How to protect your personal details and BSN: defending against spoofing and scams
Protect your personal information and keep vigilant against spoofing and scam calls by following the basic principles outlined in our article.
As an international resident in the Netherlands, you've recently obtained your BSN (personal citizen number) and are navigating the local rules, regulations, and organisations. During this learning process, it is crucial to discern whom to trust and remain vigilant against suspicious scenarios. This article will delve into the fundamental principles of securing your personal information, including your newly acquired BSN, while highlighting potential spoofing risks.
What is BSN and who is allowed to use it
Your citizen service number, better known as the BSN number, is a unique personal number issued to everyone registered in the Personal Records Database (BRP). The government uses this number to process your personal data so that you do not have to provide it over and over again to different organisations.
Some non-governmental organisations can access and request your citizen service number. For instance, healthcare providers like your doctor or dentist and education providers are legally obligated to use your BSN. Similarly, banks are required to use your BSN to exchange information with the Tax and Customs Administration.
If you are receiving childcare benefit, housing benefit or healthcare benefit, your childcare, landlord or healthcare insurer are required to request your BSN, and in the case of childcare, your child's BSN.
The BSN number is intended for contact between the government and its citizens. Organisations outside the government use it only for a specific purpose outlined in the law or if it concerns the exchange of personal data.
An organisation is not allowed to use your BSN if there is no need to record any data from you, and it should ensure that an individual is using their own number.
Which organisations have permission to make a copy of your ID?
In the Netherlands, only specific organisations are authorised to make a copy of your identification document (ID). For instance, government bodies, banks, notaries, casinos, life insurers, and your employer are permitted to do so. They must inform you of the legal obligation to copy your ID.
However, in practice, other organisations may also request a copy of your ID. It's important to note that you are not obligated to provide it to them. Sometimes, these organisations may only require a few essential details rather than a full copy. Alternatively, some companies can copy or scan your ID but must black out the photo and national identification numbers like the BSN, national insurance number, or social security number.
Remember that BSN is typically included in a Dutch passport, identity card, or driving licence. Additionally, this number is listed on various documents such as Dutch payslips, annual salary statements, health insurance cards, and health insurance policies.
Messages or calls from the government
Generally, the Dutch government or public information services such as IND, the National Police, the Ministry of Justice, and the Dutch Supreme Court, do not initiate calls in English as a primary means of communication. You will typically receive a call or message from governmental service only if you have contacted them first.
Did you receive an unexpected call or message from a company or government agency without an appointment, and you are sceptical about its authenticity? We advise you to end the call promptly and contact the organisation from which the suspicious call originated. These precautionary measures will help ensure your safety and protect against fraudulent activities.
Beware of ‘spoofing’ phone tape scams
Watch out for phone scams where the callers pretend to be officials of the IND, the National Police, the Dutch Supreme Court or the Ministry of Justice. The spoofing makes it look as if the call comes from a random Dutch (mobile) number or an official number of the government. Using this number scam organisations try and steal personal data from residents in the Netherlands.
Example: In the case of the callers pretending to be IND, the person being called sees the number of the IND’s customer information centre (+31 88 043 0430). However, in reality, these phone numbers have been ‘spoofed’.
If you answer a spoofing call, you'll hear an English-spoken tape recording with various scenarios. The fraudsters may falsely claim that your BSN number is being misused, mention an arrest warrant against you, or accuse you of engaging in criminal activities like drug trafficking or money laundering. They will prompt you to press 1 to speak to an 'agent' and verify your identity by sharing personal information. They might also urge you to transfer your money to a provided account number for 'security' purposes, resulting in financial loss if you comply.
Another tactic involves requesting you to download and install a specific program, granting the caller remote access to your computer and sensitive data. Alternatively, they may deposit money into your account and ask you to transfer it to a provided account or crypto wallet, potentially leading to bank blockage due to fraudulent transactions.
To determine the authenticity of a call, remember that it can be challenging to identify spoofed calls immediately. Exercise caution when asked for personal information. Note that the IND never calls using the client information centre on your screen, does not request money transfers, and does not adopt an aggressive tone. Avoid returning calls to unknown numbers, refrain from transferring money based on messages or calls, and do not provide information or download software when prompted by strangers.
I’ve been spoofed or scammed. What can I do?
If you’ve only provided your name, address, and the last 3 digits of your BSN, this is not enough information to cause anything fraudulent immediately. However, your information may be used by criminals to appear more convincing when approaching you in the future.
If you have received a suspicious call from someone claiming to be an IND employee, please contact the IND at +31 88 043 0430. Your report will be registered. Read more information about spoofing on the IND website.
If you have been scammed, you can report it on the Fraude Helpdesk website and to the police.
If you suspect identity fraud, contact the Centraal Meldpunt Identiteitsfraude – CMI (Central Identity Theft and Error Reporting Centre, website in Dutch) or call at +31 88 900 1000. This centre registers reports of identity fraud and supports and advises (potential) victims.
