News |

Finland urged to fix identity theft loophole

Finnish authorities have been urged to tighten their procedures after Yle reported on the ease with which criminals can change others' addresses and start receiving their mail.

Image: Kaisu Nevasalmi / Yle

Criminals are currently able to use address change forms from Finland's Population Register Centre and Post Office to alter people's addresses without their knowledge or consent.

Finnish police officer Tero Toivonen, who is currently on secondment at Europol, has criticised the practice, saying Finland's procedures are outdated.

"A big chunk of our legislation was written before the internet and this kind of digital technology, and that causes unintended consequences, such as unauthorised address changes used to perpetrate fraud," said Toivonen.

Most people notify address changes online, but it's still possible to do so using a a paper form. Image:

At present some 80 percent of official address change notifications are made online, using secure online banking codes to prove identity. However some 20 percent of address changes are notified using a paper form, which requires no effective identification check beyond a Finnish resident's ID number.

The Post Office, which redirects mail, and the Population Register Centre, which keeps official records for the state and public bodies, admit the potential for fraud.

No legal requirements for ID checks

In one case last year a 30-year-old woman is alleged to have changed the address of a 20-year-old woman without her knowledge, before ordering around 30 different products and services in the name of the 20-year-old.

Police are investigating the case. Hannu Kortelainen, who heads up the Helsinki Police Department's criminal investigation division, says it's a relatively common occurrence.

"Criminals have more time to commit fraud when the crimes are committed in the name of someone whose address has been changed," said Kortelainen. "Bills and requests for the return of products are then sent to the wrong address and it can last for months before the victims understand what's been happening."

Story continues after photo

Hannu Kortelainen
Hannu Kortelainen Image: Christoffer Kaski / Yle

Toivonen suggests that the authorities should at least contact individuals by email and post to confirm address changes. Timo Salovaara of the Population Register Centre says, however, that there is currently no legal requirement for them to check the identity of anyone submitting an address change form.

"In practice that means that we have to accept notifications sent by post, and we can't check identities," said Salovaara.

People can block any changes to address information by sending a written request to the Post Office and the Population Register Centre. Kortelainen recommends that course of action, especially for those 16,000 people whose ID numbers were leaked online in 2011 after data breaches at the University of Eastern Finland and the TTS training institute.

Latest in: News


Our picks