IDENTITY THEFT Anthony Ewing Eastern Michigan University Ypsilanti, MI An applied research project submitted to the school of Police Staff and Command Program May 22, 2002 2 ABSTRACT 3 Abstract Strangers rummaging through the trash bins can no longer be dismissed as some poor soul searching for bottles and can. But some depraved individual on a mission to steal our identity, destroy our good name and excellent credit. Impostor's roams about reaping havoc and leaving devastation in their wake on 500,000-700,000 people annually through "Identity Theft". Despite your best efforts to manage the flow of your personal information or to keep it to yourself, skilled identity thieves may use a variety of methods low and hi-tech to gain access to your data. Identity thieves may pick through your trash or recycling bins to capture your personal information: charge receipts, copies of credit applications, insurance receipts, insurance forms, physician statements, bank checks and statement, expired charge card. Identity thieves may pose as representatives of banks, Internet services providers and even government agencies to get you to reveal your social security number, mother's maiden name, financial account numbers, and other identifying information. The Internet is making identity theft one of the signature crimes of the digital era. Once an ID theft is underway, the Internet can make the work considerably easier, allowing criminals to work anonymously and from all 4 Abstract over the world. If an identity thief needs to know someone's Social Security number, it is easy enough to buy it on the Internet. Social Security numbers are the keys to the kingdom on the websites. Those digits would be enough to get a driver's license in someone's name and to start a full-scale identity theft. The theft of personal data from websites is also growing. The websites you visit can look back at you as you surf the Internet. You may be unintentionally revealing information about your self as you move through cyberspace. The identity thieves are out there and someone could be spying on you with a commercial software called "spyware." Someone can send you a spyware wrapped in an e-mail greeting card programmed to install itself when you open the card and you would never know. Identity theft is a complex crime at best. The impostor can sometimes be someone you love. 5 TABLE OF CONTENTS Abstract Page 1 Table of Contents Page 4 Introduction……………………………………………………………………Page 5 Background and Significance……………………………………………… Page 9 Reference…………………………………………………………………… Page 20 6 INTRODUCTION 7 Introduction Identity Theft is considered the fastest growing financial crime in the country, affecting an estimate 500,000 - 700,000 people annually. Identity Theft occurs when the pilfering of people's personal information for use in obtaining credit cards, loans and other goods. Identity thieves may pick through your trash or recycling bins to capture your personal information: charge receipts, copies of credit applications, insurance receipts, insurance forms, physician statements, bank checks and statement, expired charge card. Ask that a password only access be used before any inquires or changes can be made on any accounts. Identity thieves may pose as representatives of banks, Internet services providers and even government agenices to get you to reveal your social security number, mother's maiden name, financial account numbers, and other identifying information. Despite your best efforts to manage the flow of your personal information or to keep it to yourself, skilled identity thieves may use a variety of methods low and hi-tech to gain access to your data. 8 Introduction Here are some of the ways impostors can get your personal information and take over your identity: They steal wallets and purse containing your identification and credit and bank cards. They steal your mail, including bank and credit card statements, pre-approved credit offers, telephone calling cards and tax information. They complete a "change of address form" to divert your mail to another location. They rummage through your trash, or the trash of businesses for personal data in a practice known as "dumpster diving". They fraudulently obtain your credit report by posing as a landlord, employer or someone else who may have a legitimate need for and a legal right to the information. They get your business or personnel records at work. They find personal information in your home. They use personal information you share on the Internet. They buy your business or personnel records at work. They buy your personal information from "inside" source, for example, an identity thief may pay a store employee for information about you that appears on an application for goods, services or credit. Here are some of the Ways Impostors use your Personal Information: 9 Introduction They call your credit card issuer and pretending to be you, ask to change the mailing address on your credit card account, The impostor then runs up charges on your account. Because your bills are being sent to the new address it may take some time before you realize there's a problem. They open a new credit card account, using your name, date of birth and social security number. They establish phone or wireless service in your name. They open a bank account in your name and write bad checks on that account. They file for bankruptcy under your name to avoid paying debts they've incurred under your name, or to avoid eviction. They counterfeit checks or debit cards, and drain your bank account. They buy cars by taking out auto loans in your named. 10 BACKGROUND AND SIGNIFICANCE 11 Background and Significance Abraham Abdallah, a Brooklyn busboy, high-profile arrest in March, brought national attention to Identity Theft, which the FBI says is the nation's fastest-growing white-collar crime. Abraham Abdallah, had Forbes Magazine's issue on the 400 Richest People In America, plus social security numbers, credit card numbers, bank-account information and mother's maiden names of an A list of intended victims drawn from the issue, including Steven Spielberg, Oprah Winfrey and Martha Stewart. Abraham Abdallah is accused of using websites, e-mail, and off-line methods to try to steal the celebrities' identities and make off with millions in assets . One scheme that was caught in time; he allegedly sent an e-mail purporting to come from Siebel Systems founder Thomas Siebel to Merrill Lynch, directing that $10 million to be transferred to offshore accounts. Abraham Abdallah , who has yet to be indicted on Federal charges, denied the charges at the time of his arrest. Identity Theft was central to a millennium plot to blow up Los Angeles International Airport, Algerian Mohammed Amry, stole the information of 21 people from the Cambridge, Mass, fitness club where he worked to create false green cards and social security cards, authorities have alleged. The fake IDs were used to open bank accounts, prosecutors said, allegedly, counterfeit checks were deposited into those accounts and money was withdrawn from them. Identity Theft has become a Federal offense since the Identity Theft and 12 Background and Significance Assumption Deterrence Act was signed into law in October 1998. According to the TransUnion Corporation, a national credit bureau, the number of identity theft inquiries to its Theft Victims Assistance Department increased 1400 percent... The U.S. Postal Service reports that 50,000 people a year have become victims of identity theft and the U.S. Treasury Department estimates that identity theft causes from 2 billion to 3 billion in losses annually credit alone. In cases investigated by the Secret Services, losses jumped 75 percent. In some of the worst cases, when identity thieves commit crimes and use their false identities to mislead police, victims of identity theft suddenly find themselves saddled with criminal records. Identity thieves may pose as representatives of banks, Internet services providers and even government agenices to get you to reveal your social security number, mother's maiden name, financial account numbers, and other identifying information According to the Federal Trade Commission, social security numbers are principal componets used to commit identity theft. 13 Background and Significance U. S. Senator Dianne Feinstein (D-CA.) introduced bipartisan legislation to combat the growing practice of "Identity Theft." Specifically the Identity Theft Prevention Act of 2000, would eliminate the loophole in the Fair Credit Reporting Act, that permits credit bureaus to sell personal information such as social security numbers, birth dates, and mother's maiden names to marketers without restrictions. It would authorize the Social Security Administration to impose up to a $5,00.00 maximum fine for the misuse of a social security number. Minimize your risk by giving your social security number only when absolute necessary. Ask to use other types of identifiers when possible. You don't have to give a business your social security number just because they ask for it. If someone ask for your social security number, ask the following questions: Why do you need my social security number? How will my social security number be used? What law requires me to give you my social security number? Ask that a password only access be used before any inquires or changes can be made on any accounts. Most "Identity Theft" stilll begins off line, but once an ID theft is underway, the Internet can make the work considerably easier. The Internet is making identity theft one of the signature crimes of the digital era. The Internet allows these criminals to work 14 Background and Significance anonymously and from all over the world, "said Gregory Regan, head of the Secret Service's financial crimes division. Law enforcement officials also say that stolen personal and financial information can be easily transmitted worldwide on the Internet by criminal groups that have begun to specialize in identity theft because it is so lucrative. Federal investigators have encountered cases in which credit card numbers stolen in the United States have been used a day or two later in Tokyo or Hong Kong. If an identity thief needs to know someone's Social Security number, it is easy enough to buy it on the Internet. One Web site, docusearch.com. will retrieve a person's Social Security number in one day for $49.00....Net Detective 2000, an online company, promotes itself as "an amazing new tool that you use to find out everything you ever wanted to know about your friends, family, neighbors, employees, and even your boss! Social Security numbers are the keys to the kingdom on the websites. Those digits would be enough to get a driver's license in someone's name and to start a full-scale identity theft. Before long, credit ratings could be ruined, bank accounts drained. A particular problem: fast proliferating websites that sell fake IDs. Credit card fraud from identity theft now tops 1 billion a year. All a thief needs to do is find a credit card receipt and expiration date, then print a fake 15 Background and Significance credit card with a different name signature strip and magnetic strip. The fake card is then used to run up charges on the original holder's account. However, the Ohio Senate has passed legislation which could thwart the process. Senate Bill 250 would require that no more than the last five numbers of the account numbers be printed on the receipts. So even if a criminal is able to get someone else's credit card slip he would not have the ease of creating a fraudulent card. It was a fake-ID seller who helped an identity thief run up $30,000 in false charges to Charles Glueck, a Metarie, LA, dentist. After Glueck lost his wallet, the man who took it went online to get a driver's license with his picture and Glueck's identity. He then started charging. Glueck was shocked to learn later from police that the website has not broken the law because when it shipped the driver's license to the thief, the license was marked for "novelty" use only." "Once you know how to work a computer, you can be whoever you want to," Glueck says. The theft of personal data from websites is also growing. Internet users are well aware they are trading off privacy when they dial up their modems. Information about their Internet usage has being collected without their knowledge. You may be unintentionally revealing information about your self as you move through cyberspace. The websites you visit can look back at you as 16 Background and Significance you surf the Internet. Many use "cookies' to collect data about your visit-where you go in the site, what links you click on. Your web browser may also be giving away information about you as you travel through cyberspace. Whether you know it or not, your browser's "preferences" menu may include your name, email address and other information that can be captured and stored by sites you visit. Your Internet protocol address can also give you away. Every computer on the Internet is assigned an IP address, the online equivalent of a street address, that allows it to receive data. Dial-up connections usually assign you a new IP address every time you connect. If you use a fixed connection (like DSL or cable), you may have a permanent IP address that any website you visit can capture and, by comparing it against a database, connect to you by name. That personal information you provided to a website might be sold or stolen. Everything you buy online is connected to you by your name. Web retailers are collecting a sizable data of information on individual purchases. Ecommerce sites routinely share your information, or sell it. Amaze, which once permitted users to choose to keep their data confidential rewrote its privacy policy last year to say custom data are an "asset" it may sell of transfer in the future. Egghead.com sent a chilly wind through cyberspace late last year when it disclosed that hacker had broken into its system and may have accessed millions of credit-card numbers from numbers from its data base. It was a stark reminder that financial data are only as safe as every website you share them with. 17 Background and Significance The identity thieves are out there and someone could be spying on you. You can buy commercial spyware, but you can use VNC, which can be downloaded for free. VNC was designed to help people link their own computers. But it also works as a cheap and easy way to keep tabs on someone. The great thing about controlling another person's computer is that you can surf the web as if you were him or her. When you go to a site, his or her IP address--a kind of digital fingerprint--is the one that gets left behind, not yours. You can look over a person's shoulder as they surf the net. It is weird to watch someone's cursor click its way across your screen, as they open their e-mail you can read it. You can send someone a spyware wrapped in an e-mail greeting card programmed to install itself when they open the card and they would never know. Thieves who steal the identities of others to forge credit cards, passports and other documents would face speedier prosecution and tougher prison sentences under guidelines announced by Federal officials. The sweep coincides with legislation moving through Congress, which would force judges to add time to sentences for crimes involving identity theft. 18 Background and Significance At a Federal Trade Commission hearing, Maureen Mitchell described why assistance is necessary to victims of identity theft. Saying that, she has logged over 400 hours of times trying to clear their names and restore their good credit. Words are unable to adequately express the gamut of emotion that we have experience as victims". Another victim wrote, "I have spent an ungodly number of hours trying to correct the damage that has been done by the individual who stole my identity. Professionally, as a teacher and tutor, my hours are worth thirty five dollars. I've been robbed of $5,250 in time. I have been humiliated in my local stores because my checks have been rejected at the checkout. I am emotionally drained. I am a victim, and Congress needs to recognize me as such." The Federal Trade Commission phone counselors, advise consumers to notify their local police departments both because local law enforcement may be in the best position to catch and bring the perpetrator to justice and because a police report is among the best means of demonstrating to would be creditors and debt collectors that a consumer is a genuine victim of identity theft. More than half the states have enacted their own identity theft legislation. Consumers also report problems with the institutions that provided the credit, goods or services to the identity thief in the consumer's name. These institutions often attempts to collect the bad debt from the victim, or report the 19 Background and Significance bad debt to a consumer reporting agency, even after the victim believes that he or she has shown that the debt is fraudulent. Consumers further complain that these institutions inadequate or lax security procedures failed to prevent the identity theft in the first place; that customer service or fraud departments were not responsive; or that the companies refused to close or correct the unauthorized accounts after notification by the consumer. The Privacy Rights Clearing House, which works with victims, says it takes an average victim of identity theft two years to clear their credit rating. Identity theft is a complex crime at best. When the impostor is someone you know, the impact of the crime magnifies dramatically. How do you prosecute your own mother? What kind of father would allow the police to arrest his son? The best define against credit card thieves is still the consumer securing or destroying all credit information, particular care should be paid to monthly statements, which will continue to have the full account numbers. Do not give out personal information on the phone, through the mail or over the Internet unless you have initiated the contact or know who you're 20 Background and Significance dealing with. Keep items with personal information in a safe place in your home, away from service workers, employed outside help, and or roommates. The identity thief can be someone you love. 21 Reference 1. Gov't Web First Gov 2. New York Times on the Web, April 3, 2000, Aided by Internet, Identity Theft Soars, by Timothy L. O'Brien, pg. 1 3. Gov't Guide: Identity Theft How identity Theft Occurs; Government Guide I.D. Theft 4. Gov't Guide: I.D. Theft How identity Theft Occurs; Government Guide I.D. Theft 5. Government Guide I.D. Theft 6. "Time". Com, Internet Insecurity, by Adam Cohen 7. Findlaw Legal News, Associated Press, May 2, 2002 Protecting Americans from Identity Theft Congressman Steven C. LaTourette, 19th District 8. Ohio, Identity Theft Prevention Act of 2001 New York times on the Web, 9. April 3, 2000, Aided by Internet, Identity Theft Soars, by Timothy L. O'Brien, pg. 1 10. Gov't Guide: I.D. Theft How Identity Theft Occurs 11. Gov't Web First Gov 12. http://Feinstein.senate.gov/ Identity Theft, March 30, 2000, pg 1 13. Government Guide I.D. Theft 22 14. April 29, 02, the Times reporter, Dover-New Philadelphia, Ohio, on Credit Card Fraud Reference 15. Government Guide I.D. Theft 16. "Time".com, Internet Insecurity, by Adam Cohen 17. New York Times on the Web, April 3, 2000, Aided by Internet, Identity Theft Soars, by Timothy L. O'Brien, pg. 2-4 18. April 29, 02, The Times Reporter, Dover-New Philadelphia, Ohio, On Credit Card Fraud 19. "Time". Com, Internet Insecurity, by Adam Cohen 20. Find Law legal News Associated Press, May 2, 2002, Justice Dept., Congress Press Law enforcement Crackdown On Identity Theft, by Laurie Kellman 21. Gov't Web First Gov 22. "Time". Com, Internet Insecurity, by Adam Cohen 23. Gov't Web First Gov 24. "Time". Com, Internet Insecurity, by Adam Cohen 25. April 29, 02, The Times Reporter, Dover-New Philadelphia, Ohio, On Credit Card Fraud 26. Government Guide I.D. Theft 23