Identity Theft: Why Would Anyone Want My Identity?

Identity Theft:Why Would Anyone Want My Identity? • Dr. Charles D. Knutson • Brigham Young University • www.charlesknutson.net

Identity theft • This is the information age • Everything is electronic • "Who is who?" is a trickier question • Your identity is extremely valuable • Brief Quiz: • Who has been a victim at any level? • Credit card purchase that you didn't make • Someone uses your information

Some statistics • 2003 to 2006 • Decrease in number of victims • Increase in value of crime • 9 million Americans each year • $56.6 billion in 2006 • Average time for victim to resolve: • 40 hours • 73% of crimes involve credit cards

True story - Michelle Brown "Over a year and a half from January 1998 through July 1999, one individual impersonated me to procure over $50,000 in goods and services. Not only did she damage my credit, but she escalated her crimes to a level that I never truly expected: she engaged in drug trafficking. The crime resulted in my erroneous arrest record, a warrant out for my arrest, and eventually, a prison record when she was booked under my name as an inmate in the Chicago Federal Prison." -- U.S. Senate Committee Hearing, July 2000

Not a true story…

Forms of identity theft • Financial identity theft • Criminal identity theft • Identity cloning • Business/commercial identity theft

Financial identity theft • Use someone else's personal information to obtain goods and services • Credit card fraud • Line of credit fraud • Loan/mortgage fraud

Criminal identity theft • False identification to avoid arrest or incarceration • Illegal immigration • Terrorism • Espionage • Blackmail

Identity cloning • Use someone else's information to assume control of their daily life functions • Bills, mail, financial affairs, civil affairs

Business/commercial • Use business name and information to obtain credit • Or perform some other financial transaction

Self-revealing crimes • Intent is to take advantage and then abandon the scam • Leaves the victim picking up pieces • Loan fraud in someone else's name • Equipment or merchandise secured • First notice of payment comes to victim (moment of discovery) • No intent to maintain the scam

Non-self-revealing crimes • Intent is to maintain the scam indefinitely • Victim may never know • Victim may be deceased... • Concealment from authorities • Most common motivation

General Responsibility • Personal • All personal information must now be considered private! • Government and business • Data must be protected at all costs

Identity Theft - Techniques • Dumpster diving • Skimming • Computer spyware • Shoulder surfing • Hacking • Phishing

Identity Theft - Techniques • Spam • Social networks • Stealing • The old fashioned way • Change of address

Dumpster diving • Obtain physical access to garbage, discarded documents • Yes, this actually happens • Mail stealing • Unlocked mailboxes on street

Skimming • Specialized device • Clerk swipes card • Stores credit card information • International travel • Make sure credit card doesn't leave your sight

Skimming

Computer spyware • More in presentation on malicious software • Software installs on your computer without your knowledge • Captures and communicates • Keystrokes, passwords, credit card information

Shoulder surfing • Stand near someone • Especially in a crowded setting • Watch PIN, any other personal information that can be seen • May also be done at a distance with telescope or binoculars • More devices being made safer • ATMs, keypad entry systems

Hacking • Thieves electronically penetrate databases • Obtain all kinds of personal information • Often credit card information • This is a very very large topic!

Phishing • More in "Malicious Email" • Email from "trusted" source • Click email link goes to forged site • Enter username and password • They now access your account • And any other account where you use that username and password combination

Spam • More in "Malicious Email" • Direct user to site to purchase something • You provide credit card or other personal information • No real product • Recognize reputable sites • Not all spam involves identity theft

Social networks • More in "Social Networks" • MySpace, Facebook, etc. • People post personal information • Full name, birth date, mother's maiden name • Anything else that can be leveraged to guess passwords

Stealing • The old fashioned way... • Purse, wallet • Mail • Laptop! • Sticky note near your computer where you wrote down all your passwords

Change of address • File change of address form with the post office • All mail for victim redirected to you • Use financial tools that show up • Bank statements, loan applications • Use personal information • Social security statement, check stub

Some statistics • Low-tech methods for stealing personal information are still the most popular for identity thieves • Stolen wallets and physical documents – 43% of identity thefts • Online methods – 11%

Now that I'm paranoid? What do I do? • Creative passwords • Not a real word, numbers and letters • Do not carry your social security card with you! • Credit report check • List of all accounts and service phone numbers in a safe place

Now that I'm paranoid? What do I do? • Photocopy contents of your wallet or purse • Credit cards, driver license, etc. • Always err to the paranoid side when receiving a phone call • Verify phone number and call back • Nothing personal in the trash

Shredder tips • Dr. K's rule of thumb: • If you wouldn't want to read the contents of a document on the front page of USA Today (or widely distributed newspaper of your choice)... SHRED IT!! • Cross-cut shredder • Not vertical slices • Too easy to put back together

Shredder tips • Pre-approved, sign and mail offers • Credit cards • Loan applications • Anything private • Not just blatantly useful, but anything private

Free credit report • Credit report companies required by law to provide a free credit report annually • https://www.annualcreditreport.com • This is the ONLY true website • Check your report each year • Look for any suspicious activity

Credit card promotions • Remove your name from promotional lists • Firm offers of credit or insurance, derived form your credit rating • 888-567-8688 • Experian, Equifax, TransUnion

Phone solicitation • National do not call registry • www.donotcall.gov • Effective for five years • Still allows surveys and non-profit organization • Cell phones excluded from telemarketers

Questions? • Internet Safety Podcast • www.internetsafetypodcast.com • Internet Safety Wiki • wiki.internetsafetypodcast.com Dr. Charles Knutson knutson@cs.byu.edu

Identity Theft: Why Would Anyone Want My Identity?