You're walking down the high street minding your own business, barely conscious in that post-sunrise, pre-coffee phase. All of a sudden you spy something in the path ahead of you - a bank card. You pick it up to find what appears to be a valid bank card from a Mr John Doe. What do you do?
Do you start tapping strangers on the shoulder? Do you hand it into the nearest shop? Do you hand it into the nearest police station? But you're a smart one so you decide to look up John Doe on Facebook. Failing to find a John Doe local, an idea springs on you - why not post it on my Facebook timeline and local community group to see if anyone else knows who's card this is.
Let's pause here and assess what has just happened.
First of all, a genuine well done on taking action. Too many of us find it easier and simpler to ignore what is a big issue for others as they inconvenience us. Deciding to take a positive action is a good thing. However, unknowingly you could be doing further damage. By arming yourself with a little knowledge about cyber security you'll be able to handle this situation properly.
Don't put yourself or others in danger
Being a good citizen does not mean becoming Spiderman. You don't know who's card this is, and by reaching out to them directly you risk putting yourself in danger, even if it is through the internet. You risk putting the other party under fear too. What if they accuse you of stealing it? What if someone else has committed fraud on that card and you're the one creepily trying to Facebook them? Vulnerable people and dangerous people are part of our communities. Especially if you yourself are young - don't put yourself into immediate danger.
Don't take pictures of bank cards
If you take a picture of someone else's bank card with its numbers on it you're putting yourself in very dangerous waters. Even if you decide to post a lost-and-found on Facebook what value would posting a picture bring? Could you not just manually write the bank name and owner's name so your phone isn't storing an indefinite backup of their private financial details? What if someone else takes a copy of that photo? This is never a good idea.
Don't post pictures of people's bank cards online
If you post someone's private confidential financial information online you have broken the law, and you could be prosecuted as a result. Banks see this as fraud, and if significant financial loss comes of it, guess who the banks will be going to, to recover that loss? Just don't do it.
You may think, "well I'll blur out the numbers" - that's not good enough. It is possible to recover text hidden behind blurred images:
- if part of the numbers are shown (e.g. the top millimetre), then someone could compare the characters of that visible picture to a font matching that in order to figure out the numbers
- if your blur the entire number line then someone can use software to figure out the original numbers. For example, if you blurred the number "9" it would come out in a unique blur for that number. Software can run through every combination of "blurs" for numbers 0-9 and compare the resulting blurs to find matches. Through this method, the original numbers can be read. If fraud happens as a result of this, you may be held accountable by the bank.
- If you block out the numbers, sometimes these "blocks" in your photo editor on your phone are not really 100% opaque, this means by fiddling contrast and brightness settings the original number can be read. If fraud happens as a result of this, you may be held accountable by the bank.
- If you truly block out the numbers so that it is impossible to read the numbers - you may not be sharing the private banks' details online, but you likely still have a copy of the original on your phone and in your phones cloud back-up. Even if you don't, what's to say that someone else hasn't taken a picture before you did?
Hopefully, you can conclude from this that there is never appropriate to share someone else's card details online, even if you have good intentions you are putting someone else's financial records and your own legal position at risk.
Don't hand it into a shop
They may look trust-worthy because they are behind a counter, but that doesn't make them so. In fairness, if you don't want to deal with the issue properly, this is going to be a better option than leaving the card where you found it, but it would be better to report the card lost.
If I found a bank card in a shop/cafe etc. I would first report the card lost by calling the number on the back, then hand it into staff and tell them you have done so. That way if the owner calls back in they will have their card back but have the safe knowledge that no-one that may have copied down the details has access to their funds.
Should I call the police?
Police time is stretched, and bank cards being lost is not a criminal offence and is a very common occurrence. Although police can be treated as a safe and trusting authority all they will do is report the card lost - if they have the time to do so. Save the police some time and hassle (as well as the taxpayer some cost) and just report the lost card directly to the bank.
There is an important time you should do this however - if a whole wallet, purse or handbag is found this could be more concerning. Perhaps the persons has been robbed? In this circumstance you should consider handing it into your local police station.
How do you know the owner is who they say they are?
If you manage to track someone down, meet up with them in person and return their card - what are you going to do to validate their identity? Anyone can create a very real looking Facebook profile. Are you going to take their word on the matter? Are you going to just give a guess that the person's face looks the same as their hopefully real Facebook profile? Are you going to ask to see ID at the door? Do you know how to spot fake documents?
Banks have strict and details ways to check and validate identity using methods you do not have access to. They are trained to spot fraud, and if fraud makes it through they are insured against legal action. You are not.
By returning the card you don't solve the problem
If you manage to track someone down, find the real person and return the card you are not solving the problem. The card is not a key to the bank account. The details on the card are the key to the bank account. What if before you found the card someone else took a picture of it? That would mean you've now given someone false assurance that their money is safe - it might not be. If fraud happens, who do you think that person is going to point the finger at? Especially if you had previously taken a picture of the card and shared it online.
So what should I do?
If you find a bank card and the immediate owner isn't obvious then call the number on the back of the card or hand it into the issuing bank.
By reporting the card lost the bank will do a few things:
- Firstly they will block any transaction attempting to go out of it. If someone has copied down the details you've just thwarted their efforts at fraud and protected the owner. From the moment the card is logged as lost those details on the card are useless. So you can just cut it in 2 and bin it - the phone operator will tell you exactly what to do.
- They will contact the owner directly using the details they have on file to tell them their card has been lost and found. You cannot do this safely, the banks can.
- The bank will immediately issue a new card with new details to the owner. You've just saved them a massive headache and their card will now arrive sooner. That's awesome.
- You don't put yourself or others in any immediate risk.
I've already shared the card online, what should I do?
First of all, don't panic. Your heart was in the right place, you just didn't fully understand the risks. Now that you do, you can act safely to solve the problem.
- Call the bank using the number on the back of the card and report the card lost, explain you've tried to contact the owner online. If you've posted confidential financial details tell them. If fraud happens in the timeframe from when you've posted it, the bank may be able to stop some fraudulent transactions going through.
- Delete any posts you've made online. If you've done #1 then the card details are now useless, however, by leaving the posts online you're indirectly teaching people to follow the same mistake. Help your community by not leaving not-so-great examples for them to copy.
- If you've already made contact with the owner, apologise and cancel plans to return the card. Share this article if it helps
It may seem like you're inconveniencing someone by reporting their card lost, but you're actually endangering them if you do not. It's great you've chosen to be a good citizen and do something about a problem in your community. The world needs more people like you, but remember we all make mistakes and that can mean we can cause a lot of damage even if we didn't mean to.