How Consumers can Protect Against Identity Fraudsters in 2013

Transcription

1 How Consumers can Protect Against Identity Fraudsters in 2013 February 2013

2 2 FORWARD Javelin Strategy and Research s How Consumers can Protect Against Identity Fraudsters in 2013 provides recommendations to help consumers prevent, detect, and resolve identity fraud. This report provides easy tofollow guidelines for consumers to protect themselves against this $21 billion crime of identity fraud. Javelin Strategy & Research s goal is to equip consumers with proven methods to prevent, detect, and resolve identity fraud. A deeper analysis of economic indicators and identity fraud trends is available for purchase in the full version of the 2013 Identity Fraud Report, along with a detailed breakdown of how different economic factors, payment purchasing trends, and security dynamics correlate with changes in identity fraud. Now in its tenth consecutive year, the comprehensive analysis of identity fraud trends is independently produced by Javelin Strategy & Research, a division of Greenwich Associates. Javelin maintains complete independence in its data collection, findings, and analysis; the report is a product of Javelin only Identity Fraud Report: Data Breaches Becoming a Treasure Trove for Fraudsters Learn More: com/brochure/276 The full report consists of: 82 pages 56 graphs and tables. An overview of the key findings New trends Quantitative cross tabulations Longitudinal U.S. identity fraud data from This research study is made possible by our sponsors, Intersections and Citigroup. These companies are dedicated to consumer fraud prevention and education

3 3 TABLE OF CONTENTS OVERVIEW... 4 Identity Fraud vs. Identity Theft... 6 How Criminals Obtain Information RECOMMENDATIONS FOR CONSUMERS CONSUMER PROTECTION CHECKLIST PREVENTION How Can I Prevent Identity Fraud? Data Breach Notification Letters What Should I Do If I Receive a Breach Notification Letter? DETECTION How Can I Detect Identity Fraud? RESOLUTION What Should I Do If I Become a Victim of Identity Fraud? Identity Fraud Protection Solutions ABOUT JAVELIN METHODOLOGY ADDITIONAL RESOURCES GLOSSARY OF TERMS TABLE OF FIGURES Figure 1: Overall Identity Fraud Incidence Rate and Total Fraud Amount by Year... 4 Figure 2: Fraud Incidence by Data Breach Victims, Non Data Breach Victims, and All Fraud Victims... 7 Figure 3: Fraud Incidence by Ownership of Technology Products... 9 Figure 4: How Theft of Personal Information Happens Figure 5: Javelin s Prevention, Detection, and Resolution Identity Fraud Model Figure 6: Data Breaches Are at an All Time High Figure 7: How to Contact the Three Credit Bureaus Figure 8: Methods of Detection, Figure 9: Identity Fraud Protection Services... 26

4 4 OVERVIEW For the second consecutive year, the number of identity fraud victims in the U.S. increased, rising by 1 million consumers in 2012 to a total of 12.6 million consumers. This means that 5.26% of U.S. adults, or more than 1 in every 20 consumers, learned that they were victims of identity fraud in New Account Fraud: the use of a fraud victim's personal information to open fraudulent new accounts in the victim s name. Identity Fraud Is on the Rise Figure 1: Overall Identity Fraud Incidence Rate and Total Fraud Amount by Year Millions of victims $ $ $ $ $ $ $ $ Millions of victims $50 $45 $40 $35 $30 $25 $20 $15 $10 $5 $0 Billions U.S. Total one year fraud amount October 2012, n= varies: 4,784 5,249 Base: All Consumers 2013 Javelin Strategy & Research Account Takeover Fraud: the method of identity fraud in which a fraud operator attempts to gain access to a consumer s account by fraudulently adding his or her information to the account. Annual overall fraud amounts (the amount of money stolen by fraud perpetrators) also rose in 2012, increasing to $20.9 billion and reversing improvements made in 2010 and This increase in fraud amounts was driven by dramatic jumps in the two most severe fraud types: Newaccount fraud (NAF) and account takeover fraud (ATF). Traditionally, newaccount fraud and account takeover fraud have been experienced by a

5 5 lower proportion of fraud victims, but these two types of fraud consistently produce the highest average fraud amounts and consumer costs. So while there are fewer victims of these two types of fraud, they feel the sting the most. Average consumer costs rose slightly to $365 in 2012, up from $354 in Consumer costs are any out of pocket expenses suffered by the fraud victim, including unreimbursed monetary losses, and lost wages as a result of time spent to resolve the fraud as well as any related legal costs and credit monitoring costs. However, of the 12.6 million victims in 2012, 80% did not suffer any consumer costs (median out of pocket costs to consumers of $0) at all. These costs were instead absorbed by banks and credit card companies through their zero liability policies and coverage, which shield consumers from most of the costs associated with fraud. Consumers also spent relatively little time resolving their fraud cases. The average resolution time remains unchanged at 12 hours, but more than half of all victims spent three hours or less resolving fraud incidents with their providers. The expansion of zero liability policies, security protections, and dedicated fraud and claims teams at financial institutions (FIs) and card issuers have expedited the resolution process in cases of fraud and have helped lower consumers costs over the last decade. Zero-Liability Policies: Zeroliability policies are fraud protection programs that banks or credit card providers offer to protect consumers from losses associated with fraud on their payment cards (credit, debit, or prepaid) or other financial accounts.

6 6 IDENTITY FRAUD VS. IDENTITY THEFT Most individuals are familiar with the term identity theft, which is widely used by media, government, and consumer groups, as well as nonprofit organizations. However, it is important to distinguish between identity theft and identity fraud because the terms have different meanings, although Javelin uses identity fraud more commonly throughout the identity fraud survey and corresponding reports. Identity theft occurs after the exposure of personal information; typically someone s personal information is taken by another individual without explicit permission. Identity fraud is the actual misuse of information for financial gain; it occurs when criminals use illegally obtained personal information to make purchases or withdrawals, create false accounts or modify existing ones, or attempt to obtain services such as employment or health care. Personally identifiable information (PII) such as a Social Security number (SSN), a bank or credit card account number, a password, a telephone calling card number, a birthdate (month/date/year), a name, or an address can be used by criminals to profit at a victim s expense. By accessing and using relatively basic information, a criminal can take over existing financial accounts (existing card fraud or existing non card fraud) or use a victim s personal information to create new accounts (new account fraud). A criminal can commit identity fraud numerous ways, including: making an unauthorized withdrawal of funds from an account, making fraudulent purchases with a credit card, and creating new accounts (e.g., banking, telephone, utilities, and loans). All of them can have a damaging effect on an individual s credit. In fact, the first notification that fraud has been committed might be the appearance of an unfamiliar account on a credit report or a contact from a debt collector.

7 7 Consumer Information Exposed in Data Breaches Leads to Fraud Consumers should pay particularly close attention to any notifications or letters they receive from their FIs, credit card providers, health care providers or merchants regarding a breach in personally identifiable information. Almost 1 in 4 consumers who received a data breach notification in 2012 became a fraud victim. Of particular concern is that consumers who were notified that their Social Security numbers were compromised in one of these data breach incidents were 5 times more likely to be a victim of identity fraud than all other consumers and 14 times more likely to become a victim of new account fraud. As discussed previously, new account fraud victims suffer above average fraud losses and consumer costs. Fraud Rate Among Data Breach Victims Outpaces Fraud Rates Among All Consumers Figure 2: Fraud Incidence by Data Breach Victims, Non Data Breach Victims, and All Fraud Victims 25% 22.5% 20% 18.9% 15% 10% 5% 4.4% 1.4% 11.8% 4.9% 5.3% 2.4% 2.9% All consumers Non data breach victims Data breach victims 0% Q2. In the past 12 months, have you been notified by a business or other institution that your personal or financial information has been lost, stolen, or compromised in a data breach? October , n = varies 337 5,249 Base: All consumers, data breach victims, non data breach victims Javelin Strategy & Research

8 8 Online Retail Shopping Is Becoming More Lucrative to Fraudsters As online shopping expands, so too does the misuse of consumer information to commit online retail fraud. Online retail fraud occurs when a perpetrator uses online payment credentials, such as a credit or debit card account number, to make fraudulent purchases online (known in the industry as card not present (CNP) purchases). Online retail fraud increased from 41% of all fraud victims in 2011 to 45% in Payment cards, such as credit cards and debit cards, represent 95% of the misused information in these cases. Online retail fraud through CNP transactions is the least expensive fraud type for consumers in 2012, with an average consumer cost of $326. However, it is also highly pervasive in the U.S., affecting 7.5 million Americans, who then spend an average of 11 hours resolving these cases. Consumers should take the time to review their statements each month for fraudulent charges and contact their FIs and card providers for useful online authentication and security options. Rising online sales lead to increase in online fraud Malware Attacks Mobile Consumers and Puts Them at Constant Risk of Fraud The 105 million smartphone users and 42 million tablet users in the U.S. are constant targets for fraudsters, who use malware, exploit software vulnerabilities, launch phishing and smishing attacks, and compromise unsecured Wi Fi connections to obtain users valuable personal information. Tablet users are more likely to be victims of fraud than all consumers (9.6% compared with 5.3%), which can be attributed both to tablet users being younger and less risk averse than older consumers and the inherent security vulnerabilities that are typical of new technologies.

9 9 Tablet Owners Are 80% More Likely Than All Other Consumers to Become Fraud Victims Figure 3: Fraud Incidence by Ownership of Technology Products Fraud incidence rate 15% 14% 13% 12% 11% 10% 9% 8% 7% 6% 5% 4% 3% 2% 1% 0% 5.3% All consumers 5.6% Mobile phone owners 6.0% Laptop owners 6.3% 6.5% Desktop computer owners Smartphone owners 9.6% Tablet owners Q39A: Please indicate which of the following products you personally own and use. Q5: How long ago did you discover that your personal or financial information had been misused? October 2012, n = varies 1,062 to 5,249. Base: All consumers, owners of various products Javelin Strategy & Research Additionally, for the nearly 211 million Americans who regularly use online banking, malware poses an increasing threat as an avenue for compromising and gaining control of users accounts. Fraudsters stole $4.9 billion in 2012 from consumer accounts through account takeover schemes. Malware poses a direct threat to consumers, businesses, and FIs alike, because these malicious programs seek to infect various device types and compromise the type of consumer financial account information and credentials necessary to commit fraud.

10 10 How Criminals Obtain Information Many identity thefts occur through traditional methods such as stolen wallets and familiar frauds, in which a person known to the victim has access to the victim s statements or other legal documents. Identity theft occurrences are often the result of simple lost or stolen information and not necessarily through hacking or elaborate Internet schemes, although online and mobile threats remain viable sources of information. Figure 4 shows some of the many ways that identity theft can occur. Identity Theft Occurs Through Various Methods Figure 4: How Theft of Personal Information Happens AT HOME: Through information left out in the home (or at work) and stolen by family or friends WHILE YOU ARE OUT: By means of a lost or stolen wallet or purse Through dumpster diving by crooks looking for unshredded paperwork that contains personal or financial information Through theft of your mail from your mailbox or diversion of your mail by a fraudster who changes the address to obtain your account statements Through shoulder surfing, in which someone obtains personal information by looking over your shoulder By card skimming, when someone illegally records an imprint of your credit or debit card information for later use THROUGH A BUSINESS YOU USE: BY TRICKERY OR PRETENSE: Through a security data breach, Through phishing or vishing, in which whereby a business or organization that someone pretends to be a bank or accesses your personal information trusted company and tricks you into (hospital, school, department store, providing confidential personal financial company, etc.) has been information via e mails, calls or SMS/ compromised text messages Through hacking incidences, such as Trojan horses, keylogger software, viruses or malware/spyware on a computer Through social networking sites where personal information can be found and communication with fraudulent individuals can occur Through these and other new and innovative ways that criminals are constantly 2013 Javelin Strategy & Research

11 11 RECOMMENDATIONS FOR CONSUMERS Consumers should monitor accounts frequently and, if you have not already done so, use financial alerts for your bank and financial accounts. Because identity theft can occur by numerous methods, you can protect yourself by adopting a variety of best practices and effective behaviors. Javelin recommends a comprehensive, three part approach to combat identity fraud effectively: prevention, detection, and resolution. The next section provides data on current trends, steps to prevent fraud, actions to detect fraud if it occurs, and ways to resolve fraud if you become a victim. Figure 5: Javelin s Prevention, Detection, and Resolution Identity Fraud Model 2013 Javelin Strategy & Research

12 12 CONSUMER PROTECTION CHECKLIST Below is Javelin s consumer protection checklist. The checklist highlights the nine most important ways to prevent, detect, and resolve fraud in your financial accounts. Take some time and review the list below to see how prepared you are. The more items you can check off the list, the greater security you have against identity fraud. Remember, the most efficient way to combat fraud is for financial institutions and consumers to work together to stop criminals. To get even more customized recommendations, visit Javelin s IDSafety.net website, where we offer an 18 question quiz that will provide personalized recommendations for your daily activities.

13 13 PREVENTION Consumers can best prevent identity fraud by carefully protecting and limiting the exposure of sensitive information, such as PINs, banking and account numbers, and Social Security numbers. You also should be aware of common fraudster techniques, such as phishing, vishing, smishing, and other scams. How Can I Prevent Identity Fraud? Mobile Device Security. Mobile devices are treasure troves of information for fraudsters. The always on functionality of mobile devices provides fraudsters with new avenues for stealing information. We recommend the following steps to prevent identity fraud: Install mobile software only from trusted sources and official app stores. App users should also read the permissions requested by new apps carefully and determine whether the permissions coincide with the alleged function of the app. Most smartphone users should also install an antivirus/ antimalware program to mitigate instances of mobile malware. Apple maintains that no antivirus is needed for iphone users as long as the OS is kept up to date, and none is available in the Apple App Store. Mobile devices are increasingly used to store and transmit personal information. You should use antivirus/antimalware software to guard that information from malicious applications.

14 14 Make sure all operating systems are the latest versions. Updates are used to patch security holes found on the previous version of the operating system. Devices that continue to run on old operating systems continue to experience those security vulnerabilities. Install or enable a passcode lock on your smartphone. Passcodes act as a strong deterrent to thieves and can give you the time you need to enable your remote wiping or antitheft software. Be Social, Be Responsible. Social media sites like Facebook, Flickr, Tumblr, LinkedIn, MySpace, Google+, and Twitter are exploding in popularity, and the growing ubiquity of these 1. Social networking sites can provide fraudsters with personal information to access accounts. 2. Use caution when sharing such details on your profile. sites has introduced a new set of risks for the user. We are not suggesting you not participate in social media, but examine your current behaviors that expose personal information that is typically used by banks and other companies to verify a consumer s identity. Do not reveal sensitive or personal information on social networking sites. Such personal details are commonly used by banks and credit card companies as security questions to identify an individual before clearing access to his or her financial accounts, credit card logins, and more. Use caution when using apps on social networking sites. Verify that the app does not have access to any personally identifiable information. Users of certain social media apps experience a significantly higher incidence of fraud than the general public.

15 15 Stay Safe Online. Transitioning your financial activities away from paper statements and onto online channels can significantly reduce the time it takes to detect fraud as well as reduce risks associated with physical documents containing personal information. However, the Internet also introduces new threats that you should take into account. Regularly install and update firewall, antivirus, and antispyware software on your computer and mobile device when possible. Be aware of the dangers of online threats and install antivirus and antimalware software on your computer, smartphones, and tablets, and update it along with applications, browsers, and operating systems. 7.4 % consumers who accessed public wi-fi hotspots in the past 12 months became a fraud victim. This is much higher than those that did not (4.6%) Download browser security software to protect against man in the browser attacks. Install security patches and software updates as soon as they are released by verified sources. Use and recognize secure websites. Do not provide card or personal information at unsecured sites. To recognize these sites, look for the padlock symbol and an s after the http in your browser s address bar. If the website has an additional layer of security (EV SSL), green highlighting will appear in the address bar when you access the site using a high security browser. Avoid accessing websites that display personal or account information using unsecured Wi Fi connections, such as those at cafes, public libraries, or airports. You are more secure using your mobile device s 3G or 4G connection than using a public hot spot. Ensure that your Internet connection at home and work is secure or protected by a firewall.

16 16 Turn off Bluetooth and Wi Fi when they are not being used. Watch out for and attachments from convincing imitations of banks, card companies, charities, and government agencies. Never respond directly to requests for personal or account information online, over the phone, in , or through your mobile device including SMS text messages. Instead, use your bank s contact info listed on their website, on statements, or the back of credit cards. Call them directly. Do not click on embedded links in any or SMS. If you get an from your bank or FI, go to its main website or use its dedicated downloadable application. Follow safe password practices. Do not use: Dictionary words, the name of the website, or the word password. Don t just capitalize the first character; instead, capitalize a random letter. Integrate numbers into your password. Do not use easily guessed passwords, such as your birthdate, the name of a close relative, or your pet s name. Use passwords for wireless Internet connections, and don t access unsecure websites or type in PII using public Wi Fi on mobile devices, laptops, or computers. Take advantage of available online shopping and payment security features like one time passwords and virtual credit card account numbers. Many of the largest payment networks and financial institutions offer enhanced security tools for more secure shopping online. Services like Verified by Visa, MasterCard SecureCode, and Citibank s Virtual Account Numbers offer additional layers of security to your online shopping experience giving improved fraud protection. Wipe clean electronic devices, such as smartphones, tablets and computers, before disposing of, turning in, or selling them.

17 17 Stay Safe Offline. Being aware of your surroundings and destroying physical documents that contain sensitive information are essential in safeguarding your identity. Take these simple precautions to ensure that your identity is safe. Keep sensitive information from prying eyes. At home or work, secure your personal and financial records in a locked storage device or a password protected file. Javelin Data Snack: In 2012, 12% of all identity fraud crimes were committed by someone known to the victim. Shred paper documents that contain sensitive information before disposing of them. Avoid providing your full nine digit SSN whenever possible, and do not carry your financial cards and documents with sensitive information. When your Social Security number is requested as an identifier, ask if you can provide alternate information. Request electronic statements and use online bill pay whenever possible. Enroll in direct deposit, and don t put checks in an unlocked mailbox. Switch from paper statements to online financial account management. Opt out of preapproved credit offers. Javelin Data Snack: In 2012, 28% of fraud victims reported having their SSN stolen. Call: OPTOUT Visit: To be removed from credit card applications.

18 18 DATA BREACH NOTIFICATION LETTERS Organizations typically send data breach letters to notify customers about the possible leak of personally identifiable information, such as Social Security numbers, driver s license numbers, credit card numbers, etc. The letter would also specify what information was stolen or leaked and the steps required to ensure further protection of customers accounts. In 2012, 12% of U.S. adults received such letters. What Should I Do If I Receive a Breach Notification Letter? Currently, 46 states (plus the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands) require companies to notify you if a breach of security occurs at their place of business and your personal information has been placed at risk. Receiving this notification does not necessarily mean that you will suffer a fraud. However, Javelin data shows that consumers who received breach notifications in 2012 had a substantially higher risk of identity fraud, almost 5 times higher, than those who didn t receive these notifications. Take Action to Protect Yourself If You Receive a Security Breach Notification Figure 6: Record Number of Data Breach Recipients Became ID Fraud Victims in Javelin Strategy & Research

19 19 Consumers who receive security breach notifications therefore need to take action to protect themselves. If you receive a data breach letter, take the following steps: 1. Verify that the letter is legitimate. 2. You are strongly encouraged to take advantage of any free services the notification letter offers, such as credit monitoring. 3. You should also call the toll free numbers or visit the websites listed in the letter to learn more about the breach, determine your level of risk, and identify the actions you need to take to protect yourself from more damage. 4. Different breaches have different levels of risk that require specific action by consumers to prevent further harm. The action could be as simple as changing passwords to accounts that are linked to the FI to canceling the credit or debit card affected to changing security questions and answers to affected accounts. Or the action could be far reaching, such as the following: Monitoring your financial accounts. Closing affected accounts. Placing a fraud alert on your credit report with the three primary credit bureaus: Equifax, Experian, and TransUnion (refer to Figure 7 for contact details). Fraud alerts notify creditors that a potential fraud has occurred and that they should verify the applicant s identity before extending credit. An initial alert stays active for 90 days, and an extended alert for identity fraud victims lasts seven years. A fraud alert will trigger a credit report, which the consumer needs to review for any signs of fraud. Placing a credit freeze on your account with the three primary credit bureaus. A credit freeze is stronger than a fraud alert because it locks your credit report down to prevent new credit from being extended.

20 20 DETECTION Credit Bureau Information Figure 7: How to Contact the Three Credit Bureaus Credit Bureau Order credit Report fraud Web address EQUIFAX EXPERIAN TRANSUNION Mailing address Equifax Consumer Fraud Division P.O. Box Atlanta, GA Experian Consumer Assistance P.O. Box 9532 Allen, TX TransUnion Victim Assistance Dept. P.O. Box 6790 Fullerton, CA Note: To order a free annual credit report from any or all agencies, contact or call toll free at It is critical that consumers detect fraud as early as possible to minimize potential losses and fraud resolution time. Faster detection results in lower out of pocket expenses, which include unreimbursed losses, legal fees, and lost wages. The sooner fraud is detected, the easier it is to resolve and the less the criminal is able to steal Javelin Strategy & Research How Can I Detect Identity Fraud? Javelin research has consistently shown that consumers can be very successful at detecting identity fraud relating to their accounts. The most efficient way to combat fraud is for consumers and institutions (banks, government agencies such as the Federal Trade Commission, and other

21 21 organizations dedicated to fighting fraud) to work together. Consumers must be proactive in their approach to protect themselves against fraud and should work with institutions to safeguard their identity. Self Detection vs. External Fraud Detection Financial account protection is a shared responsibility between FIs and customers. In 2012, fraud detection was almost equally split between fraud victims and external sources (e.g., FIs and law enforcement). While 50% of victims were able to self detect fraud by regularly monitoring their accounts, credit reports, or enrolling in identity protection services, 33% of consumers relied on their banks or credit card providers. The latter group realized they had been defrauded only when they were notified by these external sources. Consumers Are Equally Relying on Self Detection to Discover Fraud on Their Accounts Figure 8: Methods of Detection, 2012 Self Detection 50% By monitoring accounts through the Internet, ATM, or other electronic means Monitored account through paper statements Notified by Bank or Credit Card Provider 33% Balance shrank/credit overdrawn Reviewed credit report Using a credit monitoring or identity protection service Other 17% Q22: How did you first discover you were a victim of identity theft? Was it...? October 2012, n= 827 Base: All fraud victims. Survey base: n=5, Javelin Strategy & Research

22 22 It is important to note that self detection is still the most effective way to detect fraud. Certain types of fraud are more difficult for FIs to detect and can lead to longer detection times and higher consumer costs for victims. For example, in cases of familiar fraud (instances of fraud where the victim Free reports are available at AnnualCreditReport.com or by calling personally knows the perpetrator) only 10% of victims reported being informed by banks or credit card companies that fraudulent activities had occurred on their accounts, compared to 33% of victims of other types of fraud. These cases are often difficult to detect by external security systems because the perpetrator is usually familiar with the victim s behaviors and/ or lives in the close geographical area. It is in the consumers interest for them to play an active role in managing their financial security and keeping a close watch on their financial activity. Javelin recommends doing the following to detect fraud early: Sign up for and mobile alerts through your primary bank, credit card company, and/or service provider. Set up and SMS text notifications through FIs so that they will alert you to suspicious activity and changes to your accounts or personal information. You can choose among a wide array of alert offerings for the ones that apply to your banking behaviors and practices, thereby increasing your identity fraud protection. Contact your bank, credit card provider, or service provider and ask for information about account alerts. By contacting a different one of the three credit bureaus every four months, you can stagger your free reports to review your credit three times a year at no charge. The most common method that fraudsters use to take over accounts is changing the physical address, so set up an address change alert whenever possible. Monitor your credit report on a regular basis. Review and confirm that all the accounts listed belong to you and that no unauthorized charges have been made or unknown accounts or credit lines have been opened.

23 23 Optional fee based services, such as more extensive monitoring of credit information, personal identity records, and Social Security numbers, provide extra security and convenience for those who don t want to personally monitor their information. When choosing an identity protection service, select a provider that covers both personal information and credit monitoring. 3 Review financial statements promptly. Check account balances at least weekly through online banking, mobile banking, phone, or ATM. Regularly monitor all financial accounts electronically, including banking, biller, and credit card. Confirm that all transactions are authorized and that no suspicious activity has occurred or unapproved changes have been made to your accounts. 3 For more information about the specific services offered by some of the top ID protection products, please refer to Javelin s 2012 Identity Protection Services Scorecard: How to Deliver Customer and Market Value in a Regulated $4B Market.

24 24 RESOLUTION What Should I Do If I Become a Victim of Identity Fraud? If you become a victim of identity theft or fraud, don t panic. When it comes to your financial accounts, FIs and credit card providers are prepared to help you resolve the identity theft. Most FIs have a team dedicated to resolving identity fraud and guiding victims through the Javelin Data Snack: The average amount of time required to resolve a case of identity fraud has steadily decreased, from 18 hours in 2004 to 12 hours in process. With technological advancements, identity fraud resolution has improved. By following the few simple steps below, you can help ensure that your fraud case is handled quickly and painlessly. These actions can serve as a checklist/resource guide if you become a victim. Immediately contact your bank and credit card companies. Report problems and work with your bank, credit union, or identity protection service provider to take advantage of resolution services and reimbursement policies. If your FI provides fraud resolution specialists, ask for their assistance to ensure the fraud is resolved. Notify the appropriate institutions as soon as possible if physical documents such as a checkbook, wallet, debit card, or credit card are lost or stolen, if unauthorized or suspicious account activity occurs, if changes are made to personal information (e.g., physical address, address, registered users, login or password), or if paper statements are turned off. Depending on each individual case, an FI may close your account, cancel your debit or credit cards, and take other necessary precautions. It will also assist you in setting up new accounts and will issue new debit and credit cards.

25 25 Educate yourself on your FI s and issuer s zero liability protections on debit cards and ATM withdrawals because they vary among providers. Report all lost or stolen cards or fraudulent transactions immediately because the timing of your report may affect the amount that you are liable for under the law. Contact the Federal Trade Commission. Place a fraud alert on your credit report. If your personal information has been compromised or if you have been a victim of fraud, immediately contact the three primary credit reporting agencies: Equifax, Experian, and TransUnion (refer to Figure 7 for contact information) to place a fraud alert. These agencies provide credit monitoring services as well as additional products and services. File a police report. If fraud has occurred, contact your local police department to file an identity fraud report. Make sure to save a copy for your personal records. Consider enrolling in a high quality ID protection service. To report incidents of suspected fraud or identity theft, visit the FTC online at c.gov/features/ feature identity-theft or call IDTHEFT ( ). Victims who find that their driver s license numbers or SSNs have been compromised should consider enrolling in ID protection services that monitor credit reports as well as noncredit related databases for unauthorized use of stolen information. Identity Fraud Protection Solutions Specific services are available for consumers who want extra protection against new accounts fraud the type of fraud in which a criminal uses a victim s Social Security number and other personally identifiable information to create a fraudulent account in the victim s name (e.g.,

26 26 credit card, cell phone, or utilities) and other types of fraud. Identity protection services such as credit monitoring and personal information monitoring can be purchased for a fee. Javelin advises consumers who purchase fee based services to look for the firm s BBB rating. These services can provide peace of mind and convenience for consumers who want extra protection. Credit Monitoring and Personal Information Monitoring Services SERVICE Credit monitoring Personal information monitoring Fraud alert Credit freeze Figure 9: Identity Fraud Protection Services DESCRIPTION A paid subscription service that monitors your credit for suspicious activity or changes to your credit file (e.g., credit inquiries, employment changes, new accounts or address changes) Intended to detect potential identity fraud Scans public records, third party databases and Internet sites to detect exposure of your personal information (credit card numbers, Social Security numbers, etc.) Intended to detect potential identity theft A message that is placed on your credit report, requiring lenders and creditors to confirm your identity before issuing a new line of credit Intended to prevent new accounts fraud Freezes your credit file at the credit reporting agencies, which are then prohibited from issuing your credit history to any lender, creditor, or others Intended to prevent new accounts fraud 2013 Javelin Strategy & Research Consider placing a security freeze on your credit report. If you have been a victim of fraud related to an opening of a new account more than once and you are not actively applying for credit, you may want to place a security freeze on your credit report at each of the three reporting agencies.

27 27 ABOUT JAVELIN Javelin Strategy & Research, a division of Greenwich Associates, provides strategic insights into customer transactions, increasing sustainable profits and creating efficiencies for financial institutions, government agencies, payments companies, merchants, and other technology providers. Javelin s independent insights result from a uniquely rigorous three dimensional research process that assesses customers, providers, and the transactions ecosystem. Authors: Contributors: Publication Date: February 2013 James Jarzab, Research Specialist Al Pascual, Security Risk and Fraud Senior Analyst Sarah Miller, Security Risk and Fraud Analyst Mary Monahan, Executive Vice President and Research Director James Van Dyke, President and Founder Additional Resources The 2013 Identity Fraud Report s sponsors Intersections and Citigroup also make safety recommendations: Intersections d.com/what-isidentity-theft/ Citigroup online.citibank.co m/us/jrs/pands/ detail.do? ID=SecurityCenter Editor Chuck Ervin ABOUT THE METHODOLOGY Since 2003, Javelin has collected data from approximately 5,000 adults each year to measure the overall impact of identity fraud on consumers. In 2012, 5,249 adults, including 1,186 fraud victims, answered questions regarding their daily financial practices and behaviors to help determine the causes of and provide important details about such fraud. Javelin s identity fraud study reaches an audience of 63 million and is a factual resource for the Federal Trade Commission (FTC).

28 28 GLOSSARY OF TERMS account takeover fraud card not present (CNP) casual social network activity users cloud consumer cost or out ofpocket cost credit freeze credit monitoring data breach drive by download Method of identity fraud in which a fraud operator attempts to gain access to a consumer s account by fraudulently adding his or her information to the account (e.g., changing account mailing address, adding himself or herself as a registered user, or making other alterations). Transaction in which the card is not present; card data is manually entered. This includes purchases made online, by phone, or through the mail. Social network users who indicated that they sometimes use the indicated social networking activity or often use the indicated social networking activity. The cloud is a metaphor for the Internet. With the cloud, software services and data are not hosted locally but globally and are accessible remotely by browser. Amazon, Google, and Rackspace, for example, offer large cloud networks that are leased to various businesses. Out of pocket costs incurred by the victim to resolve a fraud case, including postage, copying, notarizing of documents, and legal fees; costs may also include payment of any fraudulent debts to avoid further problems. Security freeze placed on a consumer s credit file to prevent the file from being shared with creditors, thus forestalling new accounts from being opened in the consumer s name. Service that scrutinizes a consumer s credit file for suspicious activity or changes on his or her credit report such as credit inquiries, delinquencies, negative billing information, employment changes, and address changes. Monitoring is particularly helpful in detecting new account fraud after it occurs. The most effective credit monitoring companies will monitor all three credit bureaus because many lenders will contact only one. Unauthorized disclosure of information that compromises the security, privacy, or integrity of personally identifiable data. Act of passively compromising a PC by downloading a malicious file while the victim views the content of a website.

29 29 existing account fraud existing card account fraud existing non card account fraud external detection methods fraud amount frequent social networking activity users familiar fraud identity fraud identity theft key logger Identity fraud perpetrated against either or both existing card and existing non card accounts. Identity fraud perpetrated through use of existing credit or debit cards and/or their account numbers. This fraud type can also be referred to as existing card fraud or ECF. Identity fraud perpetrated through use of existing checking and savings accounts or existing loan, insurance, telephone, and utilities accounts or other accounts. This fraud type can also be referred to as existing non card fraud or ENCF. Methods of detecting fraud in which an external resource is the first to discover the fraud. Examples of external detection methods include discovering fraud through notifications from the bank, law enforcement, or debt collectors. Total amount of funds the fraud operator obtained illegally; these may result in actual losses to various businesses and organizations and, in some cases, to the consumer. Social network users who indicated that they always use the indicated social networking activity or often use the indicated social networking activity. Fraud committed by someone who knows the fraud victim personally, such as a family member, co worker, or friend. Familiar fraud is more damaging (harder to detect and longer to resolve) because the perpetrators tend to be aware of the victim s habits and know how to hide the fraud. Also, victims tend not to report familiar fraud to authorities. Unauthorized use of some portion of another s personal information to achieve illicit financial gain. Identity fraud can occur without identity theft (for example, by relatives who are given access to personal information or by the use of randomly generated payment card numbers). Unauthorized access to personal information; identity theft can occur without identity fraud, such as through large scale data breaches. Spyware that captures and records user keystrokes on a computer and is used by fraudsters to obtain passwords, PINs, logins, and other sensitive information.

30 30 mail order/telephone order (MOTO) malware man in the browser (MITB) man in the middle (MITM) mutual authentication new accounts fraud personal information monitoring phishing privacy settings Orders placed through mail or telephone channels (a type of card not present transaction). Malicious software designed to access a computer or operating system without the knowledge or consent of the user. Some examples of malware are computer viruses, worms, Trojan horses, spyware, malicious adware, and rootkits. Malware is damaging code or programming that gathers information without permission. Attack in which a perpetrator is able to read, insert into, and modify, at will, messages between the Internet browser and a server without either party s knowing that the link between them has been compromised. Attack in which a perpetrator is able to read, insert into, and modify, at will, messages between two parties without either party s knowing that the link between them has been compromised. MITB attacks are a subset of MITM attacks in which the browser is exploited to trick the legitimate parties into revealing sensitive information. Method by which the FI and the customer identify each other by providing and identifying shared secrets. Identity fraud perpetrated through use of the victim's personal information to open fraudulent new accounts. Service that keeps an eye on a consumer s personally identifiable information by monitoring channels, including online surveillance, public records and databases, Internet sites, and carding forums (underground sites where stolen credit card numbers are bought and sold). Third party solutions that offer this service provide additional value because they can more holistically prevent and detect identity fraud, including medical and health insurance fraud. Method of "fishing" for Internet users passwords and financial or personal information by luring them to a fake website through an authentic looking that impersonates a trusted party. Phishing s could attempt to impersonate an FI, issuer, merchant, or biller. User defined controls that allow users to manage the visibility of various parts of their social media profiles, including who has access to specific information.

31 31 self detection methods severely impacted smartphone smishing social networking Trojan horse two way actionable alerts: review and release two way actionable alerts: review and respond Methods of detecting fraud in which the consumer is the first to discover the fraud. Examples of self detection include discovering fraud through electronic or paper monitoring or reporting a card lost or stolen. Victims who report that they have suffered a significantly negative effect because they have been fraud victims. Consumers rate the impact a 4 or 5 on a scale where 1 represents little or no effect and 5 represents a severe effect. A mobile device with phone, keyboard, web access, and apps (e.g., Android, iphone, Windows Mobile, BlackBerry, etc.) A form of criminal activity, using techniques similar to phishing, in which a fraudster uses SMS messages to mobile devices to lure victims into revealing personal information. Similar to phishing, it could attempt to impersonate an FI, issuer, merchant, or biller and can include a fraudulent URL link to a faked website or phone number to a fake automated voice response system. A medium for consumers to interact with one another online. Users are responsible for generating content and can post and edit conversations, pictures, and media. Some of the most popular social media sites are Facebook, MySpace, LinkedIn, Twitter, FourSquare, Yelp, and YouTube. Program that appears to be a useful file (e.g., a music file or software upgrade) from a legitimate source, tricking the victim into opening it; once activated, the Trojan horse allows intruders to access private information. Review and release alerts are user defined notifications that alert the consumer when the transaction is still pending. The transaction that triggered the alert remains pending until the consumer can verify or deny it within the alert. Review and respond alerts notify consumers after a transaction has been completed but allows the consumer to respond within the alert if he or she wants to take certain action. This could include reporting the transaction as fraudulent or transferring funds from one account to another.

32 32 Wi Fi hot spots Wi Fi Protected Access (WPA) Location that offers Internet access over a wireless local area network. These hot spots can be set up in public venues where users can connect using laptops, smartphones, tablets, and other Internetaccessing devices. Designed to replace WEP by using stronger encryption. Extensions of WPA and WPA2 include Temporal Key Integrity Protocol (TKIP) and pre shared key (PSK, also known as personal) mode. Both require the addition of a pass phrase that is used in the process of encrypting the data packet.