I spent decades as a respected financial‐services entrepreneur, building my reputation and credit score from the ground up—only to have them ripped away by the very KYC safeguards I trusted most. One day, my credit‐card issuer called to say someone had rung up dozens of unauthorized charges on my account. I was stunned—but they didn’t even seem embarrassed. Instead, they grilled me for paperwork, then admitted their identity checks had glaring holes that let a fraudster slip in under my good name.
Over the next months, I chased creditors and credit‐reporting agencies through endless phone menus and document uploads. Their “rigorous” KYC processes never once flagged the criminal who opened multiple new lines of credit in my name. Meanwhile, my personal life unraveled, and I was forced into early retirement before turning 65 just to manage the fallout.
As if that weren’t enough, every few years I must now drag myself down to the local police station, present two government‐issued photo IDs, be fingerprinted, and wait days while they run my prints against six different criminal databases—to prove I’m not the “other” Ted Lee. It’s absurd: I’m treated like a suspect because these institutions can’t be bothered to secure their own onboarding.
My personal information has been scraped and sold in multiple high-profile breaches—yet each company hides behind promises of “improved security.” Here’s where my details were exposed:
Breach | When | Records Exposed | Key Details |
---|---|---|---|
Epik | September 2021 | Email, name, phone, address, purchases, passwords | Open database of millions of customer profiles |
Gravatar | October 2020 | Names, usernames, MD5 hashes of emails | Weak hashing easily reversed |
Lead Hunter | March 2020 | Emails, genders, IPs, names, phones, addresses | Mass‐marketing data breach |
MyFitnessPal | February 2018 | Emails, usernames, IPs, SHA-1 & bcrypt passwords | Poor password hashing standards |
MySpace | Circa 2008 (leaked 2016) | Emails, usernames, SHA-1 password hashes | Old credentials resurfaced years later |
Beyond identity theft lies a darker truth: when you hand over copies of your passport or SIN, you surrender control of your most sensitive data. For a deeper dive, visit our KYC Privacy Risks & Data Breaches page.
Breach | When | Records Exposed | Key Details |
---|---|---|---|
Chinese Surveillance Database | June 2025 | 4 billion | Unprotected WeChat, Alipay, banking & behavioral profiles |
CAM4 Adult-Streaming Site | March 2020 | 10.88 billion | Unsecured server exposed personal & payment data |
Yahoo | 2013–2017 | 3 billion | Account credentials, security questions, password hashes |
National Public Data Broker | August 2024 | 3 billion | Names, addresses, birthdates, phone numbers |
ICMR Aadhaar Hack (India) | 2023 | 815 million | Biometric IDs, passports, phone numbers, addresses |
Example: Mandatory digital ID programs often store biometrics in centralized repositories without transparent encryption or access logs—opening millions up to potential hacking or state misuse.
Too many companies tout “bulletproof KYC,” then drop the ball when criminals come knocking. I’m still hyper-vigilant, distrustful of any onboarding process that doesn’t demand more than just a copy of my driver’s license. If my story and these insights help you tighten your defenses—even by a fraction—it’s worth sharing.