Identity Theft: An Introduction to the Scope of the Crime, and Its Prevention, Detection and Remediation

Transcription

1 Identity Theft: An Introduction to the Scope of the Crime, and Its Prevention, Detection and Remediation June 2009 Cairo, Egypt Joanna P. Crane Identity Theft Program Manager Senior Attorney The views expressed are those of the speaker and not necessarily those of the FTC or any other person.

2 Victim Video 2

3 What is Identity Theft? Identity Theft involves someone stealing and using the personal information of someone else to pose as that person, in order to: fraudulently obtain goods or services in the victim s name, or conceal their true identity from government and law enforcement authorities or others who perform background checks 3

4 How do thieves misuse stolen identities? Percent of all ID Theft Victims , FTC 2006 Survey For Financial Gain Credit Card 63.5% Bank 33.2% Telephone/Wireless 15.3% Internet Payment Accounts 7.0% Medical 4.5% For Concealment Given to Police 5.0% Employment 1.0% 4

5 USPIS Reshipping Video 5

6 Why has Identity Theft become such a big problem? The new Electronic Marketplace is a key factor: Increasing dependence on information Growth in information databases Social Security number used as key identifier and authenticator Greater accessibility of public record information Credit/debit transactions are extremely common and continue 6 to increase in the U.S.

7 How does Identity Theft disrupt e-commerce? Identity Theft Harms the Electronic Marketplace: Information databases corrupted with bad information Thief posing as consumer seen as low risk - results in financial loss to business Victim seen as high risk - opportunity loss for business Inaccurate information disseminated extensively, victim may not be able to fully correct Challenge to fair and accurate credit marketplace and efficient regulation of system 7 Loss of consumer confidence in cyberspace, electronic marketplace

8 How many new victims each year? In U.S.: 2003 FTC: 2005 FTC: 2005 Javelin: 2006 Javelin: 2007 Javelin: 2008 Javelin: 9.9 million 8.3 million 9.3 million 8.9 million 8.4 million 9.9 million 8

9 What is the cost of ID Theft to business each year? In U.S.: 2003 FTC: 2005 Javelin: 2005 Javelin: 2006 Javelin: 2007 Javelin: 2008 Javelin: $50 Billion $60 Billion $57 Billion $51 Billion $45 Billion $48 Billion 9

10 How does Identity Theft harm the Victim? Victim does not realize until after thief has committed fraud in his name, resulting in Direct financial losses Damage to financial status and reputation Time and costs of repairing damage Emotional harm Possible Civil Judgment or Criminal Record 10

11 Different Levels of Harm by Type of Crime ( Victims, FTC 2006 Survey) 11

12 How do thieves steal identities? Old fashioned ways - lost or stolen wallets, theft by family or friends, someone going through the victim s or company s garbage, stolen mail, buying it from a corrupt insider at a bank, hotel, car rental agency, or other business 12 12

13 How do thieves steal identities? Newer and More High Tech Ways Skimming Data breaches Phishing Keystroke loggers and malicious code Peer to Peer file sharing 13

14 Skimming The copying of electronically transmitted data on the magnetic strip of a credit card, to enable the thief to make purchases. The equipment is available over the Internet The software and hardware are very user friendly and extremely mobile The skimmed information can be transmitted via anywhere in the world within hours after it is skimmed Cardholders are not aware that they have been victimized until they receive statements showing the fraudulent charges 14

15 Skimming Common Skimming Locations Restaurants Hotels Gas Stations (affixed to pumps) ATMs (affixed to machine) Why are these locations so popular? Heavy customer volume Credit card is common payment method Multiple employees (difficult to identify suspect) Employee turnover (co-conspirators easy to recruit / emplace) Covertly placed (gas pumps and ATMs) 15

16 Skimmers Capture Device 16

17 Camera for PIN Number 17

18 Data Breaches Breaking into computer systems Networks designed for perimeter defense Firewalls on the outside, trust within Intruders need find only the weakest link Vulnerable system Unsecured network Disgruntled or Corrupt insider Once inside, often free to search and steal data 18

19 Takedown of Major International ID Theft Ring Through International Cooperation

20 20

21

22 Breached Data Quickly Sold on Black Market Carding Websites Credit cards in unlimited quantities Highest quality MasterCard and Visa with and without CVV2 No expired cards All declines replaced without questions Contacts: ICQ

23 Phishing Sending authentic-looking but fraudulent designed to trick the respondent into giving out sensitive personal information Significant magnitude: 34,758 different companies used in attacks in December 2008 Estimate that 1 in 13 households gave phishers personal information last year - 1 in 7 scam victims lost money Estimated $483 million total damage in 2008 Source: Consumer Report State of the Net Survey, 2008: 23

24 Phishing IRS Stimulus Scam 24

25 Infected computers Internet users end up infecting themselves by falling for scam or sharing their files with other users Thieves goal is to get a user with a vulnerable system (i.e., most of them) to click a link A program secretly loads that captures any keys that the bad guy wants to capture No organization is immune because it is very hard to control who senders say they are Even FTC has been used as cover Current economic downturn creating more opportunities Job Search Sites, Economic Stimulus Sites 25

26 FOX video on Peer to Peer 26

27 How can we stop Identity Theft? Prevention and Detection Challenges Our personal information is in multiple locations over which we have no control Authentication mechanisms to detect attempted identity theft have not been fully realized and adopted The Social Security number is used as both identifier and authenticator, makes identity theft too easy Thieves operate under the radar commit multiple smaller 27 fraud transactions spread out over multiple jurisdictions

28 President s Task Force Recommendations for Preventing Identity Theft Stop the thief from gaining access to the information If he gains access, stop the thief from successfully using the information If he successfully uses the information, detect it immediately and shut it down Deter further criminal behavior through prosecution and punishment 28

29 How you can protect your personal information Shred financial documents before disposing of them Don t give out your personal information unless you are sure who you are dealing with avoid scams Keep personal information secure - at home, in car, at office Monitor accounts and review financial statements regularly Watch the mail for statements for accounts or credit cards that you did not open and to make sure you receive the statements you are expecting 29

30 Guard against Identity Theft when online OnGuard Online Keep anti-virus software up-to-date Be careful in any Social Network or Peer to Peer File Sharing environment If you have online accounts, use difficult to guess passwords When online shopping look for indications that the site is secure 30

31 31 Businesses Best Practices To Prevent Data Breaches Four Key Principles for Data Security Take stock Know what you collect Scale down Only maintain what you need Lock it Use appropriate physical and electronic safeguards Pitch it properly dispose of information you no longer need

32 ORDER COPIES 32

33 Companies Should Have Identity Theft Prevention Programs Warning Signs are called Red Flags Red Flags 33

34 Examples of Red Flags Warning from credit reporting agencies Suspicious documents Suspicious personal information Fraud or active duty alert included in consumer report Documents provided for identification appear to be altered Inconsistent with external information sources 34

35 Examples of Red Flags Unusual use of account Notice from customers Account used in a way inconsistent with historical patterns of activity Customer notifies you about identity theft 35

36 What is the hardest part of resolving Identity Theft problems? 36 Proving their identity that they are who they say they are and not the thief Proving they did not commit the fraudulent transaction Company must decide whether the victim s claims are true, and, if so: Company must absolve a true victim of the debt Company is left holding the debt The wrongdoer likely is not found or unable to pay

37 Best Practices for Assisting Identity Theft Victims Give victims clear information on what documents they will need to provide you to resolve fraudulent debts Adopt a Standard Identity Theft Affidavit Eases burden on victim Establish one point of contact within the company for identity theft victims Recovery process often fragmented between collections, fraud department, or different business units, such as credit and depository channels 37

38 38

39 Best Practices For Assisting Identity Theft Victims Give victims closure letters absolving them of the fraudulent debt when the incident is resolved Ensure that fraudulent debt is not sold as bad debt to third party for collection Ensure that fraudulent debt is not reported to credit reporting agency, and clear any information previously reported to credit reporting agency 39

40 Establish a Centralized Business-Funded Victim Assistance Center Identity Theft Assistance Center (ITAC), established in 2004, is a nonprofit coalition of financial services companies united in their commitment to protect and remediate customers from identity theft Recently helped its 40,000th victim in its four years of operation Phone counselor assist victims in clearing thier credit report, resolving disputes with all other members 40

41 41

42 For More Information ftc.gov/infosecurity ftc.gov/idtheft ftc.gov/privacy 42

43 Publications President s Task Force Report - Security in Numbers: SSNs and ID Theft - Fighting Fraud with the Red Flags Rule: A How-to Guide for Business - AvoID Theft: Deter, Detect, Defend Consumer Education Kit

44 Publications Protecting Personal Information: A Guide for Business Take Charge: Fighting Back Against Identity Theft - How to Plan and Host Protect Your Identity Days Kit

45 Joanna P. Crane The views expressed are those of the speaker and not necessarily those of the FTC or any other person. 45