Identity TheftIdentity Theft

Helen LordHelen Lord

ExperianExperian

ContentContent

• Background about ExperianBackground about Experian

• What is Identity theft?What is Identity theft?

• Is there a problemIs there a problem ID Fraud victimsID Fraud victims

• How does it happenHow does it happen

• Ways to protect yourselfWays to protect yourself

• Credit Card FraudCredit Card Fraud

What kind of decisions?What kind of decisions?

• Whether a credit application is Whether a credit application is fraudulentfraudulent

• Whom to select for a new gold cardWhom to select for a new gold card

• What premium to set for an insurance What premium to set for an insurance policypolicy

• Where to locate a new retail storeWhere to locate a new retail store

• Which company to trade withWhich company to trade with

• Whether to accept or reject a credit Whether to accept or reject a credit application and what credit limit to application and what credit limit to offeroffer

• Which pages to show to a web site Which pages to show to a web site visitorvisitor

• Whether a second hand car has been Whether a second hand car has been stolen or written offstolen or written off

What we doWhat we doConsumer credit databasesDirect to consumerBusiness databases

ScoringRisk managementApplication processingAccount processing

List enhancementDatabase managementMicromarketingCustomer RelationshipManagement (CRM)

Cheque, debit anddocument processingCall centres

Marketing databasesAutomotive, insurance andproperty databases

Our major client sectorsOur major client sectors

AutomotiveAutomotive

InsuranceInsurance

Telecomms, Energy and CableTelecomms, Energy and Cable

Retail and CatalogueRetail and Catalogue

LeisureLeisure

Financial ServicesFinancial Services

GovernmentGovernment

Some of our clientsSome of our clients• ABN AMROABN AMRO

• Bang & OlufsenBang & Olufsen

• Bank Renaissance CapitalBank Renaissance Capital

• BarclaysBarclays

• BarclaycardBarclaycard

• BNP ParibasBNP Paribas

• Brasil TelecomBrasil Telecom

• Capital OneCapital One

• China Trust Commercial BankChina Trust Commercial Bank

• CommerzbankCommerzbank• Commonwealth Bank of Commonwealth Bank of

AustraliaAustralia

• Coors Brewers UKCoors Brewers UK

• Direct LineDirect Line

• EggEgg

• France TelecomFrance Telecom

• GE Consumer FinanceGE Consumer Finance

• PendragonPendragon

• PowergenPowergen

• Royal MailRoyal Mail

• Societe GeneraleSociete Generale

• Standard Bank SAStandard Bank SA

• UNICEFUNICEF

• Yahoo!Yahoo!

• HBOSHBOS

• Hilton InternationalHilton International

• HMVHMV

• HondaHonda

• JCBJCB

• Kookmin BankKookmin Bank

• LEGOLEGO

• M&S MoneyM&S Money

• MAX BAHRMAX BAHR

• MBNAMBNA

• Morgan StanleyMorgan Stanley

Company profileCompany profile

• Annual sales in excess ofAnnual sales in excess of£1.4 billion£1.4 billion

• 12,000 people 12,000 people worldwideworldwide

• Offices in Offices in 2828 countries countries

• More than 50,000 clientsMore than 50,000 clients in over 60 countriesin over 60 countries

• Part of the GUS GroupPart of the GUS Group

Our parent company – GUS plcOur parent company – GUS plc

UK’s largest non-food retailer

Argos Retail Group

Leading global information services company

Experian

Management team:Management team:Chief Executive OfficerChief Executive Officer Don RobertDon RobertChief Executive Global OperationsChief Executive Global Operations John SaundersJohn Saunders

Operating businesses:Operating businesses:President, Experian-ScorexPresident, Experian-Scorex Roger AubrookRoger AubrookManaging Director, Experian UK/Ireland and Northern EuropeManaging Director, Experian UK/Ireland and Northern EuropeRichard FiddisRichard FiddisManaging Director, Experian Rest of WorldManaging Director, Experian Rest of World Nigel FineNigel FineChief Executive Officer, Experian AmericasChief Executive Officer, Experian Americas Chris Callero Chris Callero

Experian UK/Experian UK/Ireland / Ireland /

Northern EuropeNorthern Europe

ExperianExperianRest of WorldRest of World

Experian-ScorexExperian-Scorex

GUS plcGUS plc

ExperianExperianInternationaInternationa

ll

Experian Experian GroupGroup

Argos RetailArgos RetailGroupGroup

ExperianExperianAmericasAmericas

Our structureOur structure

Our structureOur structure

ExperianExperianAmericasAmericas

ExperianExperianInternationalInternational

Experian Experian GroupGroup

Experian UK/Experian UK/Ireland /Ireland /

Northern EuropeNorthern Europe

ExperianExperianRest of WorldRest of World

Experian-ScorexExperian-Scorex

CommercialCommercialBusinessBusiness

Insurance Insurance ServicesServicesBusinessBusiness

Fraud Fraud SolutionsSolutionsBusinessBusiness

ConsumerConsumerBusinessBusiness

Automotive Automotive BusinessBusiness

Business Business StrategiesStrategies

Marketing Marketing ServicesServices

ManagementManagementSystemsSystems

InformationInformationSolutionsSolutions

CorporateCorporateDirect to Direct to

Consumer Consumer BusinessBusiness

IrelandIreland NorthernNorthernEuropeEurope

Experian, a global companyExperian, a global company

:ArgentinaAustraliaAustriaBelgiumBrazilCanadaChinaDenmarkFinlandFranceGermanyGreeceHong KongIrelandItaly

JapanMonacoThe NetherlandsNorwayRussiaSingaporeSouth AfricaSouth KoreaSpainSwedenTurkeyUnited KingdomUnited States

Countries in which we have offices:

Experian, a global companyExperian, a global company

North AmericaCosta MesaLincolnSchaumburgDallasAtlantaParsippanyNew York CityTorontoLatin AmericaSao PauloBuenos AiresAsia PacificShanghaiSydneyMelbourneHong KongTokyoSouth Korea

AfricaJohannesburg

EuropeNottingham

LondonEdinburgh

DublinParis

HamburgVienna

MilanRome

The HagueMoscow

StockholmMadrid

MonacoIstanbul

CopenhagenAthens

OsloMoscow

• Experian people numbers: Experian North America = 5,000 Experian UK = 3,500 Experian Rest of World = 3,500

Statutory obligationsStatutory obligations

• Provision of a credit report within seven Provision of a credit report within seven working days subject to authenticationworking days subject to authentication

• Resolution of any credit report related Resolution of any credit report related queriesqueries

Credit reportsCredit reports

• Electoral rollElectoral roll

• Court judgments and bankruptciesCourt judgments and bankruptcies

• Credit account informationCredit account information

• Previous searchesPrevious searches

• CIFASCIFAS

• Goneaway informationGoneaway information

• Address linksAddress links

• Financial associations and aliasesFinancial associations and aliases

What is Identity Fraud?What is Identity Fraud?““Identity Fraud occurs when the perpetrator Identity Fraud occurs when the perpetrator

knowingly transfers or uses, without lawful knowingly transfers or uses, without lawful authority, a means of identification of another authority, a means of identification of another person with the intent to commit an act that person with the intent to commit an act that constitutes a violation of UK law.”constitutes a violation of UK law.”

Source Identity Fraud - The UK ManualSource Identity Fraud - The UK Manual

““Identity fraud is the use of a misappropriated Identity fraud is the use of a misappropriated identity in criminal activity, to obtain goods or identity in criminal activity, to obtain goods or services by deception. This usually involves services by deception. This usually involves the use of stolen or forged identity documents the use of stolen or forged identity documents such as a passport or driving licence.” such as a passport or driving licence.”

Source CIFASSource CIFAS

What is Identity Fraud?What is Identity Fraud?

• Stealing someone’s identity by various means, Stealing someone’s identity by various means, using name, date of birth and sometimes using name, date of birth and sometimes address details to apply for credit facilities.address details to apply for credit facilities.

Account takeover, previous address fraudAccount takeover, previous address fraud

• The creation of a brand new identity.The creation of a brand new identity. Where has the individual come from? We Where has the individual come from? We

are seeing a lot of cases whereby an are seeing a lot of cases whereby an individual has no previous history – where individual has no previous history – where have they come from, have they really have they come from, have they really been abroad for the past 3-4 years???been abroad for the past 3-4 years???

Is it a problem?Is it a problem?

Is it a problem?Is it a problem?

Bust-out Fraud: Bust-out Fraud: Supporting Terrorist FinancingSupporting Terrorist Financing

It all starts with the terrorists, or It all starts with the terrorists, or their associates, attempting to their associates, attempting to obtain credit cards. This is done obtain credit cards. This is done either through Identity theft to either through Identity theft to create new accounts, or by create new accounts, or by threatening individuals, like threatening individuals, like international students, to hand international students, to hand over genuine accounts when they over genuine accounts when they leave the country.leave the country.

Each bust-out merchant will put Each bust-out merchant will put through an invented charge for a through an invented charge for a large value through his account large value through his account with any credit cards they receive. with any credit cards they receive. In this example, it will be £1000.In this example, it will be £1000.

The credit card company will The credit card company will process the fraudulent transaction process the fraudulent transaction in good faith and return the sum of in good faith and return the sum of the transaction back to the the transaction back to the merchant.merchant.

When the bust-out merchant When the bust-out merchant receives payment for the receives payment for the transaction from the credit card transaction from the credit card company, he transfers the money company, he transfers the money that he has received to the broker, that he has received to the broker, minus his fee for processing the minus his fee for processing the transaction, which is normally transaction, which is normally around 10%around 10%

In this example, he will therefore In this example, he will therefore return £900.return £900.

The credit cards they obtain are The credit cards they obtain are then passed onto then passed onto the brokerthe broker, who, , who, as his name suggests, arranges as his name suggests, arranges deals. deals.

Unfortunately, the deals arranged Unfortunately, the deals arranged by the broker are not legitimate by the broker are not legitimate ones. He passes on the credit ones. He passes on the credit cards he has received to dishonest cards he has received to dishonest merchants, known as merchants, known as bust-out bust-out merchants,merchants, who have agreed to who have agreed to put fraudulent transactions put fraudulent transactions through their accounts for the through their accounts for the broker.broker.

The broker then passes the money The broker then passes the money onto onto the playerthe player. The player is a . The player is a major figure in terrorist financing.major figure in terrorist financing.

The player will deposit the funds he The player will deposit the funds he has received from the broker into a has received from the broker into a bank account. This can be a bank account. This can be a personal account, but is more likely personal account, but is more likely to be either a business account, or to be either a business account, or an account linked to a charitable an account linked to a charitable organisation.organisation.

The money will then either be sent The money will then either be sent to a foreign account by wire to a foreign account by wire transfer, or will be added to a transfer, or will be added to a Paypal e-mail account, so that it Paypal e-mail account, so that it can be accessed anywhere, by can be accessed anywhere, by anyone with the user id and anyone with the user id and password.password.

The money can then be used for The money can then be used for whatever purpose the terrorists whatever purpose the terrorists see fit. It could be used, as in 9/11 see fit. It could be used, as in 9/11 for flight training, or it could be for flight training, or it could be used to procure arms and used to procure arms and armament for training camps. armament for training camps. However it is used, it will be aimed However it is used, it will be aimed at the Western world and their at the Western world and their allies.allies.

This information was derived from investigations made by the This information was derived from investigations made by the FBI into terrorism post 9/11. It involved examining not just how FBI into terrorism post 9/11. It involved examining not just how the actual attacks were planned, but also how they were funded. the actual attacks were planned, but also how they were funded. It is now applied for stopping the flow of money for further It is now applied for stopping the flow of money for further potential attacks.potential attacks.

Developed identitiesDeveloped identities

• Attempts to obtain credit reports and Attempts to obtain credit reports and monitoringmonitoring

• IndicatorsIndicators new voters rollnew voters roll current account/credit card/personal loancurrent account/credit card/personal loan multiple identitiesmultiple identities addresses in similar street/locationaddresses in similar street/location

• Documentation in placeDocumentation in place Spanish, Belgium, Pakistani, Spanish, Belgium, Pakistani,

French, Syrian passportsFrench, Syrian passports

www.nextdayid.co.ukwww.uwantid.co.ukwww.phidentity.comwww.foolthem.comwww.identacard.co.ukwww.ypurphoto-id.comwww.noveltyid.co.ukwww.phakeid.co.ukwww.legalfakeid.comwww.fakeidexpress.comwww.europeanid.co.ukwww.fakeid.co.ukwww.mrbateman.co.uk

ID websitesID websites

Establishing the IdentityEstablishing the Identity

• Voters roll Voters roll published for viewing at the local librarypublished for viewing at the local library Form ‘A’s come pre-printedForm ‘A’s come pre-printed Local authority checks are minimalLocal authority checks are minimal

*Deceased identity fraud*Deceased identity fraud

Year Identity fraud Deceased fraud

2000 34,849 7,6802001 53,536 32,7142002 74,706 44,6542003 100,763 55,9402004 119,967 70,0002005 140,000 82,000

**Source - CIFASSource - CIFAS

Popular NamesPopular Names

ChloeChloeSophieSophieHannahHannahDeborahDeborahPatriciaPatriciaDorothyDorothy55thth

OliviaOliviaJessicaJessicaCharlotteCharlotteJacquelineJacquelineJoanJoanEdithEdith44thth

SophiaSophiaMeganMeganJessicaJessicaKarenKarenMaryMaryDorisDoris33rdrd

EmilyEmilyEmilyEmilyLaurenLaurenJulieJulieJeanJeanFlorenceFlorence22ndnd

JessicaJessicaChloeChloeRebeccaRebeccaSusanSusanMargaretMargaretMaryMary11ststFemalesFemales

OliverOliverJoshuaJoshuaMatthewMatthewJohnJohnDavidDavidArthurArthur55thth

JamesJamesDanielDanielDanielDanielMarkMarkBrianBrianThomasThomas44thth

ThomasThomasJamesJamesJackJackAndrewAndrewWilliamWilliamGeorgeGeorge33rdrd

JoshuaJoshuaThomasThomasJamesJamesPaulPaulPeterPeterJohnJohn22ndnd

JackJackJackJackThomasThomasDavidDavidJohnJohnWilliamWilliam11ststMalesMales

200520051999199919941994196419641934193419041904

Types of Fraud Types of Fraud

• Previous address fraudPrevious address fraud

• Current address fraudCurrent address fraud

• Forwarding address fraudForwarding address fraud

• Account takeoverAccount takeover

• Card not presentCard not present

• Money LaunderingMoney Laundering

Previous Address FraudPrevious Address Fraud

• Not usually the organised gang, but the opportunist.Not usually the organised gang, but the opportunist.

• Very easy to commit – the victim looks as though Very easy to commit – the victim looks as though they still reside at the address.they still reside at the address.

Voters Roll still current.Voters Roll still current. Accounts still at the address.Accounts still at the address.

Address links not yet createdAddress links not yet created.. Mail not on redirect.Mail not on redirect. Junk mail received.Junk mail received.

Current Address FraudCurrent Address Fraud

• Fraud committed by someone at your own address.Fraud committed by someone at your own address. PartnerPartner TenantTenant Shared mailboxesShared mailboxes Mail InterceptionMail Interception

Forwarding Address FraudForwarding Address Fraud

• Your address is used as the applicant’s previous Your address is used as the applicant’s previous address.address.

• The applicant’s current address is a ‘drop address’ The applicant’s current address is a ‘drop address’ quite often somewhere you wouldn’t choose to visit.quite often somewhere you wouldn’t choose to visit.

Account TakeoverAccount Takeover

• A fraudulent change of address is accepted by a A fraudulent change of address is accepted by a company.company.

• Insiders changing account details.Insiders changing account details.

• Phishing and bogus calls enable access to accounts with Phishing and bogus calls enable access to accounts with the correct password and security details.the correct password and security details.

• New cards intercepted in the postNew cards intercepted in the post

• The account is used by the fraudster who asks for new The account is used by the fraudster who asks for new cards to be issued to the new address.cards to be issued to the new address.

Card Not PresentCard Not Present

• The card and customer The card and customer are not present at the are not present at the point of sale.point of sale.

• Transactions take place Transactions take place over the internet or by over the internet or by telephone.telephone.

• CVV code not asked for CVV code not asked for – the digits on the card – the digits on the card signature strip.signature strip.

• Card could be cloned or Card could be cloned or skimmed.skimmed.

Money LaunderingMoney Laundering

• Money that is illegally obtained being cleaned up and Money that is illegally obtained being cleaned up and made to look legal.made to look legal.

• Large cash deposits going into a bank account through a Large cash deposits going into a bank account through a company and then being taken out by cashpoint.company and then being taken out by cashpoint.

• Businesses set up purely to balance cash flow.Businesses set up purely to balance cash flow.

• Consumer Operations see suspicious activity on some Consumer Operations see suspicious activity on some bank statements.bank statements.

Information sharingInformation sharing

• Full members of CIFASFull members of CIFAS Loading fraudulent applications Loading fraudulent applications

(Category 1, 2 and occasionally 3, 4)(Category 1, 2 and occasionally 3, 4) Innocent party reportsInnocent party reports

• Credit reference agency fraud circleCredit reference agency fraud circle highlight current activityhighlight current activity dubious disassociation requestsdubious disassociation requests

• Police liaisonPolice liaison credit report requestscredit report requests S29’sS29’s

What is CIFAS?What is CIFAS?

• Founded by major UK lenders in 1988 when it was Founded by major UK lenders in 1988 when it was accepted that fraud prevention is a non-competitive accepted that fraud prevention is a non-competitive issue.issue.

• Enables members to share known fraud to help Enables members to share known fraud to help prevent fraud and to protect innocent consumers.prevent fraud and to protect innocent consumers.

• Currently have 122 members from all sectors, Currently have 122 members from all sectors, including: including:

banking/credit cardsbanking/credit cards mortgagesmortgages telecommstelecomms insuranceinsurance mail ordermail order credit reference agenciescredit reference agencies Insurance services such as Credit Expert partnersInsurance services such as Credit Expert partners

Category 0 – Protective Category 0 – Protective RegistrationRegistration

• Category 0 (Protective Registration) - This is registered at Category 0 (Protective Registration) - This is registered at an individual’s own request. They may have had an individual’s own request. They may have had documents stolen and wish to protect themselves.documents stolen and wish to protect themselves.

Category 1 – Use of a False Category 1 – Use of a False NameName

• Category 1 (use of a false name) - A name of an Category 1 (use of a false name) - A name of an individual has been used despite the fact that they do individual has been used despite the fact that they do not currently reside at the address. The name used not currently reside at the address. The name used could be that of a former occupant, an individual who is could be that of a former occupant, an individual who is deceased, or could be completely bogus.deceased, or could be completely bogus.

Category 2 – Victim of Category 2 – Victim of ImpersonationImpersonation

• Category 2 (Victim of Impersonation) - Another individual Category 2 (Victim of Impersonation) - Another individual has used a genuine person’s name and/or address details.has used a genuine person’s name and/or address details.

• If a genuine party can be located a category 2 must be If a genuine party can be located a category 2 must be added and a letter sent to them.added and a letter sent to them.

The name is Bond ...The name is Bond ...

• Derek Bond, a retired civil engineer, found out for Derek Bond, a retired civil engineer, found out for himself how insidious modern fraud can be. As he himself how insidious modern fraud can be. As he stepped on to the tarmac at Cape Town airport, the stepped on to the tarmac at Cape Town airport, the 72-year-old grandfather of six was arrested and 72-year-old grandfather of six was arrested and thrown into jail. That he could have been mistaken for thrown into jail. That he could have been mistaken for one of the FBI's 'most wanted' was worrying enough. one of the FBI's 'most wanted' was worrying enough. Despite enjoying an impeccable reputation in his Despite enjoying an impeccable reputation in his home town, it took three weeks before Mr Bond's home town, it took three weeks before Mr Bond's family could convince the authorities that they'd made family could convince the authorities that they'd made a mistake. Away from people who knew him, and a mistake. Away from people who knew him, and could vouch for him, Mr Bond's standing rested solely could vouch for him, Mr Bond's standing rested solely on the contents of a file on someone's' desk. And if on the contents of a file on someone's' desk. And if that file said that Derek Bond, of medium build and that file said that Derek Bond, of medium build and height, was in fact Derek Lloyd Sykes, a British-born height, was in fact Derek Lloyd Sykes, a British-born conman responsible for a multi-million-dollar conman responsible for a multi-million-dollar telemarketing scam in Texas, then who was to say it telemarketing scam in Texas, then who was to say it wasn't true?wasn't true?

Victims of ID fraudVictims of ID fraud

• Provision of credit report - post Provision of credit report - post authenticationauthentication

• Advice line and dedicated case workersAdvice line and dedicated case workers

• Password Notice of Correction Password Notice of Correction

• Recommend Recommend contact with the policecontact with the police Preference servicesPreference services CIFAS Protective RegistrationCIFAS Protective Registration check postal Change of Address filecheck postal Change of Address file

• Contact lenders and amendContact lenders and amend

Analysis of ID fraud victimsAnalysis of ID fraud victims

• Young professionalsYoung professionals

• Asian communitiesAsian communities

• Ethnic minoritiesEthnic minorities

• Multiple occupancyMultiple occupancy

• Primarily urbanPrimarily urban

How fraud was uncoveredHow fraud was uncovered

1% 2%

33%

46%

3%2%

2% 4%7%

Advised by police Bank/credit credit card statement

CIFAS Notification of debt

Credit report request Contacted by lender

Post re-directed Declined finance

Policy document

Modus OperandiModus Operandi

42%

27%

15%

8%3% 2% 1% 1% 1%0%0%

0%

Previous address Current address Forwarding address

ID theft A/c takeover Stolen post

Credit report fraud Tenancy fraud Redirect

Card not present Occupant overseas Jackal fraud

Age AnalysisAge Analysis

3

538

946

651

404320

0

200

400

600

800

1000

Under18

18-30 30-40 40-50 50-60 60+

Knowledge of fraudsterKnowledge of fraudster

• 95% of victims had no knowledge of the 95% of victims had no knowledge of the fraudster. Of those who knew who had used fraudster. Of those who knew who had used their identity, the breakdown is as follows:their identity, the breakdown is as follows:

Ex-partnerEx-partner 14%14% Family memberFamily member 16%16% FriendFriend 15%15% TenantTenant 54%54% Work colleagueWork colleague 1%1%

Police reactionPolice reaction

• 82% of cases were not reported to the police. 82% of cases were not reported to the police. Of those that were, the action taken was as Of those that were, the action taken was as follows:follows:

Under cautionUnder caution 1%1% ProsecutionProsecution 7%7% Under investigationUnder investigation 61%61% Not pursuedNot pursued 31%31%

Cost of fraud by account typeCost of fraud by account type

£137,763

£7,742 £16,800

£395,249

£5,250

£98,683

£222,897

£145,125

£-£50,000

£100,000£150,000£200,000£250,000£300,000£350,000£400,000£450,000

0100200300400500600700

Total cost Number of cases

Average cost of fraud case by Average cost of fraud case by account typeaccount type

£4,305

£967

£207

£1,725

£750

£5,482

£6,368

£248

£-

£1,000

£2,000

£3,000

£4,000

£5,000

£6,000

£7,000

Total cost

Number of confirmed Number of confirmed fraudulent searches by CAPS fraudulent searches by CAPS typetype

100

1

663

10

139

353

188

43

8

304

59

8

378

52

0 100 200 300 400 500 600 700

Agency Mail Order

Business Airtime

Credit Card

Credit Sale

Current account

Direct Mail Order

Enquiry

Hire Purchase

Mortgage

Personal loan

Revolving Credit

Secured Loan

Unrecorded Enquiries

Utility

Cost of fraud by sector - top Cost of fraud by sector - top five CAIS membersfive CAIS membersNumber of casesNumber of cases

Mail OrderMail Order 182182

BankBank 162162

Mail OrderMail Order 9090

TelecomTelecom 8787

RetailRetail 8383

CostCost

BankBank £96K£96K

BankBank £83K£83K

BankBank £72K£72K

Credit cardCredit card £52K£52K

BankBank £37K£37K

Quote From victimQuote From victim

““Please treat as an urgent request from Please treat as an urgent request from somebody who is literally being torn apart somebody who is literally being torn apart by this unfortunate set of circumstances. At by this unfortunate set of circumstances. At present I cannot lease a car, buy a house or present I cannot lease a car, buy a house or apply for a credit card. My life has been apply for a credit card. My life has been taken other by another!!!"taken other by another!!!"

Account openingAccount opening

• Full application detailsFull application details

• VAT number checksVAT number checks

• DPA/CCLDPA/CCL

• Consent wording checksConsent wording checks

• Business Information databaseBusiness Information database

• Experian fraud prevention toolsExperian fraud prevention tools

• Handling of potential “fraud” referralsHandling of potential “fraud” referrals

• Site visitsSite visits

Bin raidingBin raiding• Experian’s white paper - Closing the Lid on ID Experian’s white paper - Closing the Lid on ID

Fraud was published in 2003Fraud was published in 2003 focussed on household waste and commercial waste in focussed on household waste and commercial waste in

CamdenCamden showed that 1 in 10 consumers discarded enough showed that 1 in 10 consumers discarded enough

information for someone to commit card not present information for someone to commit card not present fraudfraud

majority of businesses binned personal data with little majority of businesses binned personal data with little or no attempt to destroy personal dataor no attempt to destroy personal data

““My information is that criminal gangs are paying bin raiders My information is that criminal gangs are paying bin raiders £5.00 per letter. Proceeds of bin raiding are fuelling ID £5.00 per letter. Proceeds of bin raiding are fuelling ID fraud, which in turn feeds back into other criminal activity fraud, which in turn feeds back into other criminal activity such as drugs, prostitution and people trafficking.” Street such as drugs, prostitution and people trafficking.” Street Warden, London Borough of CamdenWarden, London Borough of Camden

BurglaryBurglary

• Break in - nothing taken?Break in - nothing taken? Where are your utility bills, Where are your utility bills,

passport, blank cheques?? passport, blank cheques??

• Estate agenciesEstate agencies Who is looking around your Who is looking around your

house? Never let them go off house? Never let them go off alone.alone.

The bogus surveyor The bogus surveyor

• Fraudsters in Kent recruited a bogus surveyor to Fraudsters in Kent recruited a bogus surveyor to accompany them when viewing recently vacated accompany them when viewing recently vacated properties – without the estate agent.properties – without the estate agent.

• Post was stolen during the viewingPost was stolen during the viewing

• Keys were cut for the property – just in case they Keys were cut for the property – just in case they needed accessneeded access

• Post was redirected to a ‘drop address’Post was redirected to a ‘drop address’

• Telephone lines reconnected and transferred to a Telephone lines reconnected and transferred to a mobile numbermobile number

• Internet applications made for bank accounts and Internet applications made for bank accounts and credit cardscredit cards

And on to the next one…………a nice little earner!And on to the next one…………a nice little earner!

Postal RedirectPostal Redirect

• Post is forwarded to a ‘drop address’ or postal boxes Post is forwarded to a ‘drop address’ or postal boxes unbeknown to the genuine partyunbeknown to the genuine party

• Postal collection is arranged from a local sorting office.Postal collection is arranged from a local sorting office.

• There are instances of post that is not required being There are instances of post that is not required being delivered whilst you are out – so you do not suspectdelivered whilst you are out – so you do not suspect

• Collusion – staff working within the postal service aiding Collusion – staff working within the postal service aiding the fraudstersthe fraudsters

Postal Redirect Service – how it Postal Redirect Service – how it worksworks• A form is completed and taken to the Post Office or sent by post.A form is completed and taken to the Post Office or sent by post.

The fraudster has all relevant details – they have done their The fraudster has all relevant details – they have done their homeworkhomework

• It must be accompanied by ID.It must be accompanied by ID. The fraudster already has your ID. They have an insider working at The fraudster already has your ID. They have an insider working at

the Post Office or they have enough information to send the form the Post Office or they have enough information to send the form direct to the Administration Centre, by-passing the checks.direct to the Administration Centre, by-passing the checks.

• A confirmation is sent to both the previous and forwarding address.A confirmation is sent to both the previous and forwarding address. The fraudster relies on this not being questioned.The fraudster relies on this not being questioned.

Stealing an Identity - do your Stealing an Identity - do your researchresearch

• Bin raidingBin raiding

• BurglaryBurglary

• Postal redirectPostal redirect

• Shoulder surfingShoulder surfing

Shoulder SurfingShoulder Surfing

• Completing applications in shop or businessCompleting applications in shop or business

• Overhearing calls in public placesOverhearing calls in public places

• PIN numbersPIN numbers

Phishing and PharmingPhishing and Pharming

• Scam e-mails - Scam e-mails - redirecting you to redirecting you to bogus internet sites bogus internet sites

• Re-confirm security Re-confirm security detailsdetails

• Pharming - using Pharming - using holes in computer holes in computer security to security to reprogram so that it reprogram so that it appears that you are appears that you are on the correct site.on the correct site.

Bogus CallsBogus Calls

• Incoming calls from financial institutionsIncoming calls from financial institutions

• Requesting identity information and passwords to Requesting identity information and passwords to authenticate youauthenticate you

• REMEMBER A REPUTABLE COMPANY WILL NOT ASK YOU REMEMBER A REPUTABLE COMPANY WILL NOT ASK YOU FOR THESE DETAILS.FOR THESE DETAILS.

Preventing ID fraudPreventing ID fraud• Don’t respond to cold callingDon’t respond to cold calling

• Ensure post is re-directed when you moveEnsure post is re-directed when you move

• Register on the electoral roll immediatelyRegister on the electoral roll immediately

• Shred all personal correspondenceShred all personal correspondence

• Don’t respond to cold calling/e-mailsDon’t respond to cold calling/e-mails

• Don’t respond to surveysDon’t respond to surveys

• Don’t discuss personal details over the phoneDon’t discuss personal details over the phone

• Monitor bank statements etc. and get regular Monitor bank statements etc. and get regular credit reportscredit reports

• Don’t keep PIN numbersDon’t keep PIN numbers

Indicators of ID fraudIndicators of ID fraud

• Bank statements/correspondence failing to Bank statements/correspondence failing to arrivearrive

• Unexpectedly declined credit/contact by debt Unexpectedly declined credit/contact by debt collection companycollection company

• Contact to advise that you have been Contact to advise that you have been approved credit you have not applied forapproved credit you have not applied for

Chip and PinChip and Pin

APACS - 10/10/2005

Chip & PIN ramps up fear factor Finextra, 01/02/06Almost one-in-four consumers now feel more exposed and vulnerable when making a purchase following the introduction of PINs in place of signatures at the point-of-sale in the UK, according to research from polling organisation Ipso Mori. The research among more than 2000 UK consumers was conducted on behalf of IT services group Xansa. The study found that one in four (23%) of female card holders and one in ten (11%) of male shoppers feels less secure using the new payment method. Despite a fall in the amount of cardholder present fraud, the safety improvements are not clear to some of the shopping community (17%) who now feel more vulnerable when making a purchase, because of entering a PIN number rather than signing. From 14 February, cards will only be accepted at retailer tills when accompanied by a PIN number. Xansa is recommending credit card providers appeal directly to female cardholders, to allay their fears, as well as to encourage them to use the mechanism for in-store payments.