PRIVACY AND IDENTITY THEFT 2003:

Transcription

1 PRIVACY AND IDENTITY THEFT 2003: Where Are We Now And Where Are We Going.... Huggins v. CitiBank: A Case Study Stephen P. Groves, Sr., Esquire 205 King Street, Suite 400 Charleston, South Carolina 29401

2 New FTC Revelations Released September 3, 2003 Howard Beales, FTC Director of Consumer Protection Program announced: More than 27 million Americans have been victims of identity theft in the past five years Almost 10 million people were victims of identity theft in 2002

3 Almost $50 billion in losses to business, including financial institutions, in 2002 New Accounts/Other Frauds - $33 billion Existing Credit Card Accounts - $10 billion Existing Other Accounts - $7 Billion

4 Average Cost In Time And $$$ To Consumers $1, out-of-pocket per victim 30 (existing accounts) to 60 (new accounts) hours attempting to correct inaccurate information 300 million hours in 2002

5 FTC Complaints: % involved credit card fraud 22% involved telephone or utility fraud 17% involved bank fraud

6 What Is Identity Theft? Identity theft occurs when a person steals another person's name, address, social security number, or other identifying information in order to commit fraud.

7 Common Ways Thieves Obtain Personal Information From Businesses/Institutions: Stealing records from their employer Bribing an employee who has access to the records conning information out of employees, or hacking into the organization's computers

8 Obtaining Info..... Rummage through individual s trash, the trash of businesses, or dumps in a practice known as "dumpster diving" Illegally obtain credit reports by abusing their employer's authorized access to credit reports or by posing as a landlord, employer, and/or someone with a legitimate need for/legal right to the information

9 Obtaining Info.... Steal credit/debit card account numbers as a card is processed by "skimming ; Steal wallets and purses; Steal mail (bank/credit card statements, pre-approved credit offers, new checks, and/or tax information);

10 Obtaining Info.... Complete a "change of address form" to divert mail to another location; Steal personal information directly from an individual s home; and Scam info. from an individual by posing as a legitimate business person and/or government official.

11 Huggins v. Citibank John Doe obtained personal information about the victim; John Doe individual identified himself as P. Kenneth Huggins, Sr. to credit card companies; Several companies issued credit cards to John Doe; John Doe used cards to purchase goods, make cash advances, and cash withdrawals;

12 Huggins v. Citibank John Doe ignored credit card invoices Mr. Huggins contacted by credit card companies when payments not made; Mr. Huggins credit damaged

13 Huggins v. Citibank Mr. Huggins sued credit card companies in Federal Court Question certified to SC Supreme Court Seeking to create a new cause of action : Negligent Enablement Of Imposter Fraud

14 Mr. Huggins Arguments the financial institutions were, as a matter of public policy, responsible for any damages caused to him by John Doe because the financial institutions were the issuer of the credit cards and, in turn, were in the best position to ensure that John Doe should not have been able to obtain the credit card ;

15 Arguments (continued) Even if the financial institutions did nothing wrong, they should bear the loss since they issued the credit card to John Doe; and Fact John Doe committed a crime by obtaining the credit card was immaterial since the financial institutions could have reasonably foreseen and anticipated his actions and their result

16 Supreme Court s View Of Issues: Issuing the credit cards without any investigation, verification, or corroboration of [John] Doe's identity.... Failing to adopt policies reasonably designed to verify the identity of credit card applicants....

17 Supreme Court s View: Adopting policies designed to result in the issuance of credit cards without verifying the identity of applicants.... Attempting to collect [John] Doe's debt from [Mr.] Huggins.

18 Negligence Claim 1) a duty of care owed by the defendant to the plaintiff 2) a breach of that duty by negligent act or omission, and 3) damage proximately caused by the breach.

19 Critical Element Existence of legal duty; Owed by defendant to plaintiff; Without duty there is no claim; Duty arises from a relationship recognized by law between the parties; Mere foreseeability of injury insufficient.

20 Court Recognizes: Greatly concerned about the rampant growth of identity theft and financial fraud in this country [and recognized] certain that some identity theft could be prevented if credit card issuers carefully scrutinized credit card applications.

21 Supreme Court s Position: The relationship, if any, between credit card issuers and potential victims of identity theft [was] far too attenuated to rise to the level of a duty between them.

22 Polzer v. TRW, Inc. New York Appellate Division the defendant credit card issuers had no relationship either with the imposter who stole the plaintiffs' credit information and fraudulently obtained credit cards, or with plaintiffs, with whom they stood simply in a creditor/debtor relationship.

23 Legislation Is The Answer We note that various state and national legislation provides at least some remedy for victims of credit card fraud.... While these regulations may not fully compensate victims of identity theft for all of their injury, we conclude the legislative arena is better equipped to assess and address the impact of credit card fraud on victims and financial institutions alike.

24 SC Criminal Laws Forgery: S.C. Code Ann Various Larcenies: S.C. Code Ann (credit card larceny), 230 (breach of trust with fraudulent intent); (obtaining signature/property by false pretenses) Financial Transaction Card Crime Act S.C. Code Ann , et. seq.

25 Personal Financial Security Act S.C. Code Ann , et. seq. guilty of financial identity fraud when he, without authorization or permission of another person and with the intent of unlawfully appropriating the financial resources of that person to his own use or the use of a third party....

26 Personal Financial Security Act Obtains or records identifying information which would assist in accessing the financial records of the other person. Accesses or attempts to access the financial resources of the other person through the use of identifying information.

27 Personal Financial Security Act social security numbers; driver's license numbers; checking account numbers; savings account numbers; credit card numbers; debit card numbers; personal identification numbers; electronic identification numbers; digital signatures; or other numbers or information which may be used to access a person's financial resources.

28 Personal Financial Security Act Felony crime Punishable by imprisonment up to 10 years; Possible fine; and Restitution may be ordered

29 Consumer Identity Theft Protection Act Senate Bill 222 Currently pending in House Labor Commerce, and Industry Committee New stringent verification requirements on credit card issuers

30 Consumer Identity Theft Protection Act A credit card issuer which mails an offer or solicitation to receive a credit card and receives a completed application listing an address that is substantially different from the address on the offer or solicitation shall verify the change of address by contacting the person to whom the solicitation or offer was mailed, or by using other reasonable means of verifying the account holder s identity

31 Consumer Identity Theft Protection Act Person in whose name credit card issued is not liable for the unauthorized use of a credit card issued in response to that offer or solicitation if the credit card issuer does not verify the change of address

32 Consumer Identity Theft Protection Act Expedited judicially clearing of an identity theft victim s name when the identity thief is convicted or the victim s name is associated with a criminal conviction record Requires SLED to create an identity theft victim database available solely to the victim and law enforcement agencies

33 Federal Laws Identity Theft and Assumption Deterrence Act of U.S.C Knowing make false identification Knowingly transfers false identification document Knowingly possess equipment used to make false identification documents

34 Federal Laws Identity Theft and Assumption Deterrence Act of 1998 knowingly illegally transfer or use a means of identification of another Knowingly traffic in false identification documents Intent is key element 1 to 25 years imprisionment

35 USA Patriot Act Congress has required financial institutions to enhance their identification and verification of accountholders Minimum Verification Requirements

36 USA Patriot Act verifying the identity of any person seeking to open an account to the extent reasonable and practicable; maintaining records of the information used to verify a person's identity, including name, address, and other identifying information; and consulting lists of known/suspected terrorists/terrorist organizations provided to the financial institution by any government agency to determine whether a person seeking to open an account appears on any such list.

37 USA Patriot Act law enforcement s enhanced ability to intercept wire, oral, and electronic communications relating to computer fraud and abuse offenses sharing of electronic, wire, and/or oral interception information anti-money laundering provisions

38 Federal Laws - Civil Fair Credit Reporting Act 15 U.S.C. 1681, et. seq. Fair Debt Collection Practices Act 15 U.S.C. 1692, et. seq. USA Patriot Act Fair and Accurate Credit Transaction Act of 2003 Passed by US House on Sept. 10

39 FATCA 2003: Amending FCRA Sec. 605 (g) INVESTIGATION OF CHANGES OF ADDRESS. If a credit card issuer receives a request for an additional credit card with respect to an existing credit card account within 30 days after receiving notification of a change of address for that account, the card issuer shall--

40 FACTA 2003 (1) notify the cardholder of the request-- (A) at both the new address and the former address of the cardholder; or (B) by such other means of communication as the cardholder and the credit card issuer previously agreed to, in accordance with reasonable policies and procedures established by the card issuer pursuant to regulations which the Board shall prescribe; and (2) provide to the cardholder a means of promptly reporting incorrect changes.

41 FACTA 2003: Amending FCRA Sec. 605 (k) RED FLAG GUIDELINES REQUIRED. The Federal banking agencies shall jointly establish and maintain guidelines for use by insured depository institutions in identifying patterns, practices, and specific forms of activity that indicate the possible existence of identity theft, and update such guidelines as often as necessary.

42 Conclusion The battleground for consumers redress for identity theft in this State will be in the Legislature and not the Courts. Legislation is currently pending in both the SC House and Congress to impose more responsibilities upon financial institutions for combating identity theft. Only time will tell how successful those attempts are.

43

44

45