief Police Officers' economic crime portfolio, said it was crucial for there to be an extension to the testing process.

"This could be done gently so that the vulnerability of the technology could be looked at in a controlled way," he said. "The validity of the technology is pivotal and there needs to be more than one method of establishing identity."

Hart called for testing to take place over time so a system could evolve to take advantage of the latest technology, and warned ministers not to commit to a set time frame too soon.

Graham Lund, head of new product development at the credit reference agency CallCredit, said ID cards were a major concern.

"We have some reservations dependent on how tough the security measures are," Lund said. "We would need to be confident the system was producing bona fide cards and that there would not be a large number of duplicates."