1 office of the attorney general commonwealth of virginia identity theft
TRANSCRIPT
1
Office of the Attorney Office of the Attorney General Commonwealth of General Commonwealth of
VirginiaVirginia
Identity Theft
2
OutlineOutline
Computer Crime SectionComputer Crime Section ID Theft StatisticsID Theft Statistics ID Theft LawsID Theft Laws ID Theft TrendsID Theft Trends ID Theft TipsID Theft Tips Resources / Contact InfoResources / Contact Info
3
Office of the Attorney General’s Office of the Attorney General’s
Computer Crime Computer Crime SectionSection
Formed in July 1999Formed in July 1999
Investigate & prosecute ID theft, child Investigate & prosecute ID theft, child exploitation, and Computer Crime Act casesexploitation, and Computer Crime Act cases
Coordinate Commonwealth’s Internet crime Coordinate Commonwealth’s Internet crime fightingfighting
Assist Law Enforcement Officers & Assist Law Enforcement Officers & Commonwealth AttorneysCommonwealth Attorneys
Assist with computer crime and technology Assist with computer crime and technology legislationlegislation
4
5
Identity Theft Identity Theft StatisticsStatistics
Compiled by the Compiled by the Federal Trade Federal Trade
Commission (FTC)Commission (FTC)
6
7
8
9
10
11
12
ID THEFT LAWSID THEFT LAWS
13
Identity Theft Protection Identity Theft Protection ActAct
State Agencies Regulated (2.2-3800)State Agencies Regulated (2.2-3800) ““Government Data Collection and Government Data Collection and Dissemination Practices Act”Dissemination Practices Act”
Ensures safeguards for personal privacy by Ensures safeguards for personal privacy by recordkeeping agencies of the recordkeeping agencies of the Commonwealth and political subdivisionsCommonwealth and political subdivisions
Virginia Code Section 18.2-186.3Virginia Code Section 18.2-186.3Felony for acquiring and misusing Felony for acquiring and misusing personal identifying informationpersonal identifying information
14
Identity TheftIdentity Theft Virginia Code Section § 18.2-186.3Virginia Code Section § 18.2-186.3
A. It shall be unlawful for any person, without the A. It shall be unlawful for any person, without the authorization or permission of the person or persons who authorization or permission of the person or persons who are the subjects of the identifying information, with the are the subjects of the identifying information, with the intent to defraud, for his own use or the use of a third intent to defraud, for his own use or the use of a third person, to: person, to:
1. Obtain, record or access identifying information 1. Obtain, record or access identifying information which is not which is not available to the general public that would available to the general public that would assist in accessing assist in accessing financial resources, obtaining financial resources, obtaining identification documents, or identification documents, or obtaining benefits of obtaining benefits of such other person; such other person;
2. Obtain goods or services through the use of 2. Obtain goods or services through the use of identifying identifying information of such other person; information of such other person;
3. Obtain identification documents in such other 3. Obtain identification documents in such other person's name; or person's name; or
4. Obtain, record or access identifying information 4. Obtain, record or access identifying information while while impersonating a law-enforcement officer or an impersonating a law-enforcement officer or an official of the official of the government of the Commonwealth. government of the Commonwealth.
15
Identity TheftIdentity Theft PENALTIESPENALTIES Class 1 MisdemeanorClass 1 Misdemeanor If over $200, Class 6 FelonyIf over $200, Class 6 Felony If 50 or more person’s identifying info If 50 or more person’s identifying info
stolen, then Class 6 Felonystolen, then Class 6 Felony Class 5 Felony if information is used to Class 5 Felony if information is used to
commit another crimecommit another crime
16
NameSocial Security NumberCredit Card NumberDOBDriver’s LicensePassport NumberFingerprintVoiceprintRetina or Iris ImageElectronic ID Number
“Personal Identifying Info” includes:
17
Database BreachesDatabase Breaches
Unauthorized acquisition 50 Unauthorized acquisition 50 or more persons in same or more persons in same transaction prohibited (18.2-transaction prohibited (18.2-186.3)186.3)
Felony: Up to 10 yearsFelony: Up to 10 yearsResponse to Choicepoint, Response to Choicepoint, Lexis-Nexis,Lexis-Nexis, DSW DSW
18
Database Breach Database Breach Cont.Cont.
2008 Legislation2008 Legislation Requires companies to notify AG’s Office and Requires companies to notify AG’s Office and
affected Virginia consumers if database of affected Virginia consumers if database of personal info is breachedpersonal info is breached
If over 1,000, also must notify credit reporting If over 1,000, also must notify credit reporting agenciesagencies
““Reasonably harmed” standard triggers Reasonably harmed” standard triggers notificationnotification
Without “unreasonable delay”Without “unreasonable delay” Must alert law enforcement if would impede Must alert law enforcement if would impede
criminal investigationcriminal investigation
19
Destruction of Public Records Section 42.1-82
The procedures for the disposal, physical The procedures for the disposal, physical destruction of destruction of public records withpublic records with SS #s by SS #s by
ShreddingShredding ErasingErasing
Otherwise modifying Otherwise modifying SS #s to make themSS #s to make them unreadable or undecipherable by any means. unreadable or undecipherable by any means.
20
Credit Reporting Agencies-Credit Reporting Agencies-Notice of Police ReportsNotice of Police Reports
Virginia Code §Virginia Code § 18.2-186.3:118.2-186.3:1--a --a new section new section requires consumer requires consumer reporting agencies, reporting agencies, upon notice that a upon notice that a police report has police report has been filed, to note been filed, to note on person’s credit on person’s credit report within 30 report within 30 days of notice.days of notice.
21
Virginia Computer Virginia Computer Crimes ActCrimes Act
Computer Crimes Act: Title 18.2-152.1 – Computer Crimes Act: Title 18.2-152.1 – 152.15152.15 Computer Crimes Act DefinitionsComputer Crimes Act Definitions Computer FraudComputer Fraud SPAMSPAM Computer TrespassComputer Trespass Computer Invasion of PrivacyComputer Invasion of Privacy Theft of Computer ServicesTheft of Computer Services Harassment by ComputerHarassment by Computer Using Computer to Gather ID Info Using Computer to Gather ID Info
(Phishing)(Phishing)
22
FishingFishing
23
Virginia Computer Crimes Virginia Computer Crimes ActAct
- PhishingPhishing § § 18.2-152.5:118.2-152.5:1. Using a computer to gather . Using a computer to gather
identifying information; penalties. identifying information; penalties. A. It is unlawful for any person…to use a computer A. It is unlawful for any person…to use a computer
to obtain, access, or record, through the use of to obtain, access, or record, through the use of material artifice, trickery or deception, any material artifice, trickery or deception, any identifying information…Any person who violates identifying information…Any person who violates this section is guilty of a Class 6 felony. this section is guilty of a Class 6 felony.
B. Any person who violates this section and sells or B. Any person who violates this section and sells or distributes such information to another is guilty of a distributes such information to another is guilty of a Class 5 felony. Class 5 felony.
C. Any person who violates this section and uses C. Any person who violates this section and uses such information in the commission of another crime such information in the commission of another crime is guilty of a Class 5 felonyis guilty of a Class 5 felony
24
25
Virginia Computer Virginia Computer Crimes ActCrimes Act
Phishing VariationsPhishing Variations Banking TrojansBanking Trojans
Website BasedWebsite Based
“ “Vishing”Vishing” VOIP BasedVOIP Based
Spear PhishingSpear Phishing Individual TargetingIndividual Targeting
26
Virginia Computer Virginia Computer Crimes ActCrimes Act
PharmingPharming Malicious VirusesMalicious Viruses
SpywareSpyware Web Based/Personal Email UseWeb Based/Personal Email Use ““419” Scams419” Scams
27
Virginia Computer Virginia Computer Crimes ActCrimes Act
"Vishing" E-mail Example"Vishing" E-mail Example
28
From:From: favour dickson [mailto:[email protected]] favour dickson [mailto:[email protected]] Sent:Sent: Thursday, January 31, 2008 9:43 AM Thursday, January 31, 2008 9:43 AMSubject:Subject: ATM, ATM,
ATM,ATM, We have been instructed to pay $450,000 to you via ATM Card system.We have been instructed to pay $450,000 to you via ATM Card system.By this method, a domiciliary account will be created in your name and you will By this method, a domiciliary account will be created in your name and you will be given an account number and a pin code to enable you check and monitor be given an account number and a pin code to enable you check and monitor your account online while an ATM CARD will be sent to you to for withdrawal your account online while an ATM CARD will be sent to you to for withdrawal from any ATM centre worldwide. from any ATM centre worldwide.
There are 250 banks in the world on the " ATM International Card Operation There are 250 banks in the world on the " ATM International Card Operation System" you can withdraw your money from depending on the one you prefer System" you can withdraw your money from depending on the one you prefer that operates ATM withdrawer system in 149 countries and nearer to you. that operates ATM withdrawer system in 149 countries and nearer to you.
You are requested to contact our ATM PAYMENT CENTER. Breach in Republic You are requested to contact our ATM PAYMENT CENTER. Breach in Republic of Benin Cotonou West Africa, contact person Mrs Gladys Offoer on email of Benin Cotonou West Africa, contact person Mrs Gladys Offoer on email address address [email protected]@gmail.com
Contact her immediately so that you can be told what is require for the Contact her immediately so that you can be told what is require for the account to be activated as well as delivery of the card to you. account to be activated as well as delivery of the card to you.
Mr.Favou DicksonMr.Favou Dickson DirectorDirectorCredit Payment Department.Credit Payment Department.Bell South Associates Inc United state of AmericaBell South Associates Inc United state of America
29
Common Sources of Common Sources of Identity TheftIdentity Theft
Mail theftMail theft Dumpster DivingDumpster Diving Unscrupulous Unscrupulous
employeesemployees Internet FraudInternet Fraud Stolen/lost walletStolen/lost wallet Medical records Medical records
with confidential with confidential informationinformation
Burglary/larceny Burglary/larceny (residential/auto)(residential/auto)
““Friends” and Friends” and relativesrelatives
Phone scamsPhone scams Shoulder surfingShoulder surfing Unethical use of Unethical use of
public public documentsdocuments
30
Who Should Victims Who Should Victims Contact?Contact?
Credit BureausCredit Bureaus Federal Trade Commission (FTC)Federal Trade Commission (FTC) Creditors (Card Issuers & Utilities)Creditors (Card Issuers & Utilities) Local Law EnforcementLocal Law Enforcement Office of the Attorney GeneralOffice of the Attorney General
31
Credit BureausCredit Bureaus Immediately call the fraud units of the three
credit reporting companies. Report the theft of credit cards, and the
misuse of their account numbers. Request that their credit accounts be flagged Victims should request that a statement be
added to their reports, such as: “My identification has been used to apply for fraudulent credit. Contact me at (victim’s telephone number) to verify ALL applications.”
32
Credit BureausCredit Bureaus
33
CreditorsCreditors Victims should contact all creditors
immediately with whom their name has been used fraudulently—by telephone and in writing.
They should get replacement cards with new account numbers for their own accounts that have been used fraudulently.
They should ask that old accounts be processed as “account closed at consumer’s request.”
34
Victims of unauthorized use of a
credit card will be liable for no more
than the first $50 of the loss, although
this is often waived and the victim will
not be required to pay any part of the
loss. (15 USC 1643.)
Request that credit grantors provide
the victim with a copy of all
fraudulent credit applications and all
statements of incurred charges.
35
The Identity Theft The Identity Theft PassportPassport
36
The Identity Theft PassportThe Identity Theft Passport
Two ways will be generated:Two ways will be generated: Filing of Police Report OR Expungement of Record Filing of Police Report OR Expungement of Record
in accordance with § 19.2-392.2in accordance with § 19.2-392.2 The Office of the Attorney General, in cooperation The Office of the Attorney General, in cooperation
with the State Police, may issue an "Identity Theft with the State Police, may issue an "Identity Theft Passport" stating that such an order has been Passport" stating that such an order has been submitted. submitted.
The Office of the Attorney General may provide The Office of the Attorney General may provide access to such information to criminal justice access to such information to criminal justice agencies and individuals who have submitted a agencies and individuals who have submitted a court order pursuant to this section. court order pursuant to this section.
37
38
Office of the Attorney General of VirginiaOffice of the Attorney General of Virginiahttp://www.vaag.comhttp://www.vaag.com
Internet Crime Complaint Center Internet Crime Complaint Center http://www.ic3.govhttp://www.ic3.gov
Federal Trade Commission (FTC)Federal Trade Commission (FTC)http://www.ftc.govhttp://www.ftc.gov
39
Questions?
40
Office of the Attorney Office of the Attorney
GeneralGeneral Commonwealth of Commonwealth of
VirginiaVirginia 900 East Main Street900 East Main Street Richmond, VA 23219Richmond, VA 23219
Computer Crime Section [email protected]
http://VAAG.COM (804) 786-2071