Identity Theft: Prevention, Detection, Solutions. Presented by. Manny Madruga

Identity Theft: Prevention, Detection, Solutions Presented by Manny Madruga

Identity Theft: Prevention, Detection, Prosecution 4. Keystroke catchers. These small devices are attached to the cable that connects your keyboard to your computer and can be bought online for a little over $100. The "catcher" resembles a standard connector, but contains a memory chip that records everything you type. It's typically used in public places where computers are available, such as libraries, Internet cafes and college computer labs. To protect yourself when using a public computer, never shop online, check your bank account, pay bills or enter your credit-card information. Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Gone Phishing and Pharming Sent to Assistant State Attorney Tom Palermo at his STATE email address on 10/10/2005 at 9:24 am from ebay Inc [support_refnum_866614@ebay. com]

This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL Skimming The replication of electronically transmitted full track data to allow or enable valid authorization to occur.

Identity Theft: Prevention, Detection, Prosecution Installing on the face of the ATM Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Placement of an ATM Trap The trap is then inserted into the ATM slot. Care is taken not to insert the entire film into the slot, the ends are folded and contain glue strips for better adhesion to the inner and outer surface of the slots. Courtesy of Det. William Gergel, Hillsborough County Sheriff s Office

PAIN AT THE PUMP: Courtesy of the United States Secret Service Special Agent Don Cox, MD-FL

GET A SHREDDER http://cockeyed.com/citizen/creditcard/application.shtml FROM THE BLOG ON COCEYED.COM: I taped the bits together from the back, so I'd still be able to fill out the application in pen. It wasn't a perfect job, I was fighting static on the little bits of paper. Taped up! It was good as new! Finally, I completed the application.

WIRELESS NETWORKS: The Cybercrimes Nightmare Homeowner s Wireless Network 192.168.1.10 4 Unauthorized Users 192.168.1.10 0 Cable Modem Wireless APP 192.168.1.10 1 68.24.168.18 192.168.1.1 192.168.1.10 2 Authorized Users 192.168.1.10

Identity Theft: Prevention, Detection, Prosecution Database Penetrations msi.at Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Ways to Protect Yourself (not foolproof, no matter how hard you try) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Only Share Identity Information When Necessary When in Public, Exercise Caution When Providing Identity Information Do Not Carry Unnecessary Identity Information in a Purse or Wallet Secure Your Mailbox Secure Information on Your Personal Computer Keep Financial and Medical Records in a Secure Location Shred Nonessential Material Containing Identity Information "Sanitize" the Contents of Garbage and Recycling Ensure That Organizations Shred Identity Information Remove Your Name from Mailing Lists Carefully Review Financial Statements Periodically Request Copies of Credit Reports

An Ounce of Prevention: Ideas for PREVENTING Identity Theft from happening to you Check your credit reports once a year from all three of the credit reporting agencies (early detection). Don t carry your Social Security card with you. Don t put your SSN or drivers license number on your checks. Never give your Social Security number to anyone unless they have a good reason for needing it. Be suspicious of telephone solicitors. Never provide information unless you have initiated the call. Try to use a locked mailbox to send and receive your mail. Don t lend out your credit card. Remember: if it sounds too good to be true, it probably is. Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

An Ounce of Prevention: Sign your credit cards when you receive them Be aware of your surroundings when you use an ATM Look at the ATM before you use it skimming devices can be attached to the outside of the ATM (although the good ones may be virtually impossible to detect) Watch your credit/debit cards when you give them to anyone Be wary about non-bank ATMs some stand alone ATMs have security vulnerabilities, especially regarding encryption of PIN numbers at the keypad Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Checking your credit report How do I order my free report? Equifax, Experian, and TransUnion have set up a central website, telephone number, and mailing address for you to order your free annual report. To order, visit www.annualcreditreport.com, call (877)322-8228, or complete the annual credit report request form available on the website and mail it to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. This website is the only authorized source for your free annual credit report. If you receive an email or see a pop-up ad claiming it is from www.annualcreditreport.com or any of the three consumer reporting companies, do not reply or click on any link in the message -- it may be a scam. What information do I have to provide to get my free report? You will need to provide your name, address. Social Security number, and date of birth. If you have moved in the last two years, you may need to provide your previous address. To maintain the security of your file, each consumer reporting company may ask you for some information that only you should know. Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Should I order all of my credit file disclosures at once? You are entitled to receive one free credit file disclosure every 12 months from each of the consumer credit reporting companies. The advantage of ordering all three at the same time is that you can compare them. However, you will not be eligible for another free credit file disclosure from the central source for 12 months. On the other hand, the advantage of ordering one now and others later (for example, one credit file disclosure every four months) is that you can keep track of any changes or new information that may appear on your credit file disclosure. What if I find errors? Write to the consumer reporting company and the information provider. Under the Fair Credit Reporting Act, both are responsible for correcting inaccurate or incomplete information in your report. Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

How long can a consumer reporting company report negative information? Most accurate negative information can be reported for seven years and bankruptcy information for 10 years. There is no time limit on reporting information about criminal convictions; information reported in response to your application for a job that pays more than $75,000 a year; and information reported because you've applied for more than $150,000 worth of credit or life insurance. Information about a lawsuit or an unpaid judgment against you can be reported for seven years or until the statute of limitations runs out, whichever is longer. What about companies that claim they can improve my credit report for a fee? The Federal Trade Commission cautions consumers to be wary of companies that make claims regarding credit repair. These companies, commonly called credit clinics, do nothing for consumers that consumers cannot do for themselves at little or no cost. Reprinted from the June 2005 Texas Bar Journal (with permission on 10/11/2005) Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Is ID theft protection worth it? Make sure services have really got you covered 03:46 PM CDT on Monday, April 16, 2007 By PAMELA YIP / pyip@dallasnews.com / The Dallas Morning News TYPES OF PROTECTION CREDIT MONITORING Offered by the three national credit bureaus Experian, TransUnion and Equifax. Cost: $12.95 to $14.95 per month What you get: Daily monitoring of your credit files at all three credit bureaus and notification within 24 hours of changes to your credit report. IDENTITY THEFT INSURANCE May also be known as "identity restoration" or "identity recovery." Cost: Up to $50 a year, or free as part of your homeowners' or auto insurance policy. What you get: Covers expenses and provides services associated with restoring your identity. LIFELOCK Advertises itself as the total protection system. Cost: $110 a year or $10 a month for adults. What you get: LifeLock sets fraud alerts in your credit file and automatically renews them every 90 days. You get copies of your credit reports, and the company will take you off lists to receive prescreened credit offers. If your identity is stolen, LifeLock will cover expenses such as lost wages, attorney fees, long-distance calls, postage and other miscellaneous costs, up to $1 million. SOURCES: The companies; Dallas Morning News research

Is ID theft protection worth it? Make sure services have really got you covered 03:46 PM CDT on Monday, April 16, 2007 By PAMELA YIP / pyip@dallasnews.com / The Dallas Morning News TIPS Before spending money on identity-protection or identity-theft services: Ask yourself what you're getting for your money. Are you willing to do many of the things yourself, such as obtaining your credit reports and putting fraud alerts in your credit file? Or would you rather have someone perform those tasks for you and save you the burden of having to remember to renew fraud alerts? Find out how often credit-monitoring services watch over your credit report and how soon they will notify you if something's amiss. Determine what identity theft insurance will cover and the coverage limits. What are your deductible and premium? Be sure you're dealing with a reputable company before you divulge sensitive personal information. Some that claim to be offering identity-protection and identity-theft services may actually be identity thieves. SOURCE: Dallas Morning News research

Identity Theft: Prevention, Detection, Prosecution ONCE IT HAS HAPPENED TO YOU Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

What are the first steps I should take if I'm a victim of identity theft? If you are a victim of identity theft, take the following four steps as soon as possible, and keep a record with the details of your conversations and copies of all correspondence. 1. Place a fraud alert on your credit reports, and review your credit reports. Fraud alerts can help prevent an identity thief from opening any more accounts in your name. Contact the toll-free fraud number of any of the three consumer reporting companies below to place a fraud alert on your credit report. You only need to contact one of the three companies to place an alert. The company you call is required to contact the other two, which will place an alert on their versions of your report, too. Equifax: 1-800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241 Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm Experian: 1-888-EXPERIAN (397-3742); www.experian.com; P.O. Box 9532, Allen, TX 75013 TransUnion: 1-800-680-7289; www.transunion.com; Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790 Once you place the fraud alert in your file, you're entitled to order free copies of your credit reports, and, if you ask, only the last four digits of your Social Security number will appear on your credit reports. Once you get your credit reports, review them carefully. Look for inquiries from companies you haven't contacted, accounts you didn't open, and debts on your accounts that you can't explain. Check that information, like your Social Security number, address(es), name or initials, and employers are correct. If you find fraudulent or inaccurate information, get it removed. See Correcting Fraudulent Information in Credit Reports to learn how. Continue to check your credit reports periodically, especially for the first year after you discover the identity theft, to make sure no new fraudulent activity has occurred.

What is a fraud alert? There are two types of fraud alerts: an initial alert, and an extended alert. An initial alert stays on your credit report for at least 90 days. You may ask that an initial fraud alert be placed on your credit report if you suspect you have been, or are about to be, a victim of identity theft. An initial alert is appropriate if your wallet has been stolen or if you've been taken in by a "phishing" scam. When you place an initial fraud alert on your credit report, you're entitled to one free credit report from each of the three nationwide consumer reporting companies. Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm An extended alert stays on your credit report for seven years. You can have an extended alert placed on your credit report if you've been a victim of identity theft and you provide the consumer reporting company with an "identity theft report." When you place an extended alert on your credit report, you're entitled to two free credit reports within twelve months from each of the three nationwide consumer reporting companies. In addition, the consumer reporting companies will remove your name from marketing lists for pre-screened credit offers for five years unless you ask them to put your name back on the list before then. To place either of these alerts on your credit report, or to have them removed, you will be required to provide appropriate proof of your identity: that may include your Social Security number, name, address and other personal information requested by the consumer reporting company. When a business sees the alert on your credit report, they must verify your identity before issuing you credit. As part of this verification process, the business may try to contact you directly. This may cause some delays if you're trying to obtain credit. To compensate for possible delays, you may wish to include a cell phone number, where you can be reached easily, in your alert. Remember to keep all contact information in your alert current.

2. Close the accounts that you know, or believe, have been tampered with or opened fraudulently. Call and speak with someone in the security or fraud department of each company. Follow up in writing, and include copies (NOT originals) of supporting documents. It's important to notify credit card companies and banks in writing. Send your letters by certified mail, return receipt requested, so you can document what the company received and when. Keep a file of your correspondence and enclosures. When you open new accounts, use new Personal Identification Numbers (PINs) and passwords. Avoid using easily available information like your mother's maiden name, your birth date, the last four digits of your Social Security number or your phone number, or a series of consecutive numbers. Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm If the identity thief has made charges or debits on your accounts, or on fraudulently opened accounts, ask the company for the forms to dispute those transactions: For charges and debits on existing accounts, ask the representative to send you the company's fraud dispute forms. If the company doesn't have special forms, use the sample letter to dispute the fraudulent charges or debits. In either case, write to the company at the address given for "billing inquiries," NOT the address for sending your payments. For new unauthorized accounts, ask if the company accepts the ID Theft Affidavit (PDF, 56 KB). If not, ask the representative to send you the company's fraud dispute forms. If the company already has reported these accounts or debts on your credit report, dispute this fraudulent information. See Correcting Fraudulent Information in Credit Reports to learn how. Once you have resolved your identity theft dispute with the company, ask for a letter stating that the company has closed the disputed accounts and has discharged the fraudulent debts. This letter is your best proof if errors relating to this account reappear on your credit report or you are contacted again about the fraudulent debt.

What is an identity theft report? An identity theft report may have two parts: Part One is a copy of a report filed with a local, state, or federal law enforcement agency, like your local police department, your State Attorney General, the FBI, the U.S. Secret Service, the FTC, and the U.S. Postal Inspection Service. There is no federal law requiring a federal agency to take a report about identity theft; however, some state laws require local police departments to take reports. When you file a report, provide as much information as you can about the crime, including anything you know about the dates of the identity theft, the fraudulent accounts opened and the alleged identity thief. Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm Part Two of an identity theft report depends on the policies of the consumer reporting company and the information provider (the business that sent the information to the consumer reporting company). That is, they may ask you to provide information or documentation in addition to that included in the law enforcement report which is reasonably intended to verify your identity theft. They must make their request within 15 days of receiving your law enforcement report, or, if you already obtained an extended fraud alert on your credit report, the date you submit your request to the credit reporting company for information blocking. The consumer reporting company and information provider then have 15 more days to work with you to make sure your identity theft report contains everything they need. They are entitled to take five days to review any information you give them. For example, if you give them information 11 days after they request it, they do not have to make a final decision until 16 days after they asked you for that information. If you give them any information after the 15-day deadline, they can reject your identity theft report as incomplete; you will have to resubmit your identity theft report with the correct information. You may find that most federal and state agencies, and some local police departments, offer only "automated" reports, reports that do not require a face-to-face meeting with a law enforcement officer. Automated reports may be submitted online, or by telephone or mail. If you have a choice, do not use an automated report. The reason? It's more difficult for the consumer reporting company or information provider to verify the information. Unless you are asking a consumer reporting company to place an extended fraud alert on your credit report, you probably will have to provide additional information or documentation when you use an automated report.

3. File a report with your local police or the police in the community where the identity theft took place. Then, get a copy of the police report or at the very least, the number of the report. It can help you deal with creditors who need proof of the crime. If the police are reluctant to take your report, ask to file a "Miscellaneous Incidents" report, or try another jurisdiction, like your state police. You also can check with your state Attorney General's office to find out if state law requires the police to take reports for identity theft. Check the Blue Pages of your telephone directory for the phone number or check www.naag.org for a list of state Attorneys General. What do I do if the local police won't take a report? Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm There are efforts at the federal, state and local level to ensure that local law enforcement agencies understand identity theft, its impact on victims, and the importance of taking a police report. However, we still hear that some departments are not taking reports. The following tips may help you to get a report if you're having difficulties: Furnish as much documentation as you can to prove your case. Debt collection letters, credit reports, your notarized ID Theft Affidavit (PDF, 56 KB), and other evidence of fraudulent activity can help demonstrate the seriousness of your case. Be persistent if local authorities tell you that they can't take a report. Stress the importance of a police report; many creditors require one to resolve your dispute. Remind them that consumer reporting companies will automatically block the fraudulent accounts and bad debts from appearing on your credit report, but only if you can give them a copy of the police report. If you're told that identity theft is not a crime under your state law, ask to file a Miscellaneous Incident Report instead. If you can't get the local police to take a report, try your county police. If that doesn't work, try your state police. Some states require the police to take reports for identity theft. Check with the office of your State Attorney General www.naag.org to find out if your state has this law.

4. File a complaint with the Federal Trade Commission. By sharing your identity theft complaint with the FTC, you will provide important information that can help law enforcement officials across the nation track down identity thieves and stop them. The FTC can refer victims' complaints to other government agencies and companies for further action, as well as investigate companies for violations of laws the agency enforces. You can file a complaint with the FTC using the online complaint form; or call the FTC's Identity Theft Hotline, toll-free: 1-877-ID-THEFT (438-4338); TTY: 1-866-653-4261; or write Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. Be sure to call the Hotline to update your complaint if you have any additional information or problems. Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm

How do I prove that I'm an identity theft victim? Applications or other transaction records related to the theft of your identity may help you prove that you are a victim. For example, you may be able to show that the signature on an application is not yours. These documents also may contain information about the identity thief that is valuable to law enforcement. By law, companies must give you a copy of the application or other business transaction records relating to your identity theft if you submit your request in writing. Be sure to ask the company representative where you should mail your request. Companies must provide these records at no charge to you within 30 days of receipt of your request and your supporting documents. You also may give permission to any law enforcement agency to get these records, or ask in your written request that a copy of these records be sent to a particular law enforcement officer. The company can ask you for: Information courtesy of the Federal Trade Commission http://www. consumer. gov/idtheft/con_st eps.htm proof of your identity. This may be a photocopy of a government-issued ID card, the same type of information the identity thief used to open or access the account, or the type of information the company usually requests from applicants or customers, and a police report and a completed affidavit, which may be the ID Theft Affidavit (see next slide) or the company's own affidavit. Should I apply for a new Social Security number? Under certain circumstances, the Social Security Administration may issue you a new Social Security number - at your request - if, after trying to resolve the problems brought on by identity theft, you continue to experience problems. Consider this option carefully. A new Social Security number may not resolve your identity theft problems, and may actually create new problems. For example, a new Social Security number does not necessarily ensure a new credit record because credit bureaus may combine the credit records from your old Social Security number with those from your new Social Security number. Even when the old credit information is not associated with your new Social Security number, the absence of any credit history under your new Social Security number may make it more difficult for you to get credit. And finally, there's no guarantee that a new Social Security number wouldn't also be misused by an identity thief.

GET ON THE WEB DOWNLOAD THE F.T.C. ID THEFT AFFIDAVIT http://www.consumer.gov/idtheft/pdf/affidavit. pdf Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Identity Theft: Prevention, Detection, Prosecution Businesses need to know: There can be civil liability for companies that lose IDs or have IDs stolen from them! Mark A. Ober State Attorney - Thirteenth Judicial Circuit 800 East Kennedy Blvd. Tampa, Florida 33602

Protecting Your Employer-Client from Liability by Todd Presnell, Esq. Excerpts reprinted with permission of DRI and Todd Presnell (April 17, 2006) http://www.dri.org Methods of Prevention and Avoidance of Employer Liability (focusing on employer-employee issues) 1. Establish a policy prohibiting the dissemination of employees personnel files or other files that may contain confidential information such as social security numbers, drivers license numbers, etc. 2. Establish a policy outlining the types of confidential information that actually are needed during the hiring process, and expressly forbidding the collection of confidential information that is not really necessary 3. Establish a separate confidential policy that limits employees access to confidential information 4. Establish a policy for the prompt and proper disposal of confidential information that is no longer needed, specifically including infomraiotn gained from consumer reports 5. Maintain separate filing system/location for documents containing confidential information 6. Implement appropriate software to protect against computer viruses, unauthorized access to a company s computer network, and similar online or electronic data storage systems 7. Establish a policy that requires regular and periodic monitoring of the polices listed above to ensure that they are working, including regular testing and auditing of such policies 8. Implement a regular training program for appropriate employees (if not all of them) on the importance of proper handling of confidential information 9. Establish a mandatory reporting system whereby employees must report immediately when they believe their confidential information has been inappropriately accessed, and when they suspect co-workers of engaging in identity theft in general, or unauthorized access of

Help on the Web: 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. http://www.consumer.gov/idtheft Photo courtesy of http://www.mattandcarriegetmarr http://www.samspade.org (esp. the Do Stuff button) http://www.antiphishing.org/ http://www.ndaa-apri.org/ http://www.dc.state.fl.us/ (esp. offender search) http://www.fdle.state.fl.us/ http://www.paulenglish.com/ivr/ http://www.consumer.gov/idtheft/pdf/affidavit.pdf http://www.ic3.gov/ http://www.nw3c.org/