Identity Theft and Fraud Overview

Identity Theft and Identity Fraud

• Identity theft can be used to describe any use of stolen personal information.
• Identity fraud is a subset of identity theft.
• The goal of identity fraud is to create a credible identity through access to credit cards, financial or employment records.

Typologies of Internet Theft/Fraud

• Assumption of Identity is rare due to the difficulty in assuming all aspects of a person’s life.
• Theft for Employment and/or Border Entry involves fraudulent use of stolen or fictitious information to get work or gain entry into the U.S.
  • This type of fraud is increasing because of illegal immigration and alien smuggling.
  • Examples of fraudulent documents include alien registration cards, visas, and passports.
• Criminal Record Identity Theft/Fraud is committed to evade capture and criminal prosecution.
  • It often involves lying to police upon arrest.
• Virtual Identity Theft/Fraud involves using personal, professional, or other aspects of an identity to develop a fraudulent virtual personality.
  • It is easy to accomplish because it requires minimal effort.
• Credit Identity Theft is the most common and most feared type of identity theft.
  • It involves using stolen personal and financial information to create fraudulent accounts.

Prevalence and Victimology

• There are several factors that make it difficult to accurately measure the prevalence of identity theft. These include:
  • Perceptions of apathy.
  • Lack of reporting by local and state law enforcement agencies to federal agencies.
  • Jurisdictional discrepancies regarding how to measure these activities.
  • Selective enforcement based on community standards and departmental resources.
  • Delayed notification of victimization.
  • Vested interest of private companies in exploiting consumer fear.
  • Lack of mandatory reporting and inconsistent prosecution by federal agencies.
  • Lack of national standards in measurement.

Physical Methods of Identity Theft

• Mail theft involves stealing information from mailboxes, including credit card offers, government documents, and passports.
  • Popcorning involves searching for raised flags which signal outgoing mail.
• Dumpster Diving involves searching trash receptacles for identifying information.
• Theft of Computers involves stealing computers, containing personal information, from airports, hotels, homes, and offices.

Virtual or Internet-Facilitated Methods

• Phishing involves sending fraudulent emails or creating fake websites to acquire personal information.
  • Variations include:
    • Spoofing: Uses false, but apparently authentic, communications to solicit funds.
    • Pharming: Redirects a connection from a legitimate IP address to a mirror site.
    • Redirectors: Malware redirects traffic to undesired sites.
    • Advance-fee/419 fraud: Strangers deceive people into providing financial information, often with a promise of a windfall.
    • Phishing Trojans/Spyware: Often installed to create botnets.
    • Floating Windows: Placed over the address bar of a browser to steal personal information.
    • Botnets: Change a website's IP address without changing the domain name to steal information and spread malware.
• Spyware takes control of a computer’s interactions with users to capture information.
• Crimeware is spyware that is used to achieve identity theft and other financially motivated crimes.
• Keyloggers record keystrokes, like passwords, and can be hardware or software.
• Trojans can have an apparently legitimate purpose, but often are actually keyloggers, password-stealers, or installers of back doors.

Crimes Facilitated by Identity Theft/Fraud

• Insurance and Loan Fraud is committed to get government loans, enroll in a legitimate institution, drop out, pocket the money, and disappear.
• Immigration Fraud and Border Crossings involve using fraud to secure a border crossing, obtain immigration benefits, or engage in acts of terror.
  • Example: 300 Swift & Company employees were arrested for falsifying immigration documents.

Conclusions and Recommendations

• Expand the definition of personal identifying information to include biometric data.
• Establish a central repository of vital statistics.
• Develop alternate methods to authenticate identity.
• Prohibit the exportation of personal information to foreign countries.
• Provide victims with the ability to petition the court for a finding of factual innocence.
• Provide for consumer-initiated credit “freezes” or “blocks.”
• Restrict access and publication of social security numbers.
• Ban the sale of social security numbers.
• Require the oversight of data-selling companies.
• Require enhanced identity authentication practices.
• Develop a standardized police report.
• Develop civil remedies and criminal penalties directly proportionate to the loss suffered.
• Provide civil remedies for victims.

Identity Theft and Identity Fraud

• Identity theft encompasses any use of stolen personal information, while identity fraud is a subset of identity theft, specifically involving the fraudulent use of identifying information.
• Identity fraud involves the creation of a credible identity using information like credit cards, financial records, or employment records.
• Typologies of Internet Theft/Fraud
  • Assumption of Identity: A rare form of theft where someone assumes all aspects of another person's life.
  • Theft for Employment and/or Border Entry: Often tied to illegal immigration or alien smuggling, this involves using stolen or fictitious information to secure jobs or gain entry into the United States.
  • Criminal Record Identity Theft/Fraud: This type of fraud aims to evade capture or criminal prosecution, often involving false claims to law enforcement during arrests.
  • Virtual Identity Theft/Fraud: Using personal, professional, or other aspects of an identity to develop a fraudulent online persona.
  • Credit Identity Theft/Fraud: The most common and feared form, using stolen personal and financial information to create fraudulent credit accounts.

Prevalence and Victimology

• Statistics on identity theft are difficult to accurately measure. Contributing factors include:

  • Perception of apathy: Victims may not report theft due to a feeling of helplessness.
  • Lack of consistent reporting: Local and state law enforcement don't always report identity theft to federal agencies.
  • Jurisdictional inconsistencies: Varying definitions and regulations make it difficult to track the crime.
  • Selective enforcement: Resource limitations and community standards influence how local law enforcement addresses the crime
  • Delayed notification: Victims may not be aware of the theft until much later.
  • Vested interests: Private companies capitalize on consumer fear, pushing for protection services and products.
  • Lack of reporting requirements: There are no standardized reporting requirements for identity theft.

• Primary Information Sources:

  • Credit reporting agencies, software companies, media outlets, and government agencies all collect data on identity theft.
  • It's important to consider the agenda of each source. For example, credit reporting agencies and software companies may overstate the frequency of identity theft to sell protective services.

Physical Methods of Identity Theft

• Bag Operations: Intelligence operatives, often working with corrupted hotel staff, steal information from hotel rooms, taking advantage of readily accessible mass storage media.
• Child Identity Theft: Parents often commit this type of theft, leading to challenges in identification and delays, especially since these crimes may not fall under child welfare agency jurisdiction.
• Insiders: Employees, whether intentionally or accidentally, pose a significant risk.
• Fraudulent/Fictitious Companies: Sophisticated schemes frequently involve the creation of sham companies solely to collect personal information.
• Card Skimming: Stolen information is encoded from the magnetic strip of credit/debit cards.
• ATM Manipulation: ATM machines are modified to steal personal information, including PINs, through fraudulent means.

Virtual or Internet Facilitated Methods

• The internet's accessibility and lack of emphasis on security make it a prime target for identity theft.
• Phishing: Fraudulent emails and websites are used to collect personal information (e.g., Nigerian 419 scams). Identifying perpetrators is challenging.
  • Spoofing: Scams using false but authentic-seeming communications to request funds.
  • Pharming: Redirecting internet traffic from legitimate sites to fake mirror sites.
• Redirector Software: Malware that directs internet traffic to unwanted websites.
• Advance-Fee/419 Fraud: Individuals are tricked into providing financial information by promises of large sums of money.
• Phishing Trojans or Spyware: These often install botnets to steal information and spread malicious software.
• Floating Windows: These appear over web browser address bars to steal information.
• Botnets: Botnets change website IP addresses while maintaining the same domain names, enabling information theft and malware dissemination.
• Spyware and Crimeware:
  • Spyware: Software that monitors a user's computer activity and captures information.
  • Crimeware: Spyware used specifically for identity theft and other financial crimes.
• Keyloggers and Password Stealers: These devices record keystrokes, including sensitive information like passwords.
• Trojans: Software that appears to be legitimate but may actually contain keyloggers, password stealers, or backdoor access tools.

Crimes Facilitated by Identity Theft/Fraud

• Identity theft often serves as a method for anonymously accessing private areas and transferring resources.
• Four-phase process:
  1. Obtaining stolen identifiers.
  2. Creating or obtaining a breeder document (e.g., birth certificate, driver's license).
  3. Using the breeder document to create additional fraudulent documents.
  4. Employing the fraudulent identity to commit a crime.
• Insurance and Loan Fraud: Stolen identities are used to obtain government loans, enroll in educational institutions, and then disappear with the funds.
• Immigration Fraud and Border Crossings: Fraudulent information is used to secure border crossings, receive immigration benefits, or engage in acts of terrorism (e.g., a case involving 300 employees arrested at Swift & Company, a meat processing plant).

Conclusions and Recommendations

• Expand the definition of personal identifying information: Include unique biometric data.
• Establish a central repository of vital statistics: This would help in tackling identity theft.
• Develop alternative authentication methods: Seek out less vulnerable ways to verify identity.
• Prohibit the export of personal information: Prevent data from leaving the country and falling into the wrong hands.
• Provide victims with the ability to claim factual innocence: Allow victims to petition courts for official recognition of the theft.
• Implement consumer-initiated credit "freezes" or "blocks": Give individuals control over their credit information.
• Restrict access to and publication of social security numbers: Minimize exposure to this sensitive information.
• Ban the sale of social security numbers: Prevent the exploitation of this critical data.
• Require oversight of data-selling companies: Regulate these companies to ensure they are not facilitating identity theft.
• Implement enhanced identity authentication practices: Improve security measures for online accounts.
• Develop a standardized police report: Ensure that all investigations and reports include consistent data.
• Develop civil remedies and criminal penalties: Establish clear legal consequences.
• Provide civil remedies for victims: Allow victims to seek compensation and justice.

Identity Theft and Identity Fraud

• Identity theft is a broad term encompassing any unauthorized use of someone else's personal information.
• Identity fraud is a specific type of identity theft that involves using stolen personal information for financial gain.
• Identity fraud can involve real or fictitious identities and can affect a variety of aspects of a person's life, including employment, finances, and even immigration status.

Typologies of Internet Theft/Fraud

• Assumption of Identity: This rare form of identity theft involves a person taking on all aspects of another person's life. It is difficult to accomplish because it requires a high level of detail and knowledge.
• Theft for Employment and/or Border Entry: This type of fraud involves using stolen or fabricated personal information to obtain employment or gain entry into the United States. This type of fraud is growing due to an increase in illegal immigration and alien smuggling.
• Criminal Record Identity Theft/Fraud: This involves using a victim's identity to evade capture, criminal prosecution, or to obtain employment.
• Virtual Identity Theft/Fraud: This type of fraud involves using personal, professional, or other aspects of a person's identity to develop a fraudulent online persona. This can occur for innocent or malicious reasons.
• Credit Identity Theft/Fraud: The most common and feared type of identity theft involves using stolen personal and financial information to create fraudulent accounts.

Prevalence and Victimology

• Measuring the prevalence of identity theft is difficult due to a lack of consistency and accuracy in reporting.
• Factors contributing to inaccurate reporting include:
  • Perceptions of apathy by victims
  • Lack of reporting by local and state law enforcement to federal agencies
  • Jurisdictional discrepancies in measurements
  • Selective enforcement based on community standards and departmental resources
  • Delay in victim notification or awareness of victimization
• Other factors influencing the difficulty of accurately measuring identity theft:
  • Vested interest of private companies to exploit consumer fear
  • Lack of mandatory reporting and inconsistent prosecution by federal agencies
  • Lack of national standards in measurement
• Primary sources of information on identity theft include:
  • Credit reporting agencies
  • Software companies
  • Popular and trade media
  • Government agencies
• Each of these sources has its own agenda, including:
  • Credit reporting agencies and software companies that want to sell products and services for protection
  • Popular press outlets that capitalize on consumer fears

Prevalence and Victimology (Continued)

• Measuring the costs associated with identity theft victimization is challenging due to losses extending beyond financial cost.
• Factors affecting the cost of victimization:
  • Loss of consumer confidence
  • Delay in victim awareness
  • General lack of reporting
• Expected increases in identity theft, particularly virtual methods, due to:
  • Increasing globalization of communication and commerce
  • Lack of cooperation by lenders and consumer reporting agencies
  • Reluctance of lenders to alienate consumers with time-consuming safety measures
  • Profitability of credit bureaus from selling protection
  • Increased outsourcing of information and services

Physical Methods of Identity Theft

• Mail Theft: Stealing information from mailboxes, including credit card offers, government documents, passports and Social Security Statements.
• Dumpster Diving: Searching through garbage for identifying information.
• Theft of Computers: Physical theft of computers, especially laptops, for the purpose of accessing personal information.
• Bag Operations: Intelligence theft conducted by governmental intelligence operatives often in hotel rooms, usually with the help of corrupted hotel employees.
• Child Identity Theft: Typically committed by parents. Increasing dramatically, presenting challenges due to delayed identification and not being within the purview of child welfare agencies.
• Insiders: Employees, intentionally or accidentally, pose a significant threat of identity theft.
• Fraudulent/Fictitious Companies: Sophisticated shell companies created for the purpose of gathering personal information.
• Card Skimming: Theft of personal information encoded on the magnetic strip of credit or debit cards.
• ATM Manipulation: Stealing personal information, such as PINs, through fraudulent ATM devices.

Virtual or Internet-Facilitated Methods

• These methods leverage the accessibility and lack of security inherent in the internet.
• The international nature of the internet expands the potential number of victims.

Crimes Facilitated by Identity Theft/Fraud

• Insurance and Loan Fraud: Using the stolen information to obtain government loans, enroll in educational institutions, and then drop out, pocketing the money and disappearing.
• Immigration Fraud and Border Crossings: Utilizing stolen information to secure border crossings, obtain immigration benefits, and engage in acts of terror.

Conclusions and Recommendations

• Expand the definition of personal identifying information to include unique biometric data.
• Establish a central repository of vital statistics.
• Develop alternate means to authenticate identity.
• Prohibit the exportation of personal information to foreign countries.
• Provide victims with the ability to petition the court for a finding of factual innocence.
• Provide for consumer-initiated credit “freezes” or “blocks.”
• Restrict access and publication of social security numbers.
• Ban the sale of social security numbers.
• Require oversight of data-selling companies.
• Require enhanced identity authentication practices.
• Develop a standardized police report.
• Develop civil remedies and criminal penalties directly proportionate to the loss suffered.
• Provide civil remedies for victims.

Identity Theft and Identity Fraud

• Identity theft encompasses any use of stolen personal information, including identity fraud.
• Identity fraud involves using a credible identity created through access to credit cards, financial or employment records.
• The assumption of identity is rare due to its difficulty.
• Theft for employment and/or border entry involves fraudulent use of stolen or fictitious personal information to get work or gain entry into the U.S.
• Criminal record identity theft/fraud aims to evade capture and criminal prosecution.
• Virtual identity theft/fraud involves using aspects of identity to develop a fraudulent virtual personality, with both innocent and malevolent motives.
• Credit identity theft/fraud is the most common and most feared, involving using stolen personal and financial information to create fraudulent accounts.
• Measuring the prevalence and impact of identity theft is difficult due to:
  • Perceptions of apathy
  • Lack of reporting to federal agencies
  • Jurisdictional discrepancies
  • Selective enforcement
  • Delayed notification or awareness by victims
  • Vested interest of private companies
  • Lack of mandatory reporting and inconsistent prosecution by federal agencies
  • Lack of national standards in measurement
• Primary information sources about identity theft include:
  • Credit reporting agencies
  • Software companies
  • Popular and trade media
  • Government agencies
• Measuring the cost of identity theft is challenging because it extends beyond monetary losses, also including:
  • Loss of consumer confidence
  • Delay in victim awareness
  • General lack of reporting
• Anticipated increases in identity theft are due to:
  • Increasing globalization of communication and commerce
  • Lack of cooperation by lenders and consumer reporting agencies
  • Lenders' reluctance to implement time-consuming safety measures
  • Credit bureaus profiting from selling protection
  • Increased outsourcing of information and services
• Physical methods of identity theft include:
  • Mail theft: Stealing information from mailboxes, including credit card offers, government documents, and passports.
  • Dumpster diving: Searching waste receptacles for identification information.
  • Theft of computers: Physical theft of computers, especially laptops, from airports, hotel rooms, homes, and offices, due to their storage of personal information.
• Virtual or Internet-facilitated methods of identity theft include:
  • Phishing: Using fraudulent emails and fake websites to solicit information.
  • Spoofing: Soliciting funds via false, but apparently authentic communications.
  • Pharming: Redirecting connections from legitimate IP addresses to mirror sites.
  • Redirectors: Malware that redirects traffic to undesired sites.
  • Advance-fee/419 fraud: Strangers deceiving people into providing financial information through promises of windfalls.
  • Phishing Trojans or spyware: Creating botnets for identity theft.
  • Floating windows: Placed over browser address bars to steal personal info.
  • Botnets: Changing website IP addresses without changing domain names to steal info and spread malware.
• Spyware: Takes control of computer interactions with users to capture information.
• Crimeware: Spyware used for identity theft and other economically motivated crimes.
• Keyloggers: Record keystrokes, like passwords, through hardware or software.
• Trojans: Seemingly legitimate programs that often contain keyloggers, password-stealers, or backdoor installers.
• Identity theft/fraud facilitates anonymous entry into private areas for resource transfer through a four-phase process:
  • Procure stolen identifiers.
  • Create or secure a breeder document (birth certificate, driver's license, etc.).
  • Use breeder documents to create additional fraudulent documents and solidify an identity.
  • Employ fraudulent identity to commit criminal acts.
• Identity theft/fraud is involved in:
  • Insurance and loan fraud: Obtaining government loans, enrolling in legitimate institutions, dropping out, pocketing money, and disappearing.
  • Immigration fraud and border crossings: Securing border crossings, obtaining immigration benefits, and engaging in acts of terror.
• Recommendations to combat identity theft include:
  • Expanding the definition of personal identifying information to include unique biometric data.
  • Establishing a central repository of vital statistics.
  • Developing alternate means to authenticate identity.
  • Prohibiting the exportation of personal information to foreign countries.
  • Providing victims with the ability to petition the court for a finding of factual innocence.
  • Providing for consumer-initiated credit “freezes” or “blocks”.
  • Restricting access and publication of social security numbers.
  • Banning the sale of social security numbers.
  • Requiring oversight of data-selling companies.
  • Requiring enhanced identity authentication practices.
  • Developing a standardized police report.
  • Developing civil remedies and criminal penalties directly proportionate to the loss suffered.
  • Providing civil remedies for victims.