Chapter 13: Copies of My Identity Card

Tuesday Night, Week 11

Exams start properly next week, and I have turned into a person who eats crackers over her textbooks at one in the morning. I swapped two of my café shifts so that I could revise, which means less pay this month, and my bank account looks thin. I have a list on the wall of everything I still need to learn about cell membranes. The list is longer than the wall.

Tonight, at about eleven, a message appeared in the biology course chat. It was from a classmate in my practical group, someone I like and have worked next to all year. She wrote, "Free starter money for students! I got mine today!" and posted a link. Two or three people replied with excited faces. I was tired and hungry and a little sorry for myself, and I opened the link without thinking. I am writing that sentence down honestly, because it matters: I did not check before I opened it.

The page was bright and friendly. It said that a new investing platform for students was giving every first-year student a small amount of "free starter money" to try investing, about a week of my café pay, "to help with the stress of exam season". There were photographs of smiling students with books, and a line saying that the offer was "supported by student groups". To claim the money, I had to open an account, and then I had to "verify your account" by uploading photos of both sides of my identity card and a selfie.

And I did it, not the uploading, but nearly everything before it. I typed my name and my email address. I took my identity card out of my wallet, put it on my desk under the lamp, and photographed the front and the back. I took a selfie, holding my face very still, the way the page told me to. The three photos were ready. The upload button was right there, green and round. My thumb was above it.

Then my eyes stopped on the word "verify". It was printed in big letters above the button. Verify your account. And I thought, very slowly, as if my brain had suddenly woken up: they are asking me to verify who I am. I have not verified who they are. I am about to give a stranger the most important card I own, and I have not asked a single one of Grandma's questions.

I closed the page, and my heart was beating as if I had run up the stairs. I sat for a while with the card in my hand. Then I put it back in my wallet, and I put my phone face down on the desk, and I am writing this instead of uploading anything. Grandma's rule is inside the cover of this diary: "Count twice. The second time, count with your own paws." I counted once tonight. Tomorrow I will count again, properly.

Wednesday, Week 11

This morning, before my first revision session, I did the check, and I did it in the opposite direction from usual. Usually I am checking a claim that someone is making to me. This time someone was asking me to prove something about myself, and I realised that checking has to work both ways. Before I send documents or personal details to anyone, I need to check who is asking.

Who says so? A link in a course chat, posted by a classmate, which leads to a page that says it is a new investing platform. Not my university, not a bank, not any office I know. How can I check it myself? First, I looked up the name of the platform on the official register, through the website of the official office that supervises banks and investment firms, using the address I saved on my phone in week 7, and it was not there. Then I looked at the university's own website, through the student pages I use every day, at the section about money help for students. There was nothing about starter money, no student groups supporting any investing platform, nothing at all.

Who gains if I believe it? If the money were real, a platform would be giving away money to strangers and asking for nothing back, which is not how anybody stays in business. So the gain had to be somewhere else. And then it was obvious. The gain was the photos. The starter money was the bait, and my identity card was what they wanted.

I asked Lina what someone can do with photos of an identity card and a selfie. She did not give me any details, and I did not want any. She said, in general, that copies of your documents and a photo of your face can help someone pretend to be you. In many places that can mean accounts opened in your name, loans or purchases you never made, or your real identity being used to make another scam look trustworthy to someone else. "Your face and your card are like your signature," Lina said. "You can't cancel them as easily as a password."

Then I had to decide what to do about the course chat. I did not want to embarrass my classmate in front of everyone, because she had not done anything wrong. She had believed something, the way I very nearly did. So I wrote a careful message to the whole chat: "I opened the starter money link last night and almost sent my ID photos. This morning I looked up the platform on the official register and it isn't there, and the university's student money pages say nothing about it. I think nobody should upload anything until we know more." Then I wrote to my classmate privately, to tell her I was not blaming her.

She answered within a minute. She said she had already sent everything, both sides of her identity card and her selfie, and had been told the starter money would arrive within a day. Nothing had arrived, and this morning the platform had sent her a new message saying that, to "release" the starter money, she needed to make a small "activation payment" first, which she had been about to do. She wrote, "I feel so stupid, and I posted it to everyone." I wrote back, "You're not stupid. The people who made this are the ones who did something wrong, and you told me, which is the brave part."

Friday, Week 12

Two exams finished, three to go. I think I did well in the first one and less well in the second, but I am too tired to be sure. Between them, I helped my classmate with the things she needed to do, because she was shaking too much on Wednesday to think clearly, and I would have been too.

First, she did not make the "activation payment", and she did not answer the platform's messages again, but she kept every one of them, with screenshots of the page and the course chat post. Second, she phoned her bank, using the number printed on the back of her card, and told them that copies of her identity documents had been sent to strangers. The bank said they would put a note on her account and watch for anything unusual. Third, we found the official office that takes reports of fraud through its own website, and she reported what happened. She also reported it to the police, using the number for non-urgent matters, and she got a reference number.

Fourth, she contacted the office that issued her identity card, to ask what they advise when copies have been sent to someone she does not trust. The rules are different in different places, so I cannot say what they will do everywhere, but asking them was the right step. Fifth, she changed her email password, because she had used the same one on the platform's page. And sixth, she knows that for a while she should watch for letters or messages about accounts, loans or purchases she does not recognise. In many places you can ask for a record of the loans and accounts held in your name, and her bank told her how to do that where she lives.

She told our course organiser too, and the organiser removed the link from the chat and sent a message to everyone saying the same thing I had said. That made my classmate feel a little better. She said, "At least now it's a warning and not a trap."

Tonight, when everything else was done, I opened my phone's photo gallery and deleted the three photos I had taken on Tuesday night: the front of my card, the back of my card, and my very serious selfie. It felt good to see them go. I had not sent them anywhere, but I did not like having them sitting there, ready, as if they were waiting for me to be tired again.

Mum called on Wednesday evening as usual, and I told her everything. She was quiet at first, and then she said something about her work that I have been thinking about ever since. She said that at the hospital pharmacy, before they give anyone a strong medicine, they check the patient: name, date of birth, everything. But they also check the prescription itself: who wrote it, whether that person is really a doctor at the hospital, whether the signature is right. "We never only check one side," Mum said. "A real prescription can be on fake paper." I told her that was exactly what I had learned on Tuesday night, only the slow way.

Grandma's Fable: The Magpie Who Kept Keys

Long ago, in a wood where every burrow and every nest had a small wooden door, each animal wore its own key on a string around its neck. The keys were carved by hand, and no two were the same. The old bear, who lived in the cave below the waterfall, kept the list of who lived where, and when the miller mouse handed out the winter grain, she gave it to whoever showed the right key.

One autumn a magpie began flying from tree to tree, calling out an announcement. "The bear is old and tired, and I am helping him with the list this year. To stay on the list, every animal must show me its key and leave it with me for one night, so that I can check it is really yours. Anyone who does not will get no grain this winter."

The animals did not want to lose their grain. The rabbits gave their keys, then the squirrels, then the voles, and by the afternoon there was a shining heap of keys in the magpie's nest at the top of the tallest pine.

A young hedgehog took the string from around her neck and held her key in her paw. She was about to climb the pine. Then she looked at the key and thought, "The magpie wants to check that I am me. But who has checked that she is the bear's helper?"

She walked to the cave below the waterfall. She knew the way, because everyone did. The bear was awake, eating honey. "I have asked nobody for any keys," he said, and he put down the honey. "Nobody needs your key to know you are you. They only need to know you."

That evening, the magpie flew to the miller mouse with a beak full of keys. "I am the squirrel," she said, holding up the squirrel's key. "And I am the rabbit, and the vole. Give me their winter grain." The miller mouse had already had a visit from the bear and the hedgehog. She gave the magpie nothing at all, and the magpie flew off, scolding.

But the magpie still had the keys. So the bear and the hedgehog went from door to door in the dark, and every animal who had given a key was told, without anyone being scolded. The old beaver worked all night, carving new keys and new locks. By morning, the shining heap in the pine fitted no door in the wood.

The young hedgehog went home and hung her own key around her neck again. It had never left her paw.

Sunday Night, Week 12

Grandma told me the fable tonight. When she got to the part where the hedgehog thought, "Who has checked that she is the bear's helper?", I said, "That was me on Tuesday!" Grandma laughed and said, "Then you know the rest of the story already."

What I like most is the part after the miller mouse. The magpie still has the keys, and the story does not pretend that the danger is over. The bear and the hedgehog go from door to door and tell everyone, and nobody is scolded, and the beaver makes new locks. That is what my classmate did this week: she told her bank, the official offices, the police and the office that issued her card. You cannot always take back what you have sent. But you can make it fit fewer doors.

I tried to think about what the people behind the "starter money" want, and what they are afraid of. They want to wear someone else's name, the way the magpie said, "I am the squirrel." And they are afraid of one small question, the one the hedgehog asked: who are you, really, and who says so? A page that says "verify your account" is hoping you will be so busy proving yourself that you forget to ask it the same thing.

Grandma said one more thing. She said that in all her years as a bookkeeper, she never handed over a document because a stranger told her it was the rule. "If it really is the rule," she said, "it will still be the rule after you have checked who made it." I have three exams left, and I am going to bed early, for once.

What I Checked This Week

This week I learned that checking works both ways. When a page, message or caller asks me to "verify" myself by sending photos of my identity card, a selfie, or other personal details, I first check who is asking. A request for documents is not proof that the one asking is real. Anyone can put the word "verify" on a page.

To check who is asking, I use sources I choose myself. I look up the company on the official register, through the official office's own website that I find myself. If someone says they are connected to my university, my bank or an official office, I go to that organisation's own website or phone the number I already have, and I ask them. I never use the link, number or email address that came with the request. A friend sharing a link is not proof either, because friends can be deceived too.

Copies of my documents and photos of my face can help someone pretend to be me, for example to open accounts or take loans in my name, or to make another scam look trustworthy. A card can be replaced, but my face and my name cannot be changed. That is why I treat them as something I give only after I have checked, never because I am in a hurry or because a page says it is the rule.

If someone has already sent their documents, it is not too late to help. Do not pay any "activation payment" or other fee. Keep every message and screenshot. Tell your bank, using the number on your card. Report it to the police and to the official offices in your country that take reports of fraud, and ask the office that issued the document what it advises. Change any password used on the page, and watch for letters or messages about accounts, loans or purchases you do not recognise. The rules where you live may be different, and those offices can tell you what applies to you.

And the thing I most want to remember: I almost sent everything, at eleven at night, in exam weeks, tired and short of money. Being tired does not make anyone foolish. It makes everyone easier to hurry. That is why the habit of checking has to be ready before the night when I need it.

Things to Talk About as a Family

Tess stops writing here for the week. This time she was not asked for money but for her identity, and the offer came through a friend, during the most tiring weeks of the year. She stopped because one word made her ask the question in the other direction. Her classmate, who had already sent everything, did nothing wrong by believing, and did something brave by telling.

Here are a few things to ask one another. Which documents and personal details does each person in your family have, and who has a real reason to see them? If a friend shared an exciting offer in a group chat, how could you check it without making the friend feel foolish? And what times of the year, or times of day, make each of you most likely to hurry?

And one small thing to do together: make a short family list of the organisations that really need copies of your documents, such as a school, a bank or a doctor, and write next to each one how you would contact it through details you find yourselves. Then agree on one family rule: nobody sends a photo of an identity document or a selfie to verify an account without first telling one other person in the family, at any time of day or night.