Prevention Works

The Most Important Person

Over this past weekend, a Washington Post staff writer published a very interesting and informative article about identity theft.  It was especially interesting because she had, in fact, become the victim of identity theft recently.  In her article, she details the entire process she endured — from receiving the first phone call from her bank to her current situation — and provides some tips for the millions of other consumers who find themselves victim to this crime each year.  She captures the “headache” of the whole process, but also passes on some very helpful tips.  Above everything, she drives home what we have been saying about this crime from the beginning: Identity theft is still a new, evolving crime with almost no guaranteed, protective safeguards. When it comes to protecting your private information, the most important person still is you!

Simply put, our personal data is simply not secure these days.  Consumers’ private information continues to be displayed online, giving criminals countless opportunities at theft.  It’s essential that we all take steps to monitor our own credit, keep a close eye on our bills, and protect our personal information as best we can.  Betsy Broder, assistant director in the FTC’s Division of Privacy and Identity Protection, was quoted in the Post article as saying, “There are a lot of ways that consumers can minimize their risks, but I would hesitate to say that someone can completely immunize themselves from identity theft.  That’s because you’re not the only one that has your data.”  The truth in her words has become painfully obvious these days.  So when it comes to identity theft, only you can protect yourself.

A Cluttered Digital Landscape

Just one week into 2008, the persistent problem of identity theft has already been grabbing the headlines.  It seems that the web-based technology associated with this crime is allowing more opportunities for criminals than it is for law enforcement agencies and the courts.  Basically, the Internet is a vast, digital landscape, cluttered with an immeasurable amount of information, and it is easier for thieves to mine the data for peoples’ private information than it is for anyone to clean it up and secure or remove that private information.  But this is not a battle our society can afford to lose if we hope to continue sharing personal information in any capacity, let alone if we hope to salvage consumers’ trust in e-commerce.  To that end, I am dedicating this blog article to the many recent interesting and helpful articles I have read regarding online safety.

The Washington Post published an article last week about the proliferation of online record keeping, and the effects it’s had on identity theft.  The article paints a disturbing picture in which American citizens, particularly those involved with court cases, often have their personal information, including their Social Security numbers, published online and made publicly accessible without their knowledge.  Since the laws protecting this data and criminalizing identity theft vary greatly from state to state, and often within the states themselves, it falls heavily onto American citizens to vigilantly protect this kind of information. 

If you notice that your personal information is published on a website, immediately read that website’s privacy policy and contact them to remove the data.  There’s no guarantee that they will comply, but you should certainly make the effort.  The organization Computer Professionals for Social Responsibility offers some helpful information on its website regarding this action.  After that, since the data has been visible to the public, it would be smart to follow these instructions provided by the Federal Trade Commission.  Also, keep in mind that you may request a free credit report from each of the three national reporting companies each year in order to monitor your credit yourself.  Just remember that there is only one authorized online source for you to request a free credit report under federal law.

Also worthy of note recently: The New York Times published an extremely interesting article that reports the tale of a homeless man who had his identity stolen.

The Washington Post and the New York Times have also recently published articles that describe some of the efforts being made to safeguard children using the Internet.  Both of them are worth a read. 

For now, what else can I say?  If you, like me, are unhappy with this current state of affairs online, demand more legislation from your local lawmakers to address these issues and call out loudly for tougher penalties for cybercriminals.  The future of online privacy is very uncertain.

All That Data…

First, happy new year to all of you. I hope your year is off to as safe and happy a start as ours is at NCPC.

It may make me seem like a geek, but I have a secret love for this time of year because of all the data that become available. Right about now, all kinds of retrospective information appears about various crimes and prevention efforts, informing us of trends and the effectiveness of our efforts. And relevant to my love of data is a recent article from Wired about data loss in 2007; if you guessed it was banner year for data theft, you’d be right. To me, the problem is a common one: too little prevention too late.

According to the article, somewhere between 49 and 79 million records were lost last year, depending on how you count. That’s a lot of lives interrupted and identities stolen. According to the article, companies lost the data to the sources we have talked about in the past: hackers and lost hardware. In the largest reported case of identity theft last year, TJX’s loss, hackers found a weakness in the retailer’s wireless network and extracted data directly from TJX’s central database. Other cases were more mundane: as explained by Linda Foley of the Identity Theft Resource Center, “A lot of breaches are due to inadequate information handling, such as laptop computers with Social Security numbers on them that are lost …. This is human error, and something that's completely avoidable, as opposed to a hacker breaking into your computer system.” Indeed, Foley claims that “More of them are experiencing data breaches, and they're responding to them in a reactive way, rather than proactively looking at the company's security and seeing where the holes might be.”

Prevention is critical in data loss, and it will only be more so. Businesses are not going to stop putting information online; having information about customers available over the Internet is simply too valuable. However, unless prevention is a part of the system from the ground up, data loss will only get worse. Security needs to be a part of software projects just as much as features — if you’re designing new business software, have a security plan from the beginning. Employees are going to need to understand secure data handling as well as they understand their core job functions — if you carry equipment carrying anyone’s personal information, find out how to secure the system in case you lose it. Consumers are going to have to be involved, asking questions and challenging the process at every step. And everyone should remember this rule: If someone asks you for identifying information, ask them why they need it and what they are going to do with it.

Valuable Cargo

We’ve written quite a bit about identity theft and its many sources. Earlier this year, I wrote about the myth of the Superuser, or a computer user with extraordinary computing prowess who “hacks” into computers and commits crimes, such as identity theft. A more realistic fear involves losing a computer, such as the ones lost by the Department of Veterans Affairs in 2006. While one may fear losing a laptop, computer theft can be prevented. Superusers are unstoppable.

Sometimes, however, prevention may be difficult. Many times laptops are company property, not personal property, and so securing them may seem less imperative than, say, locking a front door. Even in the case of a personal laptop used for work purposes, it can be difficult for people to keep in mind that they’re losing more than a few thousand dollars if their laptop is stolen; if it carries tens of thousands of Social Security numbers, the laptop may be worth millions. In economics, this concept is called an externality: the laptop owner does not necessarily calculate the full value of the laptop, because the cost of loss more directly affects a third party. According to ComputerworldUK, in Great Britain steps are being taken to deal with this externality by criminalizing negligent data handling, such as putting others’ personal information on an unencrypted laptop. Although measures like this haven’t been introduced in the United States yet, it behooves us to pay attention to the debate and the results of Great Britain’s efforts.

Although there are not many details in the article on the new laws in Great Britain, the focus appears to be on negligence. The best law, however, would promote prevention, helping people understand the costs they incur by not encrypting their hard disks and securing their computers. I would not be surprised if we were to see something similar in the United States, and, if such a measure really did enforce prevention without harming people when they too are victims, I would support it. Prevention practitioners need to start educating people about data protection, which is a complicated subject. However, having seen the strength of successful campaigns in the past, I know we will succeed here too.

Hat tip to slashdot.

The Young and the Ruined

Identity theft continues to be a pervasive crime with millions of complaints logged each year.  By now, lots of good resources are available online to help educate consumers about this crime and teach them how to keep from becoming victims. However, an insightful article from the Washington Post recently highlighted a demographic of identity theft victims that is largely ignored and much underserved: young children.

Many factors make the victimization of a child by an identity thief more complicated than the victimization of an adult. Children and teenagers have no real reason to monitor their credit until they turn 18 years old, so the theft often goes undetected for years.  In many cases, a teenager will not find out that her identity has been stolen until she becomes an adult and applies for credit of her own.  Also, in many cases, the thief will be a member of the victim’s family, which presumably decreases reporting of this crime.

According to the Post article, identity theft involving child victims is on the rise.  But the article also offers many helpful tips for parents that may save their children the burden of a tarnished line of credit.  Some of them include:

• Pay attention to the junk mail your child receives.  If a person younger than 18 begins to receive promotions and solicitations in the mail, you should consider this a serious red flag.
• Keep your child’s name off marketing lists by subscribing to mail (newspapers, magazines, etc.) in your own name.
• Don’t allow your children to carry their Social Security cards with them.
• If someone asks for your child’s Social Security number, demand to know why. Most of the time you will never have to divulge this information.

Check out the Federal Trade Commission's website for more information on identity theft.

The Small Scams Add Up

By now, I consider myself somewhat of an expert when it comes to identifying scams and keeping my personal information under wraps.  And after all the research I’ve performed and all the articles I’ve written on fraud and identity theft, I feel quite safe when I’m surfing the Web.  Yet, I’m never completely at ease because I know that criminals and con artists are constantly striving to stay ahead of the curve.  It would be foolhardy for me to assume that my identity will always be safe. 

Today, it’s an article from the Washington Post that surprised me a bit.  The article describes how perpetrators of shipping scams have been successful at ripping off their victims and getting away clean with relatively small amounts of money.  But although these shipping scams don’t wreak the financial havoc of larger “Nigerian letter” scams or investment scams, the smaller amounts of money involved in shipping scams often pass quietly under law enforcement’s radar.  And the small amounts certainly add up, especially considering that complaints of this type of scam have increased in recent years, according to the Internet Crime Complaint Center.

According to the example in the Post article, the online shopper (victim) attempted to buy a laptop computer from a seller (con artist) on the social networking site, Craigslist.org. She had been corresponding with the scammer, who appeared to be a college student, and thought she had every reason to believe the transaction was legitimate.  She agreed to the exchange of the laptop and funds through an intermediary company.  But, needless to say, the shopper never received the laptop and her money was lost.  The money never made it to the intermediary company.  The con artist had sent her a link via email that took her to a phony website, designed professionally to appear as a legitimate company’s website — a trick often used in “phishing” email scams. 

This particular scam seems to have evolved from the combination of other scams, and is tricky in that sense.  But there are a few basic rules that we should all heed when doing business online:

• Never divulge personal information via email or follow a link contained in an email to divulge personal information.  Instead, contact the company directly by typing their URL into your Internet browser or, even better, by calling them directly.
• Be wary of anyone who approaches you for personal information online or by telephone.  Only divulge personal information when you have initiated contact with that person or company.
• When possible, deal with people face-to-face.  Try to avoid sending money via wire services as well as deals that involve shipping companies or escrow services.

These are rules that every savvy consumer should keep in mind.  Be sure to pass them on.  For more tips on how to keep yourself from becoming a victim of a shipping scam, please visit the Craiglist website.  They have added very helpful information.

Computer Illiteracy: Now for Thieves

I am significantly more high-tech than many identity thieves, according to a new report [PDF] from the Center for Identity Management and Information Protection at Utica College. The report covers cases investigated by the Secret Service and is extremely interesting in a number of respects; I expect it will help the prevention community more effectively prevent identity theft. I’ll highlight a few of its more interesting findings here, but I strongly recommend that you download it yourself and read at least the executive summary.

Identity theft is not as high tech as it seems. According to the report, only half of identity theft cases investigated by the Secret Service involve the Internet or other technological devices. In 10 percent of cases, thieves resorted to “non-technological methods, such as change of address and dumpster diving.” That’s right, your trash still makes you vulnerable to identity theft. Additionally, in the cases where the center was able to identify a source of vulnerability, 50 percent of the victims were compromised by a business and another 16 percent were compromised by a friend or family member. Disregarding the 16 percent of victims harmed by family and friends, “59 percent of the victims did not know the offenders,” a much higher figure than I have previously heard.

It’s important to keep in mind that this data set will be skewed significantly because it is only taken from cases that the Secret Service was actually involved in. Thus, the median loss of $31,356 is not surprising; the Secret Service is unlikely to pursue smaller cases. Additionally, it may explain why so many of their victims did not know the offenders; a grandmother is not always going to press charges against a thieving grandson. Still, the report is fascinating in its detail, and it offers a variety of recommendations for law enforcement, such as a standard system of case classification. Again, if you’re interested in identity theft, do yourself a favor and read the report.

Hat tip to slashdot.

Children: Unaware Victims

Imagine being in major debt before you can even vote. Such is the case for more than 400,000 children every year, according to the Federal Trade Commission. Although they account for only 5 percent of the total number of annual identity theft complaints, their number has climbed by 2 percent over the last two years. There may be even more child victims of identity theft since most parents don’t check their children’s credit histories. The Federal Trade Commission says that 61 percent of all identity thefts go unreported.

Since kids don’t have credit cards, mortgages, car payments, or anything else containing their personal information that could be shared with strangers, it might seem impossible for someone to steal their identity. However, what children do have is a Social Security number. If we’ve never met, never had the opportunity to see each other, and use email accounts, then it is feasible that I could use anyone’s number with a bogus name, address, and even age. Unfortunately, many credit issuers do not have the means to verify age.

Children are the ideal victims since it can be years before they or their parents realize the crime has been committed. Most only realize that they’ve been victimized later in life when they apply for their first credit card or a college loan, or undergo a credit check for their first apartment and are denied. Sometimes the perpetrators are estranged parents or relatives who have had previous access to vital information. The damage can take years to correct even if the victim is not liable.

There are seven simple steps you can take to keep your child’s identity safe: (1) Only disclose information if you know how it will be used; (2) shred any documents that bear his or her Social Security number; (3) ask your bank to require a photo ID and password for information; (4) get an annual credit report for your child; (5) check for credit card offerings made in your child’s name with the three major credit bureaus; (6) check for an earnings report in your child’s name from the Social Security Administration; and (7) always file a complaint with the Federal Trade Commission if something is wrong.

It’s a sad commentary of the times we live in that someone would steal the identity of a kid. Fortunately, by being careful, we can minimize the problems that those who have no respect for our values—or the law—might cause.

Yours Truly, Sir Dunk N. Donut

My last blog entry discussed how the people you hand your credit card to may be recording your private information and selling it. Now, add oblivious and apathetic clerks to your list of people to be on the lookout for, in addition to scheming waiters.

On my web crawl, I came across John Hargrave, a humorist on Zug.com, who tried really hard to get caught committing fraud. He signed everything but his own name on the line at the bottom of his credit card receipts: Mariah Carey, Beethoven, Lassie, Zeus. He used hieroglyphics, stick figures, and a matrix. He also walked into a Krispee Kreme store, bought some artery-strangling pastries, signed his name as “Dunk N. Donut”—a blasphemous move in context—and, while the cashier was looking, took pictures of the receipt and the store.  Apparently that didn’t raise any alarms, so he kept going and going: he segmented the experiment in five parts, and there’s a sequel, too!

It’s sort of disheartening that the safety of your money and your identity may potentially be in the hands of a finger-rapping, pimply 16-year old cashier. But for now, I suspect that our credit card companies are spending more on ad campaigns telling us that they’re keeping us safe rather than walking their pompous talk. It’s inflammatory! So be your own watchdog, because no one’s going to watch out for you better than you will.     

Heading back to the restaurant scene, what if you see your full credit card number on the receipt itself? That’s not good. Since 2005, it has been federal law that “only the last five digits of the card account number can be printed on electronically printed receipts provided to the customer.” According to this amalgamation of state laws on the National Conference of State Legislatures website, most states (in varying degrees) have consequences for printing out the whole number. Your number should be mostly X’s, and it should raise red flags if it’s not.

What if your card does end up being compromised? Well, you should know that credit and debit cards are not considered equal before the law, so you deal with each in a different way. With the Truth in Lending Act, the most your liability will account to is $50 for fraudulent charges on a credit card. Most banks waive even that. Keep an even closer watch on your debit card, though. They are subject to the Electronic Fund Transfer Act. You’d have to know and act with regard to any fraudulent charges within two days. If you do something about it before the 60-day mark, your liability is limited to $500, but after that, you could lose everything.

They don’t call it the Age of Information for no reason: danger lurks everywhere. So arm yourself with this information and slip it along to your friends. Fight back!

Skimming the Bad Guys

Just when it’s time for happy hour, you get news like this. Greg Bluestein wrote in a July 6 article on Yahoo News that when you hand over your credit card to the waiter at a restaurant, you might be victimized in a “skimming” scam where the waiter secretly records your card information and then sells it. Whoa, what?

Skimmers are small gadgets, about the size of a deck of cards or even smaller, which record sensitive information from the magnetic stripe of a credit card when swiped. Later, all the information can be stored in a computer. What’s more, you can buy a skimmer on the Internet. Dishonest employees have used skimmers at countless establishments, including Sam’s Club, gas stations and restaurants. Some people have even been scammed at ATM machines, where the thief has placed a skimmer over the original card slot.

According to Bluestein’s article, “Some studies suggest as much as 70 percent of all cases of credit card skimming stem from restaurant scams.” So while you shouldn’t stop going out to eat, you wouldn’t be paranoid to worry about using your credit card. Should you start growing your own groceries in your back yard, hermitically seal yourself off in a cave, never to dine at Olive Garden again? No, because you can do something about it and also because it’s hard to grow your own Cheez-Its. First off, know that capitalism is on your side this time around: Verifone and Hypercom, two companies that sell pay-at-the-table systems, are making strides in safeguarding America’s restaurant industry. These devices read the pattern of dots on your credit card’s magnetic strip and allow you to hold on to your card the whole time. They are already fairly widespread in Europe and Asia. Stateside, we can check out our own groceries at the supermarket and our carts at Target, so it’s just a matter of time before these devices catch on here. Also, do the things you’re supposed to do anyway. Keep a close watch on your credit and debit accounts, and be sure to shred old receipts and bills that may have your number on them.

Keep your wits about you, and don’t let anyone leave a bad taste in your mouth!