I use an application Carbon (formerly PayLater) to sort out some immediate cash requirements. I have been a customer for about 3 years.
Recently, I had an urgent requirement and decided to use them again. I went through the usual protocol of filling in a loan amount and getting offers. I chose one and applied. Unexpectedly, I got a request to update my pension information on the app. That set off a warning for me. Why do they need my pension information? For such a little amount. This amount is less than I had applied for in the past.
I fired off a tweet at them and inquired why I had to provide my pension information. Do note that they already have all my other details including bank information, card information and employment information. Their response? They needed to verify my employment status.
I got a call from their customer service. He asked if I had changed my phone recently. Affirmative. I change my phones frequently. Well, according to him, they had to re-verify me since I had changed my device. That response brought up a few questions
- what was on the old device that kept me verified but not on this device?
- what information are you gleaning off my device that I am not aware of?
Those are not my concerns. Not yet.
During the call, the customer service representative asked me a few identifying details to confirm if it is me. My date of birth, working place and name of bank registered with Carbon. I asked him if he had access to my bank account information, and he replied yes. I got scared. Nothing hidden. I may be paranoid but there is nothing wrong with being paranoid about your financial information being handled carelessly. The customer service representative has access to enough information to impersonate me.
What other information about me is made available to the customer service representative? My texts, which may have been secretly uploaded to a server without my knowledge, which show very personal information? Were they able to read my pension information from the notifications texts I had received in the past?
I will put in a request to delete my account.