Is this genuine? Data Protection concern.

[Wowee]

I've just taken a phone call purporting to be from the Child Maintenance Service, requesting address details for one of our employees.
I asked them to make the request in writing (as the call could have been from anyone) to be told that they can't do that. When I said I wouldn't give the info over the phone, I have been sent the following email (I've replaced the senders name with ****)

"Further to my call to your office today, this email is to confirm where I am calling from. Please be aware that by disclosing information over the phone to me you will not breach data protection, as we are a government department.

Section 35(1) of the Data Protection Act 1998 allows information to be disclosed where that disclosure is required by legislation.



Please don't reply to this message. DWP will never ask you to send any usernames, passwords, personal, health/medical or bank account information via email. Any email sent in response will be deleted without being read.




**** | Child Maintenance Service New Case Workgroup I Department for Work and Pensions I Central England CMG I Operations Directorate | 2nd Floor South I Pedmore House I Level Street I Dudley I DY5 1XA I *****@dwp.gsi.gov.uk"

I guess this looks genuine enough, and purports to come from a .gov.uk email address (although not one I can reply to apparently).
I tried to ring the Child Maintenance service, but they aren't answering their phone at the moment

 

[fisicx]

So if you can't respond to the email how are you supposed to send the information?

 

[Newchodge]

Please be aware that by disclosing information over the phone to me you will not breach data protection, as we are a government department.

That is absolute rubbish. If they ring again, ask them to give you chapter and verse of where this exemption exists in the legislation.

It may look official, but I would still refuse to give personal information over the phone, and offer it only in writing in response to a written request.

 

[fisicx]

Reading the email again it looks like someone is trying to chase a missing spouse. Have you looked at the email headers, that will give some indication as to the origin.

 

[Wowee]

So if you can't respond to the email how are you supposed to send the information?

I'm supposed to give it verbally over the phone apparently

 

[Wowee]

That is absolute rubbish. If they ring again, ask them to give you chapter and verse of where this exemption exists in the legislation.

It may look official, but I would still refuse to give personal information over the phone, and offer it only in writing in response to a written request.

Thanks that is my view. Actually the language in that email doesn't look very official, to me it seems very unprofessional.

 

[ffox]

**** | Child Maintenance Service New Case Workgroup I Department for Work and Pensions I Central England CMG I Operations Directorate | 2nd Floor South I Pedmore House I Level Street I Dudley I DY5 1XA I *****@dwp.gsi.gov.uk"

OOps. While the email link in the quoted address has had attempted redaction, the link (in the OP) has survived. Hover it and you get the senders name. Keep calling the DWP at Pedmore House until you get a reply and see if they have this person on staff.

If not, their IT department will want the original email for tracing, if he is there they may want to re-consider their personnel training.

 

[Socio South West]

Think you are dead right not to give any information. The wording of the email sounds totally dodgy as well. Check the information behind the email and see the server route and where it really originated from.

If the requirement to disclose is a legal obligation (you have only their word that it is......) they will be only too ready to put it in writing, and/or give you a checkable number that you can call back and check the identity of the caller.

Stand firm!

 

[Toby Willows]

It’s the “.gsi” in the email address that would raise a red flag for me.

Phone the DWP on their number from their website and simply ask if they are chasing someone through your company.

 

[ethical PR]

It’s the “.gsi” in the email address that would raise a red flag for me.

Phone the DWP on their number from their website and simply ask if they are chasing someone through your company.

Why Toby? it's standard for GSI to be used in many central government email addresses.

OP it sounds like you have an employee who is not paying maintenance to support their child. Have you checked the email address. From what you have said it does sound genuine.

The CMS do call people regarding contact details for those refusing to support their children. I agree they should follow up a call in writing so you know this is a valid request.

 

[Socio South West]

I can hear the conversation when @Wowee gets through to Pedmore House....
<Receptionist> Child Support Agency, Pedmore House...
<Wowee> Can you tell me if I*** R******** works there please?
<Receptionist> Sorry - not allowed to tell you - Data Protection......

 

[fisicx]

Not sure he does: https://en.wikipedia.org/wiki/Ivan_Robinson

 

[Chris Ashdown]

Just ignore it and continue with the answer for them to confirm in writing and nothing else will do

 

[Toby Willows]

Why Toby? it's standard for GSI to be used in many central government email addresses.

.

Didn’t know that. Ta

 

[fisicx]

Except they shouldn't be using GSI anymore:

https://www.gov.uk/guidance/set-up-government-email-services-securely

Which suggests it's a made up email address.

 

[ffox]

Neither do DWP list a DY5 1XA address. -
https://assets.publishing.service.g...data/file/574585/new-dwp-postal-addresses.pdf
And search for Dudley.

That may be due to published data being behind the times, but it adds to the suspicion.

 

[Toby Willows]

Except they shouldn't be using GSI anymore:

https://www.gov.uk/guidance/set-up-government-email-services-securely

Which suggests it's a made up email address.

Looked it up and it seems to me it’s used internally over a intranet network (are they still used?).

 

[Wowee]

Well, he's rung again, and I've told him our data protection policy doesn't allow me to give the information over the phone, but we will happily reply to an official request in writing. He sighed deeply, said "oh, ok then" and put the phone down

 

[Wowee]

I do think it's pretty poor that calls to the Child Support Agency employer helpline as listed on www.gov.uk don't get answered. I rang 3 times between 9:20 and 10:00 a.m. and just got an automated answer that they were unable to take calls at present, office hours are 8:00 a.m. to 7:30 p.m. Mon-Fri. ¯\_(ツ)_/¯

 

[Newchodge]

Well, he's rung again, and I've told him our data protection policy doesn't allow me to give the information over the phone, but we will happily reply to an official request in writing. He sighed deeply, said "oh, ok then" and put the phone down

Then it probably is genuine, but he didn't want to go to the bother of writing a letter!

 

[Mr R]

Make sure you can tie the address on any letter you receive for a genuine office in a verifiable government office. - Check this via a .gov.uk website. Then phone the number you get from the website to verify the letter is real!

It sounds paranoid I know; but there is a 'market' for the minute detail of people's lives - things like NI numbers, children's dates of birth etc. The sort of thing that can be used for identity theft (think of the sort of thing you're asked to set up as a 'security question'). And of course, these days the internet is riddled with nutjobs looking to 'dox' or otherwise troll others.

 

[Mr R]

Google the postcode and you'll discover...... "Child Support Agency, Pedmore House, The Waterfront, Level Street, BRIERLEY HILL"

However, the CSA was replaced by the Child Maintenance Service in 2012. Google "Child Maintenance Service" together with the postcode and you draw a blank... I smell fish!