How a Visitor Book can be a Major Security Risk?
We live in an era of phishing websites, phone fraud, identity theft, digital arrest fraud and what not. The worst is the doorstep fraud. We do not even realize when we become its victims. A burglary or a car theft or a bank account cleanup is often preceded by a doorstep fraud. After the crime, victims always wonder as to how it happened. They never get to the part of doorstep fraud.
Understanding a Doorstep Fraud
Doorstep fraud is the most frequent type of crime which is rarely caught. It is a conman trick. Con in conman stands for confidence. So how do they do it? Doorstep fraud requires three recurring elements.
The first is a credibility anchor. A reference like a doctor or his clinic, bank, utility company, or government office creates trust. These are the names that make the visitor's presence seem expected rather than suspicious.
The second is a wealth with vulnerability signal. Old age and living alone are vulnerabilities inviting scammers. Wealth could be anything like a regular pension account or something visible like a house, a car, or a purchasing history that tells the scammer how much to ask for and how hard to push.
The third is a pretext object. It may start with a free sample, an inspection, or a service offer that gets a foot in the door and a few minutes of unsupervised access to the house.
In short, the door-to-door scam involves individuals disguising themselves as surveyors, sales representatives or service providers to access people's homes.
They gain personally identifiable information like security measures in the home, details of properties and their occupation pattern, or money. The setup phase is the most decisive part of whether the fraud or actual crime will succeed.
A Visitor Book
We all visit a clinic of a doctor or some other place of trust. We come across visitor's book. In my case it was placed at the reception of my dentist. This visitor book was a diary running into hundreds of pages. A page or two for each day. Whenever I am asked to fill it, I put acronyms for name and residential address and an obscure scrawl for phone number. And another short fake scrawl for signature. Why do I obscure my entries?
A visitor book turns private information into a public ledger. Every patient who signs after you can read your name, address, and phone number. Anyone who flips back through weeks of pages sees the same for everyone else.
A visitor log or patient register that captures name, address, phone number, a short signature and the date and time of visit is a small profiling dataset sitting in plain sight. Add the doctor's name and here is a full supply of all three ingredients required for doorstep fraud, explained above.
The visitor book had everything except the age and purchasing power of the signatory. Photography of the book is very easy. All one has to do is to find either a busy day or an empty clinic.
If you still do not understand, please read on for more details.
One physical book holds hundreds of pages of names, addresses, and numbers in one place. If it is lost, photographed, or stolen, every visitor's data leaks at once. That is very different from one person's risk being exposed alone.
Patterns matter too. A running register lets someone track when a specific person visits regularly. That knowledge can support stalking or burglary planning, since it tells a stranger when someone's home is likely empty or he/she is vulnerable.
Executing the Doorstep Scam
Doorstep scams require a trusted name to open the door. A doctor's name can do that. Using the clinic's name, a crafty person can visit each patient with a few rupees toothpaste as sample saying that our company is giving it for free to all the patients of Doctor Know-it-All.
Later in conversation they can tell the person that we also give car washing and polishing cream for free. If seeing the house had not resolved the wealth, the car model will resolve the purchasing power puzzle.
A data point that confirms the target has money, and a low-cost freebie to justify the visit and buy time inside. The doorstep visit under a false pretext becomes a soft social engineering entry point.
This completes the three-part structure: credibility anchor, pretext object, and the wealth signal. Now the crime will move to next part which will be visible. This part most of the victims forget. But this is the foundation of the actual crime which may not happen without this preparatory work.
This visit itself may also be crime-oriented. A quick pick. A small theft or something but that is not my focus here. But remember the visitor will have a visiting card, stationery and a beaming ID card with photograph. He may be wearing a tie and jacket with shining shoes.
Prevention of Fraud
The clinic was collecting this information because these were the columns in the preprinted visitor book bought off the shelf from a stationery shop. Nobody designed that form for the clinic's actual needs. A printer designed it for a generic "visitor register" and clinics just bought whatever was on the shelf. The columns exist because they're standard for the product. Data collection by default, rather than by decision, is one of the most ordinary ways sensitive information ends up in the wrong hands. The vulnerability wasn't carelessness. It was inheriting a stranger's idea of what a visitor register should contain. So how can we prevent the fraud?
Data minimization is the core principle here. If a field isn't needed for the clinic's actual purpose, seeing the doctor, then collecting it only creates exposure risk later.
Doctors, especially dentists, do not charge by time so mention of it is redundant. For order determination as to who came first the serial number can tell that. In short, a visitor book should ask just for name and phone number. Nothing else. Not even time of visit.
So the right visitor book reduces to three things: serial number, name, phone number. Nothing on it tells a stranger where someone lives and what his initials or short signatures look like.
Another useful suggestion is to use a single sheet on a clipboard for each day. Better still if one sheet is used for the morning and one for the evening.
If one sheet is used for a single day, the date is the contextual information, not something the patient needs to write. Staff can note it later at the time of filing. It cuts one more handwritten data point that a photograph could capture along with everyone's details. Now no one can look back and see the pattern of visits.
Future
The suggestions and advice have one destiny. That is to be ignored. More so it is unsolicited. However, in my professional experience as a lawyer, people have trouble following advice even when they have paid for it. Therefore, it is very unlikely that my advice will be followed. But if it is their pattern of living, writing about things is my pattern of life now.
Qué Será, Será.
Reference:
Guideline to protect from door to door scam
Leave a Response