**EE KB - EE/Social/Community PII- Impersonation Process

Personal information is either personally identifiable information (PII), or sensitive personal information (SPI), this is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Reports of PII will be addressed if the person reporting the issue is the individual owning the PII. These should be removed immediately without first running it by legal.

     Cases such as these can include but are not limited to the following: 

          Impersonation

• Clients/Freelancers using company names that are not their own or presenting themselves as someone else
• A profile picture that belongs to the person contacting Upwork 

          PII Disclosure

• A user’s post or profile contains the name, address, email address, login credentials (user name and password), financial account information, photo or similar information about a person who is not the owner of the account

Impersonation

     Reports Via Social Media or Community 

        EE

              1. Locate Upwork profile in OBO

              2. Change visibility to restricted

              3. Lockout as malicious account with these CSS notes:

[ACTION] Security Lockout / Permanent Suspension
[DEPARTMENT] EE
[CAUSE] Impersonation of verified Twitter user
[DETAILS] escalation received through social media
[NEXT STEP] Reassign related tickets to EE 

4. Send an IDV request through Zendesk to reported profile. Solve it. If no response is received, no further action needed. If user responds, then we will investigate further with Identity Ops. 

     After IDV request 

• If account fails IDV, the account should be permanently closed (if the account has any contracts with Enterprise accounts, please reach out to Legal first).
• If the account owner passes IDV, then remove the account hold and respond to the original complainant with the following:

It appears that the account owner has the <<__same name or the same company name__>>  as <<__your name or your company name__>>. As you may know, Upwork has many registered users and it is not uncommon for users to have the same or similar names. 

     Reported Via EE or a ticket

If you receive a report via a ticket or email that a profile is using the name or photo of third party, you should:

1. Locate Upwork profile in OBO

2. Change visibility to restricted

3. Lockout as malicious account with these CSS notes:

[ACTION] Security Lockout / Permanent Suspension

[DEPARTMENT] EE

[CAUSE] Impersonation of verified Twitter user

[DETAILS] escalation received through social media

[NEXT STEP] Reassign related tickets to EE 

4. Send an IDV request through Zendesk to reported profile. Solve it. If no response is received, no further action needed. If user responds, then we will investigate further with Identity Ops. 

     After IDV request 

• If account fails IDV, the account should be permanently closed (if the account has any contracts with Enterprise accounts, please reach out to Legal first).
• If the account owner passes IDV, then remove the account hold and respond to the original complainant with the following:

It appears that the account owner has the <<__same name or the same company name__>>  as <<__your name or your company name__>>. As you may know, Upwork has many registered users and it is not uncommon for users to have the same or similar names. 

PII Disclosure

A user’s post or profile contains the name, address, email address, login credentials (user name and password), financial account information, photo or similar information about a person who is not the owner of the account.

EE

1. Locate Upwork profile in OBO

2. Change visibility to restricted if a profile. If a job post, change to private with these CSS notes:

[ACTION] Profile or job post changed to private 

[DEPARTMENT] EE

[CAUSE] PII Investigation

[INTERNAL NOTES] Upon resolution of issue, profile will be set back to public. 

Future infractions may lead to perm suspension

3. Send following to the profile owner: 

We received a report that your posting or profile contains personal information concerning another person.  While we investigate this, we have hidden your <<___profile or post___>>. 

It is a violation of the Upwork Terms of Service to disclose private or confidential information concerning another person on publicly viewable areas of the site.  We take violations of this nature very seriously. Please <<___Title of content to be removed___>>, and respond to this email within 48 hours confirming that the content has been removed and you will comply with this requirement going forward.

Thank you in advance for your cooperation.

If user resolves issue and removes content without rebuttal

1. Set account back to public

2. Thank user and remind that future infractions of this nature may lead to permanent suspension