IDENTITY THEFTIDENTITY THEFTFEDERAL BUREAU OF INVESTIGATIONFEDERAL BUREAU OF INVESTIGATION

Cyber DivisionCyber Division

IDENTITY THEFT vs. IDENTITY IDENTITY THEFT vs. IDENTITY FRAUDFRAUD

IDENTITY THEFT:IDENTITY THEFT: ““Occurs when someone Occurs when someone appropriatesappropriates another's personal another's personal

information without their knowledge to commit theft or information without their knowledge to commit theft or fraud.” (Internet Crime Complaint Center [IC3]) fraud.” (Internet Crime Complaint Center [IC3])

““Crime of Persuasion”Crime of Persuasion”

IDENTITY FRAUD:IDENTITY FRAUD: Occurs when someone assumes your identity to Occurs when someone assumes your identity to performperform

a fraud or other criminal act.a fraud or other criminal act.True-nameTrue-nameSynthetic Synthetic - concoction of fake and real information to - concoction of fake and real information to create a new identity.create a new identity.

PERSONALLY IDENTIFIABLE PERSONALLY IDENTIFIABLE INFORMATION (PII)INFORMATION (PII)

PII includes:PII includes: NameName SSNSSN Date of birthDate of birth Driver’s license or identification numberDriver’s license or identification number Alien registration numberAlien registration number Passport numberPassport number Taxpayer identification numberTaxpayer identification number Biometric data (i.e., fingerprint, voice print, retina/iris Biometric data (i.e., fingerprint, voice print, retina/iris

image, other unique physical representationimage, other unique physical representation Electronic identification number (EIN), address, or Electronic identification number (EIN), address, or

routing coderouting code Telecommunication identifying information or access Telecommunication identifying information or access

device (as defined in 18 U.S.C. 1029(e))device (as defined in 18 U.S.C. 1029(e))

NON-PUBLIC PERSONAL NON-PUBLIC PERSONAL INFORMATION (NPI)INFORMATION (NPI)

Any information NOT found in public sources (per Gramm-Any information NOT found in public sources (per Gramm-Leachy-Bliley Act of 1999):Leachy-Bliley Act of 1999):Includes:Includes:

Non-public personally identifiable financial information; Non-public personally identifiable financial information; and any list, description, or other grouping of consumers and any list, description, or other grouping of consumers (and publicly available information pertaining to them) (and publicly available information pertaining to them) derived using any personally identifiable financial derived using any personally identifiable financial information that is not publicly available. information that is not publicly available.

Excludes:Excludes: Publicly available information; and any list, description Publicly available information; and any list, description

or other grouping of consumers (including publicly or other grouping of consumers (including publicly available information pertaining to them) that is derived available information pertaining to them) that is derived without using personally identifiable financial without using personally identifiable financial information that is not publicly available. information that is not publicly available.

IDENTITY THEFT STATUTESIDENTITY THEFT STATUTESFalse Identification Crime Control Act of 1982False Identification Crime Control Act of 1982

Prohibits fraud in connection with identification documents. Prohibits fraud in connection with identification documents.

Internet False Identification Act of 2000Internet False Identification Act of 2000 Amends False Identification Crime Control Act of 1982 to Amends False Identification Crime Control Act of 1982 to

include computer-aided identity crimes include computer-aided identity crimes

Identity Theft and Assumption Deterrence Act of Identity Theft and Assumption Deterrence Act of 19981998

Makes it unlawful to knowingly transfer or use, without lawful authority, Makes it unlawful to knowingly transfer or use, without lawful authority, another person's identification for unlawful activities that constitute a another person's identification for unlawful activities that constitute a violation of Federal law or a felony under applicable State or local law. violation of Federal law or a felony under applicable State or local law.

Identity Theft Penalty Enhancement ActIdentity Theft Penalty Enhancement Act Establishes penalties for aggravated identity theft, among Establishes penalties for aggravated identity theft, among

other actions.other actions.

IDENTITY THEFT STATUTESIDENTITY THEFT STATUTESIdentity Theft and Assumption Deterrence Act of Identity Theft and Assumption Deterrence Act of 19981998

Makes it unlawful to knowingly transfer or use, without lawful authority, Makes it unlawful to knowingly transfer or use, without lawful authority, another person's identification for unlawful activities that constitute a another person's identification for unlawful activities that constitute a violation of Federal law or a felony under applicable State or local law. violation of Federal law or a felony under applicable State or local law.

Identity Theft Penalty Enhancement ActIdentity Theft Penalty Enhancement Act Establishes penalties for aggravated identity theft, among Establishes penalties for aggravated identity theft, among

other actions. other actions.

The Fair and Accurate Credit Transactions Act of The Fair and Accurate Credit Transactions Act of 20032003Identity Theft Prevention Act of 2005Identity Theft Prevention Act of 2005

Protects the integrity and confidentiality of issued SSNsProtects the integrity and confidentiality of issued SSNs Prohibits establishment in the Federal Government of any Prohibits establishment in the Federal Government of any

uniform national identifying numberuniform national identifying number Prohibits Federal agencies from imposing standards for Prohibits Federal agencies from imposing standards for

identification of individuals on other agencies or persons identification of individuals on other agencies or persons

STATUTES GOVERNING STATUTES GOVERNING PRIVACY AND USE OF PRIVACY AND USE OF

PERSONAL DATAPERSONAL DATA Privacy Act of 1971Privacy Act of 1971Drivers Privacy Protection Act of 1994Drivers Privacy Protection Act of 1994Health Insurance Portability and Accountability Act of 1996 Health Insurance Portability and Accountability Act of 1996 (HIPAA)(HIPAA)Gramm-Leach- Bliley Act of 1999Gramm-Leach- Bliley Act of 1999

Requires the Federal Trade Commission, along with the Federal Requires the Federal Trade Commission, along with the Federal banking agencies, the National Credit Union Administration, the banking agencies, the National Credit Union Administration, the Treasury Department, and the Securities and Exchange Treasury Department, and the Securities and Exchange Commission, to issue regulations ensuring that financial Commission, to issue regulations ensuring that financial institutions protect the privacy of consumers' personal financial institutions protect the privacy of consumers' personal financial information information

Social Security Number Confidentiality Act of 2000Social Security Number Confidentiality Act of 2000Federal Credit Laws Federal Credit Laws Truth in Lending ActTruth in Lending ActElectronic Fund Transfer ActElectronic Fund Transfer ActFair Credit Billing ActFair Credit Billing ActDrivers Privacy Protection ActDrivers Privacy Protection Act

STATE IDENTITY THEFT LAWSSTATE IDENTITY THEFT LAWSAccording to the National Conference of State Legislatures:According to the National Conference of State Legislatures:

Every state has a law regarding identity theft or Every state has a law regarding identity theft or impersonation.impersonation.

29 states, Guam, and the District of Columbia have specific 29 states, Guam, and the District of Columbia have specific restitution provisions for identity theft. restitution provisions for identity theft.

Iowa, Kentucky and Tennessee have forfeiture provisions for Iowa, Kentucky and Tennessee have forfeiture provisions for identity theft crimes. identity theft crimes.

Arkansas, Delaware, Iowa, Maryland, Mississippi, Montana, Arkansas, Delaware, Iowa, Maryland, Mississippi, Montana, Nevada, New Mexico, Ohio, Oklahoma and Virginia have Nevada, New Mexico, Ohio, Oklahoma and Virginia have identity theft passport programs to help victims from identity theft passport programs to help victims from continuing identity theft.continuing identity theft.

According to FTC:According to FTC: Florida is the state with the highest per capita rate of Florida is the state with the highest per capita rate of

reported identity theft complaints, followed by Arizona and reported identity theft complaints, followed by Arizona and Texas. (FTC)Texas. (FTC)

PRESIDENT’S IDENTITY THEFT PRESIDENT’S IDENTITY THEFT TASK FORCETASK FORCE

Established by Executive Order 13402 on May Established by Executive Order 13402 on May 10, 200610, 2006 Charged 15 federal departments and Charged 15 federal departments and

agencies with crafting a comprehensive agencies with crafting a comprehensive national strategy to combat Identity Theft national strategy to combat Identity Theft more effectively.more effectively.

Strategic Plan issued in April 2007Strategic Plan issued in April 2007

Concluded in 2008Concluded in 2008

PRESIDENT’S IDENTITY THEFT PRESIDENT’S IDENTITY THEFT TASK FORCETASK FORCE

AGAG Chairman FTCChairman FTC Department of TreasuryDepartment of Treasury Department of CommerceDepartment of Commerce Department Health and Human ServicesDepartment Health and Human Services Department of Veteran’s AffairsDepartment of Veteran’s Affairs DHSDHS OMBOMB USPSUSPS Federal Reserve SystemFederal Reserve System OPMOPM FDICFDIC SECSEC National Credit Union AdministrationNational Credit Union Administration Social Security AdministrationSocial Security Administration Office of the Comptroller of the CurrencyOffice of the Comptroller of the Currency Office of Thrift SupervisionOffice of Thrift Supervision

TYPES OF IDENTITY THEFTTYPES OF IDENTITY THEFTCredit Card TheftCredit Card TheftDrive License TheftDrive License TheftSSN Theft SSN Theft Criminal Identity TheftCriminal Identity TheftMedical Identity TheftMedical Identity TheftFinancial ID Theft Financial ID Theft Business/commercial identity theft (using another's Business/commercial identity theft (using another's business name to obtain credit) business name to obtain credit) Criminal identity theft (posing as another person when Criminal identity theft (posing as another person when apprehended for a crime) apprehended for a crime) Financial identity theft (obtain credit, goods and services) Financial identity theft (obtain credit, goods and services) Identity cloning (assume another’s identity in daily life) Identity cloning (assume another’s identity in daily life) Medical identity theft (obtain medical care or drugs) Medical identity theft (obtain medical care or drugs)

IDENTITY THEFT IDENTITY THEFT “ORGANIZATION”“ORGANIZATION”

CollectorsCollectors - acquire identification documents - acquire identification documents through theft of personal.through theft of personal.ConvertersConverters - use information to establish - use information to establish fraudulent bank and credit accounts and obtain fraudulent bank and credit accounts and obtain fraudulent checks and monetary instruments.fraudulent checks and monetary instruments.PassersPassers - use fraudulent accounts and - use fraudulent accounts and instruments to purchase consumer items or cash instruments to purchase consumer items or cash fraudulent checks.fraudulent checks.

IDENTITY THEFT TECHNIQUESIDENTITY THEFT TECHNIQUES““Old Fashioned” StealingOld Fashioned” Stealing

Purse or wallet snatchPurse or wallet snatchDumpster DivingDumpster DivingShoulder SurfingShoulder SurfingSkimmingSkimming

False or disguised ATMsFalse or disguised ATMs Unscrupulous waitersUnscrupulous waiters

Mail theft and rerouting. Mail theft and rerouting. ““Preapproved” Credit Cards By MailPreapproved” Credit Cards By Mail

Social Engineering (“Pretexting”)Social Engineering (“Pretexting”) BaitBait Quid pro QuoQuid pro Quo DiversionDiversion VishingVishing SmishingSmishing PhishingPhishing

Spear PhishingSpear Phishing

IDENTITY THEFT TECHNIQUESIDENTITY THEFT TECHNIQUES

Advance FeeAdvance Fee419 Nigerian and Spanish Prisoner419 Nigerian and Spanish Prisoner

UK LottoUK Lotto

Hitman SchemeHitman Scheme

Vacation Vacation

FBI/DHS/IRS emailFBI/DHS/IRS email

PharmingPharming Redirect of websiteRedirect of website

Tab-nappingTab-napping Replacing open tab browserReplacing open tab browser

Click JackingClick Jacking

Evil Twin Wi-FiEvil Twin Wi-Fi

HackingHacking

PII EVERYWHEREPII EVERYWHERESSN: – considered “the Golden Key to the Palace.” SSN: – considered “the Golden Key to the Palace.” (identitytheft labs.com)(identitytheft labs.com)

ChecksChecksPasswords: Passwords:

common information known to usercommon information known to userMother’s Maiden Name:Mother’s Maiden Name:

www.ancestry.com, cemetery, church marriage records, www.ancestry.com, cemetery, church marriage records, newspapers, military records, probate records and wills, death newspapers, military records, probate records and wills, death records, census records and land records records, census records and land records

Taxpayer Identification Number:Taxpayer Identification Number: W-2W-2 Date of birthDate of birth

Internet searchInternet searchElectronic identification number (EIN), address, or routing Electronic identification number (EIN), address, or routing codecode

ChecksChecks Bank websiteBank website

IP ADDRESSES AS PII?IP ADDRESSES AS PII?

IP ADDRESSES AS PII?IP ADDRESSES AS PII?

SOCIAL SECURITY NUMBERSSOCIAL SECURITY NUMBERS

Financial institutions must wait until Social Financial institutions must wait until Social Security Administration (SSA) sends Death Master Security Administration (SSA) sends Death Master File to financial industry. File to financial industry.

Account is active until financial institutions are Account is active until financial institutions are notified.notified.

Death Master File based on information provided Death Master File based on information provided by consumers and some governmental agencies.by consumers and some governmental agencies.

SSNs are not recycled.SSNs are not recycled.

DORMANT SSNsDORMANT SSNs

SSNs that are inactive or not used over a period SSNs that are inactive or not used over a period of time.of time.

Children’s SSNsChildren’s SSNs Prisoner SSNsPrisoner SSNs

New scam involves SSNs numbers sold under New scam involves SSNs numbers sold under another name, such as “credit profile,” “credit another name, such as “credit profile,” “credit protection” or “credit privacy numbers” (CPNs).protection” or “credit privacy numbers” (CPNs).

Buyers establish phony credit and run up huge Buyers establish phony credit and run up huge debts.debts.

I THOUGHT IT WAS PRIVATE?I THOUGHT IT WAS PRIVATE?

I THOUGHT IT WAS PRIVATE?I THOUGHT IT WAS PRIVATE?

Common Access Card (CAC)Common Access Card (CAC)

IDENTITY THEFT STATISTICSIDENTITY THEFT STATISTICS

According to FTC, the most common identity According to FTC, the most common identity frauds reported:frauds reported: Credit card fraud (17%) Credit card fraud (17%) Government documents/benefits fraud (16%)Government documents/benefits fraud (16%) Phone or utilities fraud (15%)Phone or utilities fraud (15%) Employment fraud (13%)Employment fraud (13%) Bank fraud (10%)Bank fraud (10%) Loan fraud (4%)Loan fraud (4%)

Public Access to PIIPublic Access to PII

SOCIAL NETWORKING THREATSSOCIAL NETWORKING THREATS

Fake or compromised profilesFake or compromised profilesMalicious applications (including “malvertisements”Malicious applications (including “malvertisements”CybersquattingCybersquattingSpamSpamPhishing/Pharming/ClickJacking/SmishingPhishing/Pharming/ClickJacking/SmishingInformation harvestingInformation harvestingCross-site scripting vulnerabilitiesCross-site scripting vulnerabilitiesDirect messagesDirect messagesTiny URLsTiny URLsMetaDataMetaDataLocation-based Services (“checking in”)Location-based Services (“checking in”)

SNS USER BEHAVIORSNS USER BEHAVIORAccording to a study by Ponemon Institute and ProtectMYIDAccording to a study by Ponemon Institute and ProtectMYID® ® (Experian):(Experian):

Approximately 65% of users do not set high privacy or security Approximately 65% of users do not set high privacy or security settings;settings;

> 90% of users do not review privacy policy before engaging in > 90% of users do not review privacy policy before engaging in use;use;

Approximately 40% of respondents provided physical home Approximately 40% of respondents provided physical home address; address;

> 60% of users are either not confident or unsure of their SNS > 60% of users are either not confident or unsure of their SNS provider’s ability to protect their identity;provider’s ability to protect their identity;

Approximately 44% would continue to use site even if SNS Approximately 44% would continue to use site even if SNS provided did not adequately protect privacy/security;provided did not adequately protect privacy/security;

Approximately 60% are not confident or unsure that their Approximately 60% are not confident or unsure that their network of friends only includes people they know and can trust.network of friends only includes people they know and can trust.

SNS USER BEHAVIORSNS USER BEHAVIOR

According to Consumer Reports (2010):According to Consumer Reports (2010): 52% post risky information online;52% post risky information online; 40% posted birth date;40% posted birth date; 26% of Facebook users with children posted 26% of Facebook users with children posted

their children's photos and names;their children's photos and names; 1 in 4 households with a Facebook account, 1 in 4 households with a Facebook account,

users not aware or ignored privacy controls. users not aware or ignored privacy controls.

SMARTPHONESSMARTPHONES

““A lost smartphone may soon be the high-tech A lost smartphone may soon be the high-tech equivalent of a lost wallet.” (nytimes)equivalent of a lost wallet.” (nytimes)

JAILBREAK APPLICATIONSJAILBREAK APPLICATIONS

THERE’S AN APP FOR THATTHERE’S AN APP FOR THATCiti Mobile App:Citi Mobile App: Ranked the 11th most-popular in finance Ranked the 11th most-popular in finance

category of Apple's App Store.category of Apple's App Store. Glitch in App saved personal account Glitch in App saved personal account

information in a hidden file on users' phones, information in a hidden file on users' phones, as well as personal computers hooked up to as well as personal computers hooked up to phones.phones.

LOCATION-BASED SERVICESLOCATION-BASED SERVICES

GPS Apps in mobile phonesGPS Apps in mobile phones GPS TrackingGPS Tracking ““Checking-in”Checking-in”

http://icanstalku.com/http://icanstalku.com/

METADATAMETADATA

JPEG images – metadata can include JPEG images – metadata can include photographer, camera settings (ISO, Aperture, photographer, camera settings (ISO, Aperture, Flash, lens type), processing software and Flash, lens type), processing software and location.location.

Metadata in images retained by desktop image Metadata in images retained by desktop image processing software and some online photo processing software and some online photo storage websites.storage websites.

GEOTAGGINGGEOTAGGING

Location-based data (metadata) stored inside of images.Location-based data (metadata) stored inside of images.

Common on smartphones with cameras.Common on smartphones with cameras.

DATA AGGREGATORSDATA AGGREGATORSwww.spokeo.comwww.pipl.comwww.zabasearch.comwww.intellius.comwww.peekyou.comwww.wink.comwww.zoominfo.com

PROTECTIONSPROTECTIONSCredit report “security freeze”Credit report “security freeze”

Keeps 3Keeps 3rdrd parties from accessing your credit file (unless parties from accessing your credit file (unless you have taken steps to temporarily unfreeze it). you have taken steps to temporarily unfreeze it).

Differs from state to state.Differs from state to state. ExemptionsExemptions Not recommended for younger consumersNot recommended for younger consumers

Fraud AlertsFraud Alerts Contact Credit BureausContact Credit Bureaus

Review credit report for suspicious activity Review credit report for suspicious activity www.annualcreditreport.com

Credit Protection ServicesCredit Protection Services

Shred!!!Shred!!!

Remove from mass mailing listsRemove from mass mailing lists

““SECURITY FREEZE”SECURITY FREEZE”

Keeps 3Keeps 3rdrd parties from accessing your credit file parties from accessing your credit file (unless you have taken steps to temporarily (unless you have taken steps to temporarily unfreeze it). unfreeze it).

Differs from state to state.Differs from state to state. ExemptionsExemptions Not recommended for younger consumers.Not recommended for younger consumers.

IDT PROTECTION SERVICESIDT PROTECTION SERVICES

LifeLock, IDWatchdog, GuardDog, Debix, etc.LifeLock, IDWatchdog, GuardDog, Debix, etc. Not 100%Not 100% Limitations on serviceLimitations on service

LifeLock:LifeLock: Phoenix New Times article (2010): LifeLock CEO Todd Phoenix New Times article (2010): LifeLock CEO Todd

Davis’ SSN has been stolen at least 13 times.Davis’ SSN has been stolen at least 13 times. According to FTC Chairman, According to FTC Chairman, “While LifeLock promised “While LifeLock promised

consumers complete protection against all types of consumers complete protection against all types of identity theft, in truth, the protection it actually provided identity theft, in truth, the protection it actually provided left enough holes that you could drive a truck through left enough holes that you could drive a truck through it.”it.”

REPORTING IDENTITY THEFTREPORTING IDENTITY THEFT

http://www.ftc.gov/sentinel/http://www.ftc.gov/sentinel/

www.ic3.govwww.ic3.govInternet Crime Complaint Center (IC3) began operation on Internet Crime Complaint Center (IC3) began operation on May 8, 2000May 8, 2000

http://www.lookstoogoodtobetrue.com/http://www.lookstoogoodtobetrue.com/

FEDERAL TRADE COMMISSION FEDERAL TRADE COMMISSION (FTC)(FTC)

Consumer Sentinel:Consumer Sentinel: Developed and maintained by FTC.Developed and maintained by FTC. Complaint database that collects information Complaint database that collects information

about consumer fraud and identity theft from about consumer fraud and identity theft from the FTC and over 115 other organizationsthe FTC and over 115 other organizations

Makes the information available to law Makes the information available to law enforcementenforcement

REPORTING IDENTITY THEFTREPORTING IDENTITY THEFT

FTC: www.ftc.gov/bcp/edu/microsites/idtheft 1-877-IDTHEFT (1-877-438-4338); TTY 1-866-653-4261 http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/

idt04.pdf http://www.consumer.gov/military/

IRS: http://www.irs.gov/privacy/article/0,,id=186436,00.html IRS Identity Protection Specialized Unit; 1-800-908-4490

Social Security Administration (SSA): http://www.ssa.gov/oig/guidelin.htm

US Postal Service: https://postalinspectors.uspis.gov/

CREDIT BUREAUSCREDIT BUREAUS

Equifax (800-525-6285)Equifax (800-525-6285)

Trans Union: (800-680-7289)Trans Union: (800-680-7289)

Experian: (888-397-3742)Experian: (888-397-3742)

Credit bureaus consult SSN Death Master File to identify Credit bureaus consult SSN Death Master File to identify deceased persons’ numbers.deceased persons’ numbers.

SHRED-A-THONSHRED-A-THON

OTHER OPTIONS?OTHER OPTIONS?

http://suicidemachine.org/http://suicidemachine.org/

http://twitwipe.aalaap.com/login.phphttp://twitwipe.aalaap.com/login.php

QUESTIONS?QUESTIONS?