Sealing of ID cards and payment cards at oglaszamy24.pl
The scandal has been taking place for several hours on Wykop. Someone sells personal data on oglaszamy24.pl. And there is a whole lot of it, and trade is in full swing. The administration of the online store either does nothing with it (or is not aware of it), or has so many advertisements that it is unable to read and verify everything - which is unlikely.
Readers report "strange" auctions, where they trade with personal ID cards, payment cards, verified Allegro accounts, bank accounts, birth certificates, death certificates, driving licenses and other scanned documents that contain personal data.
Here's one of the ads:
Skan dowodu Skany dowodów osobistych LUPUS Witam Oferuje dokumenty takie jak prawa jazdy czy skany dowodow osobitych, paszporty, dyplomy i wiele innych. Skany sa oryginalne, nie modyfikowane jak u innych sprzedawcow. Wysylam skan, jako pierwszy z zamazanymi danymi. Pytania? AlfaLupus @ protonmail.ch Cena: 50 zł Kontakt: Alfa Lupus Telefon: 127 0 0 1
Similar to the offer for PLN 50, we can see mushrooms after rain:
Witam Oferuje skany dowodów paszportów praw jazdy akt ur. zgonu, i wiele wiecej! Cena skany to 50 pln (zestaw 100 prawko plus id) Skany nigdy nie sprzedawane dwa razy, nie uzywane w BETach czy na zadnej innej stronie (chyba ze wlasciciel ich uzyl wtedy wymieniam) email : AlfaLupus @ protonmail.ch jabber : thchaos @ exploit.im
It can not be ruled out that the same criminal is behind all advertisements. The comparison of individual auctions quickly shows that the person who added information used the same language - with the same mistakes - and did not use Polish characters. In most advertisements, telephone contact is given to the local IP address 127.0.0.1, placed probably for a joke or as a "filler" of the mandatory field in the process of adding the auction. In many sales offers we see the same e-mail contact with the mailbox in the Protonmail service (famous for its anonymity).
In one advertisement, the criminal does not even hide, he just writes explicitly that the data sold belongs to the "pole":
Konta bankowe Skan dowodu Słupa Karta płatnicza Umowa z bankiem Bankowość mobilna Karta sim Nazwisko Mam na sprzedaż konta bankowe zakładane w placówkach na czyste osoby. Do każdego konta jest komplet dokumentów oraz karta do bankomatu z długim terminem ważności. Zapraszam do kontaktu.
We are not sure whether the attached photos of the evidence for the ads are true, whether they come from data leakage, theft of documents by current or former employees of the data processing company (and requiring the transfer of scanned proof or other document) or whether they were generated and made available as demonstration.
Oferuje oryginalne skany dowodów osobistych, nie przerabianych w zaden sposob. Posiadam ogromne ilosci roznych dokumentow, aktow ur. praw jazdy dokumentow firmowych i wiele innych! Zapytaj a przedstawie szeroka oferte. Skany moge wyslac pierwszy ze znakiem wodnym badz zamazanymi danymi! Skany nigdy nie byly uzyte w bukach skrillach itd, chyba ze uzyl ich w tym celu ich wlasciciel, udzielam jednak gwarancji, i wymieniam takie skany! Handluje skanami od bardzo dawna! Pytania prosze kierowac pod mail: AlfaLupus @ protonmail.ch
The administration of ogloszenia24.pl did not answer our questions. Interestingly, the owner (s) of the site probably had to deal with law enforcement agencies, because in the "contact" section there is a special tab for police officers:
In the advertisements, the address of AlfaLupus @ protonmail.ch is scrolling, but it will be virtually impossible to determine who the mailbox belongs to (from what real IP address was it created).
We warn readers that they would not hastily agree to copy their documents without foundation. In this regard, even GIODO has reservations:
A safer solution, to which I personally incline, would be to use a different data collection technique, such as creating a customer-certified copy of your ID card. This is because our security is at stake because the photocopier of evidence can be used by fraudsters, for example in order to conclude a credit agreement via the Internet, without the knowledge of the owner of this document. We see this problem and we want to counteract it.
- comments Dr. Edyta Bielak-Jomaa from GIODO.
The banks have the right to photocopy their identity cards, but the employees of the Inspector General for Personal Data Protection look at this practice. On the other hand, a categorical prohibition on copying identity documents was given to telecommunications operators who can request more data only with the customer's free consent. This means that no other data, such as a photo of the user, is required to sign the contract.
The decision of GIODO was challenged in another case by an entrepreneur whose position the Provincial Administrative Court in Warsaw dismissed twice (case references: file reference II SA / Wa 1655/15 and file number II SA / Wa 779/16).
Add new comment
Learn more about our offer
We use Google Cloud Translation and Gengo API’s to translate articles with exception of our comparative tests.