identity theft

Identity Theft

TACTYC Conference

Georgia Perimeter College

May 19, 2006

Who Is at Risk?

You Are!!!

Identity Theft

What is it?

Who commits it?

How does it happen?

What are the possible consequences?

How can I prevent it?

What must I do if it happens to me?

What Is Identity Theft?

n : the co-option of another person's personal information (e.g., name, social security number, credit card number, passport) without that person's knowledge and the fraudulent use of such knowledge

-- dictionary.com

Federal Identity Theft and Assumption Deterrence Act18 U.S.C. § 1028(a)(7)

Federal law passed in 1998

Prohibits “knowingly transfer[ring] or us[ing], without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law.”

Other Related Federal Statutes

18 U.S.C. § 1028 – identification fraud

18 U.S.C. § 1029 – credit card fraud

18 U.S.C. § 1030 – computer fraud

18 U.S.C. § 1341 – mail fraud

18 U.S.C. § 1343 – wire fraud

18 U.S.C. § 1344 – financial institution fraud

Georgia Statute §16-9-121. Identity Fraud Law

“A person commits the offense of identity fraud when without the authorization or permission of a person with the intent unlawfully to appropriate resources of or cause physical harm to that person, or of any other person, to his or her own use or to the use of a third party he or she: (1) Obtains or records identifying information of a person which would assist in accessing the resources of the other person; or(2) Accesses or attempts to access the resources of the other person through the use of identifying information.”

Identifying Information (Partial List)

Names (current or former)

Social Security numbers

Driver’s license numbers

Bank account/credit card numbers

Birth dates

Tax identification numbers

Medical identifications

Statistics

Source: Federal Trade Commission Identity Theft Data Clearinghouse reportOver 635,000 consumer identity theft &

fraud complaints received in 200461% classified as fraud, 39% identity theft.Reported losses of over $547 million.

27,300,000 million victims in past 5 years

Statistics (cont.)

Source: GA Stop ID Theft Network2,592 victims reported in Georgia in 2001

Seventh-highest in nation

Atlanta was 11th among major cities for reported identity theft in 2004 according to FTC

Statistics (cont.)

Source: ChoicePoint Data Disclosures Report, 2005

As of Nov. 15, 125 data disclosure incidents this year57 million people potentially affected

Statistics (cont.)

Losses to banks and final institutionsEstimated $48 billion in 2003

Average loss per business victim$10,200

Average loss to individual victims$1,180175 or more hours resolving problems over

two or more years

Who Commits Identity Theft?

Professional thieves

Strangers

Employees of businesses

Family members and relatives

Friends/acquaintances

Who Commits Identity Theft?

An estimated nine percent of ID theft cases involve family

Another ten percent of ID theft cases involve someone with another form of personal relationship (friend/ acquaintance, co-worker, etc.)

How Does Identity Theft Occur?

Non-technological methods still used for the majority of cases “Dumpster diving”Dishonest employeesMail theft/interceptionMasquerading and “Social hacking” “Shoulder surfers”Telemarketing scams

How Does Identity Theft Occur? (cont.)

Technology usage is growing rapidlyWireless communication interceptionCamera phonesSoftware toolsCredit card “skimming”ATM spy cameras “Phishing” and “Pharming” schemes

Potential Consequences to Victims

Financial lossesCivil issuesCriminal problems

Financial Consequences

Direct monetary losses Credit/ATM/Debit cards Checks

Indirect monetary losses Lost time/wages Out-of-pocket expenditures Legal fees

Credit Denial of credit Increased rates for loans/mortgages

Civil Consequences

LawsuitsLoss of current jobFailure to be hired for new job

Criminal Consequences

Approximately 15% of victims obtain a criminal record due to identity theftAlmost impossible to completely remove criminal record once it is in law enforcement databases

How Can I Prevent It?

Total prevention is impossible!

Minimize risks as much as possible

Protect four primary areas InformationPropertyDocumentsTechnology

Protect Your Information

Do not give out information unless you must!

Ask why a piece of information is neededYou can refuse to give information, but you

may not receive the service in returnDo not use your Social Security number as

an identification numberNeeded by IRS, SSA

Protect Your Information (cont.)

Make sure you know who is requesting the informationAre they legitimate?

Do not give out personal information unless you initiate the call/email


Be especially cautious with the “big three”:Social Security numberPassport numberBank/credit account numbers


Check your credit reports regularlyEvery four months, request one credit report

from one credit bureau

Federal law allows you one free copy of each bureau’s credit report annually

See http://www.annualcreditreport.com/ for information

Each credit bureau must be dealt with individually


Should you use a credit monitoring service? In most cases, noException is if you are already a victim of

identity fraud

Note: credit bureaus will try to sell you credit monitoring when you request free reports. Be aware!


Run a public records search annuallyAvailable free from ChoicePointAllows you to check publicly available data

about yourself for accuracyCan provide clues that identity fraud has

occurred


Guard PINs and other identifiers from spying

Consider using electronic bill delivery/ bill paying services Removes possibility of mail theft Allows earlier detection of unauthorized activity Encourages more careful monitoring of financial

activity


Keep a record of all bank/credit account numbers along with phone numbers

Keep a photocopy of your wallet contents and passport in a safe place


Omit personal identifying information from resumes and job applicationsYou will eventually have to provide this if

hiredShould not be needed until late in hiring

process If demanded early, do you really want to

work there?

Protect Your Property

Keep property secured at all times

Carry only necessary items in purse/walletMinimize number of credit cardsDo not routinely carry Social Security card,

passport, birth certificate, or any document with bank routing information

Protect Your Mail

Use a locked mailbox, or pick up mail promptly

Place all outgoing mail in secured mailbox

Keep track of billing cycles

Make sure all expected mail is actually received

Protect Your Documents

Store identifying documents in a safe, locked place

Critical because of business liabilityGeorgia law – up to $10,000 fine PLUS

unlimited civil liability

Protect Your Documents (cont.)

Shred any personal or business document with identifying information before throwing away

Protect Your Technology

Control access to computers

Minimize storage of sensitive data on laptop computers and centralized network storage

Keep safeguards up to dateOperating system updatesSecurity program updates

I’m a Victim – What Do I Do Now?

Some measures apply to all cases

Others only for certain situations

Record-keeping

Send all correspondence Certified mail Return receipt requested

Document EVERYTHING Log all phone contacts

Company name, contact name, date, time Keep copies of all correspondence you send

forever File ANYTHING you receive that MAY relate to the

situation

File a Police Report

Contact local law enforcement

Georgia law requires thatLaw enforcement must take reportReport must be forwarded to Governor’s

Office of Consumer AffairsConsumer Affairs will forward to Georgia

Crime Information Center

File a Police Report (cont.)

Get copies of the law enforcement reportKeep for your recordsSend copies to creditors when reporting

fraudulent activity

Notify Credit Bureaus

All three credit bureaus should be alerted

Call first, follow up in writing

Request fraud alerts on your files

Normal duration of fraud alert is 90 – 180 days Request, in writing, extension for seven

years

Notify Creditors

Call first, follow up in writingNotify ALL creditorsBanksCredit card companiesOther lendersPhone companiesUtilities ISPs and other service providers

Notify Creditors

Existing creditorsReport fraudulent activity immediatelyCancel existing accountRequest replacement cards with new

account numbers

Notify Creditors

Fraudulently obtained accountsTake action as soon as you discover

existence of accountState that you never requested accountProvide with copy of police report and

fraud affadavitRequest that account be closedGet confirmation in writing

Get Credit Reports

Should be automatically sent at no charge when fraud alert is filedReview carefully for inaccurate informationRemember that some inaccurate

information may predate the crime

Dispute all inaccurate information in writing

Report the Crime

Federal Trade Commissionhttp://www.consumer.gov/Fill out FTC’s ID Theft Affidavit

Many companies will accept as documentationOthers insist on their own paperwork

Additional Agencies

U.S. State Department (passport agency)

Social Security Administration

U.S. Postal Inspection Service/local Post OfficeDepartment of Motor VehiclesInternal Revenue Service/Georgia Department of Revenue

Check approval agencies

When Criminal Activity is Involved

You MUST take additional steps

Failure to do this could result in ArrestJail timeSignificant expense to repeatedly clear

your record

When Criminal Activity is Involved (cont.)

Have local law enforcement confirm your identityFingerprintsPhotographCopies of identifying information

Have them send information to other jurisdictions involved as well


Request a “key name switch” in databasesEntry should be under impostor’s actual

name If not known, as “John/Jane Doe”

Make sure your name is listed as an alias, not as real name

Include local, state, federal databases


Obtain a clearance document Called by different names:

Clearance letter – Mis IDCertificate of release

Make multiple copies of this documentCarry a copy with you at ALL timesMake sure a trusted friend/family member has

a copy

Long-Term Damage Control

Do NOT pay any fraudulent charges/bills/ checks per Fair Credit Reporting Act provisions

Continue to get credit reports regularly (at least every six months)

Carefully monitor all financial activity

Carefully monitor mail

Do NOT change your Social Security number

Resources -- Federal Agencies

Federal Trade Commission http://www.consumer.gov/idtheft/

Department of Justice http://www.usdoj.gov/criminal/fraud/idtheft.html

Social Security Administration http://www.ssa.gov/pubs/idtheft.htm

U.S. Postal Inspection Service http://www.usps.com/postalinspectors/welcome2.htm

Resources – State Agencies

Georgia Stop Identity Theft Networkhttp://www.stopidentitytheft.org/

Resources -- Nonprofit Organizations

Better Business Bureauhttp://www.bbbonline.org/IDTheft/

Identity Theft Resource Centerhttp://www.idtheftcenter.org/index.shtml

Privacy Rights Clearinghousehttp://www.privacyrights.org/identity.htm

Credit Bureaus

Equifax – http://www.equifax.com/

Experian – http://www.experian.com

TransUnion – http://www.transunion.com

Check Approval Companies

CheckRite: (800) 766-2748

Chexsystems: (800) 428-9623

CheckCenter/CrossCheck: (800) 843-0760

Certigy/Equifax: (800) 437-5120

International Check Services: (800) 526-5380

SCAN: (800) 262-7771

TeleCheck: (800) 710-9898

Opt-Out Resources

Pre-screened credit offers 1-888-5-OPTOUT

Credit Bureau marketing lists

Write each credit bureau individually

Telemarketing offers http://www.donotcall.gov/

Direct mail marketing http://www.the-dma.org/ consumers/offmailinglist.htm

Email marketing http://www.dmaconsumers.org/offemaillist.html

In Closing

This presentation is available online athttp://www.gpc.edu/~jbenson/presentations/idtheft.ppt