How a company in India can misuse my PAN number and its scanned copy that I provided as an interview candidate?
There is a possibility of misuse. Hence it should be shared judiciously. Sharing it with large / trusted organization reduces the risk as there would be right process / controls in place. Broadly these days PAN and other details are shared for quite a few transactions, say applying for a Credit Card, Opening Bank Account, Taking a Phone connection etc. In most of the cases the application is filled out and processed by 3rd party rather than the service provider directly.  Creating Fake Employee records is a possibility so is the misuse to create a fake Bank account in your name and transact in that account. Since one cannot totally avoid sharing PAN details to multiple parties... It helps to stay vigilant by monitoring the Form 26AS from the Govt website. Any large cash transactions / additional salary / or other noteworthy transactions are shown here. It would also help to monitor your CIBIL reports that show all the Credit Card and other details under your name.
I work in IT for eBay/PayPal. Many, if not all, got exited today. Real quick and ninja-esque. HR is really being a dick to them too. Several have personal phone numbers that were assigned to their corporate phones, and they're being told they can't have them back. Definitely sounds like scam. Odds are are high that the page he gave you the link to is a fake and this app is pure identity theft. Run away, unless you are interested enough to do the work to check with the company and confirm this is legitimate.  Nobody contacts strangers with this kind of story without it being a scam. The fact that this one sounds shady is an attempt to keep you from questioning it too closely. Think about it: if it was at all legitimate, couldn't he find a friend of a friend? If it sounds too good to be true, it ain't true. Never download software unless you know exactly where it is coming from. It could be anything from ransomware, to something that first steals all you financial info, then uss you mail account to send a similar pitch to all your friends, to a botnet that uses your machine to attack other machines. In Finland, this happens all the time - it's all about having an official ID, they don't even ask your bank account number or the card. However, as no location was specified in the question, I guess it could be anything. The stronger the requirement for official personal id is in your country, the better odds you have with just using that. Where I live it is quite strong. Recently, over 11 lakh PAN cards has been deactivated by the Income Tax Department to fetch out fake and duplicate PANs. The main targets are the individuals who are having multiple PAN cards and those with PAN cards issued under fake documents. Blocking fake PAN cards can help the government restrain identity theft and purchase of benami properties. "EDIT: TLDR I Can promise you they will lose sight again because it was never regained in the first place. They aren't the first company to do it [and it wont be the last time.](https://www.youtube.com/watch?v=5ypUz1WYens)   The company I work for (Office Depot) is doing this practice. We have insane goals that no one can reach, and often more daily responsibilities than an individual can finish. When anyone tries to speak up against it at any level the reply is ""we dont want excuses"" or ""dont be negative"". Completely ignoring any issues presented to them. Instead rather than problem solving those who bring issues to light are treated as having created the problem.  We (the company) [got in trouble a while back for our ""PC Tune Up""](https://www.youtube.com/watch?v=6cEfYibkHjM) because the tool didn't accurately portray the condition of a customers system. If you ran the tool it would ask ""do you have x or y symptoms (pop ups, slow, etc)"" and if you selected yes it would tell you that it found possible infection symptoms. It didn't make it clear that the scan didn't detect this. They then paired this with techs that weren't trained in any way other than selling using the tools diagnosis and unrealistic sales goals. When you couldn't reach numbers you were eventually replaced. If the store didn't reach numbers it came down on management (who would fake numbers by returning items and reselling them as service sku's). Every tech I knew complained about the awful diagnostic tool, and the unrealistic goals and what they were causing. Many of us refused to use the tool on the grounds of it being misleading and immoral, depot responded by requiring a minimum amount of logged uses of the tool per week. Depot did nothing but treat it as negativity until it was brought up in the news after a disgruntled tech let the word out. Then suddenly it's ""were sorry"" acting like they had no idea what was going on and  the roll out of a new tool that simply had a remote technician give the same diagnostic. (which has since changed again). We still have the same push for sales goals and attach rate (push for office, service, and square trade sales) and zero accountability. They train no one, create goals, and act surprised when they figure out how people are meeting these goals.  Nothing has actually changed in a relevant way, the same core problem still exists they've only changed the face.  These issues are prevalent in the company as we have minimal payroll for staffing at all times and high expectations with poor tools across the board. I've watched many people get fired for not meeting goal expectations and many more quit. I've watched the people who could meet the goals praised only to be fired a short time later when it's found they only met the goal through cheating of some sort.   Every single strategy corporate tries has still followed this same format of over promise and under deliver. They pile more on while cutting resources constantly and they still haven't learned the lesson that the result is the same every time regardless of game plan. The best part is the higher ups all switch out every 3 - 6 months it seems. I've had at least 4 District managers in the short time i've been here, multiple RVP's and LP's. Everyone comes in for 6 months then jumps ship to somewhere more stable. Meanwhile we cut costs to appear more profitable.   The whole retail side of the company is a sham." My understanding of this would be that this is for the portion of the subsidiary which they do not own. In other words they record 100% of the subsidiary on their books and then make this entry to account for the % which another company has a minority interest in. "These people are pretty off. Insider trading cases, outside of a tender offer context, require some sort of a breach of duty. It's not simply ""non-public material information"". You have to trade securities in interstate, based on or while in possession of the material non-public information, and in doing so is a breach of duty owed to the company or to the information source.  Now simply saying ""personal info"" about an executive does not tell me much about its materiality. So assuming it passes the materiality test, and assuming you yourself aren't a corporate insider, then the only thing left to discuss is whether or not it is misappropriation. To be misappropriation you need to be breaching some duty owed to your information source. Now this isn't just principal-agent duty, this can extend to friends and family if there is a pattern of keeping confidences. So unless you're this guys brother or doctor there really isn't a strong claim against you." Believe it or not, what they're asking you is not as unusual as you might think.  Our company sells a tremendous amount of expensive merchandise over the Internet, and whenever there's something odd or suspicious about the transaction, we may ask the customer to provide a picture of the card simply to prove they have physical possession of it.  This is more reassurance to us (to the extent that's possible) that the customer isn't using a stolen card number to order stuff.   It doesn't help too much, but if the charge is disputed, at least we have something to show we made reasonable efforts to verify the ownership of the card.   I think it's pretty thin, but that's what my employer does. you *can* get the guys in india for pennies on the dollar, but then you get what you pay for. I was told on upwork that I didn't get picked because I was too expensive, but then he went on to say that their proposals are usually garbage and wanted to pay me a little to look them over and make sure they weren't full of shit.  Upwork should be called UpOffShoring.  wtf? "This information is clearly ""material"" (large impact) and ""non-public"" according to the statement of the problem.  Also, decisions like United States v. Carpenter make it clear that you do not need to be a member of the company to do illegal insider trading on its stock. Importantly though, stackexchange is not a place for legal advice and this answer should not be construed as such.  Legal/compliance at Company A would be a good place to start asking questions." Is all data in the company equally sensitive? Does everyone in the company have equal access to this type of sensitive information that would cost a company 'billions of dollars in fines' or is your argument that any work product of any employee in the company could result in such fines? Can you provide an example of any company ever paying a fine of such magnitude? If not what is the basis for your estimation of that number?  Ok I'll take the stealth edit to mean you pulled it out of your ass which I already knew. Oh man. That's awful. Thank you for sharing this.   Hey, I'm writing a larger piece on some of the challenges we face today, and both data overload and data legitimacy are a part of it.   It would be great to have someone inside the industry to talk to about this. When I get there do you mind if I reach out to you so I can learn more? You seem overly fixated on dead tree documentation of purchases.  They are deducting this from your account monthly - the mere fact that the money was taken is enough to prove in court that they have you on their books and to hold them to paying out said insurance.  The email copies is actually a better way to organize receipts in most cases (can't be destroyed as easily, etc.) You can cancel the insurance - but don't just stop paying (you'd owe them money then).  I foresee increasing difficulty navigating the 21st century for you unless you can get past this concern about physical receipts.  I doubt other companies would do much better. FWIW, I live in the continental US.  I don't know how different the Philippines is with regard to moving everything to digital "This question has the [united kingdom] tag, so the information about USA or other law and procedures is probably only of tangential use. Except for understanding that no, this is not something to ignore. It may well indicate someone trying to use your id fraudulently, or some other sort of data-processing foul-up that may adversely impact your credit rating. The first thing I would do is phone the credit card company that sent the letter to inform them that I did not make his application, and ask firmly but politely to speak to their fraud team. I would hope that they would be helpful. It's in their interests as well as yours. (Added later) By the way, do not trust anything written on the letter. It may be a fake letter trying to lure or panic you into some other sort of scam, such as closing your ""compromised"" bank account and transferring the money in it to the ""fraud team"" for ""safety"". (Yes, it sounds stupid, but con-men are experts at what they do, and even finance industry professionals have fallen victim to such scams) So find a telephone number for that credit card company independently, for example Google, and then call that number. If it's the wrong department they'll be able to transfer you internally. If the card company is unhelpful, you have certain legal rights that do not cost much if anything. This credit company is obliged to tell you as an absolute minimum, which credit reference agencies they used when deciding to decline ""your"" application. Yes, you did not make it, but it was in your name and affected your credit rating. There are three main credit rating agencies, and whether or not the bank used them, I would spend the statutory £2 fee (if necessary) with each of them to obtain your statutory credit report, which basically is all data that they hold about you. They are obliged to correct anything which is inaccurate, and you have an absolute right to attach a note to your file explaining, for example, that you allege entries x,y, and z were fraudulently caused by an unknown third party trying to steal your ID. (They may be factually correct, e.g. ""Credit search on "", so it's possible that you cannot have them removed, and it may not be in your interests to have them removed, but you certainly want them flagged as unauthorized).  If you think the fraudster may be known to you, you can also use the Data Protection Act on the company which write to you, requiring them to send you a copy of all data allegedly concerning yourself which it holds. AFAIR this costs £10. In particular you will require sight of the application and signature, if it was made on paper, and the IP address details, if it was made electronically, as well as all the data content and subsequent communications. You may recognise the handwriting, but even if not, you then have documentary evidence that it is not yours. As for the IP address, you can deduce the internet service provider and then use the Data Protection act on them. They may decline to give any details if the fraudster used his own credentials, in which case again you have documentary evidence that it was not you ... and something to give the police and bank fraud investigators if they get interested. I suspect they won't be very interested, if all you uncover is  fraudulent applications that were declined. However, you may uncover a successful fraud, i.e. a live card in your name being used by a criminal, or a store or phone credit agreement. In which case obviously get in touch with that company a.s.a.p. to get it shut down and to get the authorities involved in dealing with the crime. In general, write down everything you are told, including phone contact names, and keep it. Confirm anything that you have agreed in writing, and keep copies of the letters you write and of course, the replies you receive. You shouldn't need any lawyer. The UK credit law puts the onus very much on the credit card company to prove that you owe it money, and if a random stranger has stolen your id, it won't be able to do that. In fact, it's most unlikely that it will even try, unless you have a criminal record or a record of financial delinquency. But it may be an awful lot of aggravation for years to come, if somebody has successfully stolen your ID. So even if the first lot of credit reference agency print-outs look ""clean"", check again in about six weeks time and yet again  in maybe 3 months. Finally there is a scheme that you can join if you have been a victim of ID theft. I've forgotten its name but you will probably be told about it. Baically, your credit reference files will be tagged at your request with a requirement for extra precautions to be taken. This should not affect your credit rating but might make obtaining credit more hassle (for example, requests for additional ID before your account is opened after the approval process). Oh, and post a letter to yourself pdq. It's not unknown for fraudsters to persuade the Post Office to redirect all your mail to their address!" The only way I've seen mezz work for more than one cycle is the hard money model.   Stay away from glory assets.  Maturities of a year or two max.  Have the stomach and wherewithal to foreclose quickly when the borrower defaults.  Keep the (C)LTV under 70, where the V is not aspirational.  Unitranche is generally better because it simplifies and, therefore, expedites things.    All that requires sitting on dry powder while your competitors are busy and then it will cost you relationships in your other funds/divisions when you ramp up. This is why most lenders succumb: they tie their managers' careers to the short term, which, to be fair, is much easier to measure.  This also applies the broader mezz market beyond RE.