T-Mobile Experian Hack

"Hackers took T-Mobile customer names, addresses, Social Security numbers, birthdays, and even sensitive identification numbers (like a driver's license, military ID or passport number.)"

http://money.cnn.com/2015/10/01/technology/tmobile-experian-data-breach/

Identity Theft Surpasses Drug Crime, Maybe

I have read conflicting information about Identity Theft being more lucrative than the criminal drug trade so I'll post some articles here as I come across them.

http://www.zdnet.com/article/cybercrime-costs-338bn-to-global-economy-more-lucrative-than-drugs-trade/

Norton reports that cybercrime is costing the global economy $338 billion a year, overtaking a still a lucrative trade in the underground drugs market.

Foster Children at High Risk for Child Identity Theft

Foster Children are unfortunately at a high risk for Identity Theft. As you can imagine with them moving around so much and so many people having temporary access to their SSN and insurance credentials, Foster Children are often in for an ugly surprise when they find themselves on their own as 18 year old adults.

Here are some articles on the topic

NBC News
http://www.nbcnews.com/feature/in-plain-sight/preying-vulnerable-foster-youth-face-high-risk-identity-theft-n157641

Children in foster care are at greater risk of becoming victims of identity theft and entering adulthood with their credit already in shambles, experts say.

The Federal Trade Commission (FTC)
https://www.consumer.ftc.gov/blog/guide-protecting-foster-kids-credit

Every year, more than 26,000 kids in the United States age out of foster care. Remember how difficult it was to navigate through the world when you were 18? Now imagine you had to do it with nearly no support system – and with a mountain of debt in your name, thanks to identity theft.

A resource (report) from the Annie E. Casey Foundation
http://www.aecf.org/resources/youth-and-credit/

KEY TAKEAWAY
Young people in foster care are at heightened risk of identity theft
The federal credit check requirement is intended to help young people leave foster care with clear credit histories.

Hackerville

I have not yet watched all of this but it looks good.

I don't endorse Norton officially but this is good info and a good explanation on what is going on as hacking.

https://youtu.be/un_XI4MM6QI

Identity Theft Scams and Tactics

I also thought I had a post about common ID Theft Scams. I'll fill this one out soon but here are some for starters, numbered but in no particular order

1. Dumpster Diving
2. Stealing wallets and purses
3. Stealing mail even by change of address form
4. Stealing records from their employer
5. Shoulder Surfing
6. Hacking
7. Skimming
8. Phishing
9. Spear Phishing
10. Vishing
11. Smsishing
12. Spoofing

I've cited Jake Stroup before as an online resource so I'll to one of his pages here again and I will be back to fill out this article in the next few days.
http://idtheft.about.com/od/theftmethods/

Identity Theft and The $1B Bank Heist

In my professional opinion this is a very good example of the type of threat posed by Identity Theft, because, like most Identity Theft victims, the crime was not discovered until well after the fact.

I heard a story very much like this around 1991. A large multinational corporation was robbed by multiple wire transfers that occurred in a few seconds or less. The theft was something like $300 Million. I had happened years before the story went out. I remember it shocked me to learn that the theft was not reported because the company did not want to startle its shareholders.

So they lost $300 Million back in the late 80s and didn't want to say anything.

Now several banks have collectively lost $1 Billion and could not say anything, not because they didn't want you to know, but because they themselves did not know.

If you saw Superman III you understand the idea behind this. If you have been a victim of Identity Theft, particularly non-financial Identity Theft, then you know what can happen.

Now the two have been combined. If you saw the reboot of Battlestar Galactica you can appreciate why Commander Adama ordered "There will be no networked computers on this ship."

If you argued with your Grandparents that you had to lock your door or your car, you need to understand now that you must have an Identity Theft Restoration service. Just like you pay for water, which again used to be free from a well.

This is the 21st Century. Times are changing. Rapidly. Be aware.

https://www.youtube.com/watch?v=p79VXtktIJo#t=114

Malicious Spyware infects firmware

Your information is on more than one network and if someone wants it bad enough, like from Anthem or your Bank for example, they can get it. And they don't need it because they are trying to do you any favors.

Be aware that anything on a network is vulnerable and there is an arms race to protect it whether you are participating in it or not.

"Kaspersky Lab says the malicious spyware ... implants are different from other cyberattacks in that they directly infect a computer’s firmware — the software that links directly to the hard drive.
This means that it is beyond the reach of most antivirus and security products, and is immune to efforts to wipe clean or even replace hard drives since it can be recalled at will."

http://time.com/3711462/u-s-cyber-warfare-equation-group-kaspersky-lab/

Types of Identity Theft

Apparently I don't have a post on the Types of Identity Theft.
I thought I did but I will finish this one out soon.
For starters here is some information that should remain intact after editing.


The Federal Trade Commission (FTC) is the nation’s consumer protection agency. The FTC works to prevent fraudulent, deceptive and unfair business practices in the marketplace.

The FTC maintains an Identity Theft education site at http://www.consumer.ftc.gov/features/feature-0014-identity-theft and has previously defined Identity Theft by stating:

Identity Theft occurs when someone uses your personally identifying information, like your name, Social Security number, or credit card number, without your permission, to commit fraud or other crimes.

I have identified 5 Basic Types of Identity Theft consistent with this definition although that can be and has been expanded into 8 or 10 or more.

The 5 as I call them are:

1. Driver's Licence
2. Social Security
3. Medical
4. Character/Criminal
5. Financial

However, the Bureau of Justice Statistics has 3 types and these are very broad but are consistent with the 5 Types as I discuss them.

From their website http://www.bjs.gov/index.cfm?ty=tp&tid=42

For the National Crime Victimization Survey (NCVS), the definition of identity theft includes three general types of incidents:

unauthorized use or attempted use of an existing account

unauthorized use or attempted use of personal information to open a new account

misuse of personal information for a fraudulent purpose.

Medical Identity Theft, and Social Security/Financial Identity Theft of Children and Seniors are the 3 most common types of Identity Theft at present.

Financial Identity Theft differs from Bank Fraud and Credit Card Fraud and represents less than 30% of the issue. CitiBank used to run ads that made it seem like Financial Identity Theft was the only type. Those ads have not been broadcast or cablecast for several years at this point.

Also you will notice that LifeLock no longer has their CEO's Social Security Number on display in ads and they don't claim to stop Identity Theft either. This is another change demonstrating an improved understanding of the complexity of the issue.

The 5 Types of Identity Theft are also commonly expanded as I mentioned, here is a variation with some additional commentary from me:

1. Driver's Licence: We all knew someone in High School who used a fake ID to get Alcohol or Cigarettes, that is an example of someone using another person's Driver's License to do something they could not. This is the basis of Identity Theft. If a warrant were issued for that person's arrest, it would have been issued for the person represented by the Driver's License.
2. Social Security: The IRS reported that $3.6 Billion in refunds were sent to parties who had filed on someone else's SSN. This type of ID Theft also allows people to work and generate a tax burden on someone else's SSN.
3. Medical: Just as above, with your medical account info, such as your SSN if you are on Medicare, someone else can access your benefits and potentially use them up for themselves. This can also create an issue in medical databases and cause you to get the wrong type of medical treatment and this is a danger that can kill you.
4. Character/Criminal: Obviously, with enough of your credentials, a criminal can pass themselves off as you, such as by getting a warrant issued for your arrest because a speeding ticket was written on your Driver's License as mentioned above. Proving that you were not the perpetrator of a crime is one of the ugly hurdles ID Theft victims must clear.
5. Financial: By using your credentials to open a new financial account a thief commits Financial ID Theft as opposed to Bank or Credit Card Fraud which are related to abusing one of your existing accounts.
6. Business: As above, if the credentials were your Business TIN (instead of your personal SSN) or some other business credential, a thief can transact or commit crimes as if they were your business. This could be buying inventory, billing for service, securing contracts they don't honor, etc.
7. Of the Deceased: If any of the above types 1-5 are stolen from a deceased person instead of a living person, then this may be classified as Identity Theft of the Deceased.
8. Child: A minor may not have a credit profile until they are 18, in most cases, so if the SSN of a newborn or young child is stolen and abused it may be 18 years before anyone even notices. This is still commonly SSN ID Theft as per 2 above.
9. ID Cloning: As illustrated very well in the Steven Spielberg film To Catch a Thief, and many spy movies including James Bond, someone can effectively impersonate you with enough information. This is basically a combination of all the types of ID Theft but can also involve transactions conducted in person with a witness as opposed to electronic transactions where there may be no one willing to say they are sure you were who they were dealing with.
10. Synthetic: By combining one Driver's License, another SSN, a third medical account and possibly also someone else's credit card or business entity a composite person maybe synthesized to create "Synthetic" Identity Theft. Again, this often involves one or more of the initial 5 basic types of identity theft.

Anthem Data Breach

After an online attack on Anthem, by far the largest breach in the industry, security experts warned on Friday that more attacks on health care organizations were likely because of the high value of the data on the black market.

http://www.nytimes.com/2015/02/07/business/data-breach-at-anthem-may-lead-to-others.html?_r=0

Notice that if  

"The information stolen from the insurance giant includes names, birthdays, medical IDs, social security numbers, street addresses, e-mail addresses and employment information, including income data," that may be enough information to file your income taxes and do plenty of other damage, including getting new insurance in your name with your credentials.

Target Stores Data Breach

Some details on how the Target data breach occurred as well as insight into how and where this type of information is traded and sold in bulk and very quickly:
http://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/

Smart phones

An article to get started on smart phones and what value they provide to an Identity Thief:
http://www.aarp.org/money/scams-fraud/info-12-2012/protecting-your-new-smartphone.html

This is a great reminder that there are multiple types of Identity Theft.

This article from the ACLU illustrates how "The type of data stored on a smartphone can paint a near-complete picture of even the most private details of someone’s personal life."
https://www.aclu.org/blog/technology-and-liberty-criminal-law-reform-immigrants-rights/new-document-sheds-light

"The astonishing amount of personal data police can extract from your smartphone" is based on the ACLU article above but has some good commentary of it's own:
http://www.thestar.com/news/world/2013/02/27/the_astonishing_amount_of_personal_data_police_can_extract_from_your_smartphone.html

Gift Card Fraud

I have been involved with professional training from a major retailer that described how thieves will photograph gift card data from cards before they are sold and then use that information to cheat the buyer of the gift card once it is activated.

This article discusses a very similar procedure:

http://www.nw3c.org/news/article/Fulltext/2013/11/28/department-store-gift-card-scam

An excerpt:
"Criminals steal gift cards from store racks before any money has been added to them and then use an electronic card reader/writer to copy the information from one gift card to another, making an identical copy. Then they take the card back to the store for unsuspecting customers to purchase. Once money is added to the card, the criminal can then go on a shopping spree with someone else’s money."


If "78 percent of retailers have been victims of gift-card fraud" how does that translate to customers? This article explains some of the issues facing retailers:

Read more: http://www.entrepreneur.com/article/229526#ixzz2oBjQjHex

Krebs Skimming posts

Krebs On Security has an excellent variety of posts about Skimmers which are a method to obtain information for use in Bank Fraud, Credit Card Fraud and Financial Identity Theft:

http://krebsonsecurity.com/all-about-skimmers/

Wealth Managers Hacked

Fascinating example of how it doesn't matter how careful you are with your Identity or Finances, other people have been entrusted with it and if they are the weakest link in your Identity chain then that is where you can most easily be compromised.

A quote "EJ Hilbert, a former FBI counter-terrorist who was appointed head of Kroll’s cyber investigations this summer told the Financial Times: ‘It’s scary. Wealth managers are being used to get millions of dollars."

The article
http://citywire.co.uk/wealth-manager/cyber-criminals-hack-into-wealth-managers-to-steal-millions/a724488#!

Holidays and Identity Theft

The Fall Holiday Season is also known as "Identity Theft Season." In some circles at least.

10 Reasons related to why consumers are particularly vulnerable to identity theft during the holidays because many relax their guard and substantially increase the exposure of their financial information:
http://www.huffingtonpost.com/adrian-nazari/10-reasons-identity-theft_b_2289723.html


Tips on Protecting Your Identity During the Holidays include not letting your credit card out of sight and getting a credit monitoring service. It also mentions photocopying your credit cards but I suggest you copy the contents of your purse or wallet in case you loose it and need to know what to report as stolen, missing or in need of replacement:
http://www.rethinkingdebt.org/news/preventing-identity-theft-during-the-holidays

10 great tips from the LA Times include not buying gift cards except from a person who sells you one from behind a counter:
http://www.rethinkingdebt.org/news/preventing-identity-theft-during-the-holidays

IRS and Identity Theft

Tax refund ID Theft is growing epidemic:

"More Americans' identities were stolen in tax refund crimes in the first six months of 2013 than in all of 2012, said an Internal Revenue Service watchdog on Thursday who described the problem as "a growing epidemic."Tax refund fraud has exploded in recent years. Scammers typically use stolen names and Social Security numbers to file phony electronic tax forms for IRS refunds."

http://www.nbcnews.com/business/tax-refund-id-theft-growing-epidemic-irs-watchdog-8C11557603

The IRS provides advice and resources including an affidavit on the following sites:
http://www.irs.gov/uac/Taxpayer-Guide-to-Identity-Theft
http://www.irs.gov/uac/Protect-Yourself-from-Identity-Theft-1

$3.6 Billion paid to Identity Theives via fraudulent refunds, down from $5.2 Billion
http://money.cnn.com/2013/11/07/pf/taxes/irs-fraud/

Obamacare and Identity Theft

My general thought on Obamacare is that illegal workers needed a job to get healthcare in your name before, now with your credentials they can just go online and get it without needing a job. If they work for cash... they can now just go online and get healthcare without having to bother to report to work somewhere or apply for a job.

Along that line, if someone qualifies for a subsidy and gets healthcare using your identity, whom do you think the IRS will ask to pay that back when it turns out you don't qualify for the subsidy when you file your own, accurate tax return?

A few links from around the web with some relevant excerpts:
How Obamacare Makes Theft Of Your Identity More Likely
"Stealing a medical identity is more lucrative than other kinds of identity theft."
http://www.forbes.com/sites/realspin/2013/08/25/how-obamacare-makes-theft-of-your-identity-more-likely/

St. Louis woman has Identity Compromised at Healthcare.gov including her Account, Address, Social Security Number
https://www.youtube.com/watch?v=DmEddTNWc_8

This article relates most directly to what I've said and have been thinking

"The risks of potential identity theft are very real, and 13 attorneys general have expressed deep concerns about the security of the exchanges’ information."

http://www.nationalreview.com/article/361946/top-ten-obamacare-disasters-come-grace-marie-turner/page/0/1

The 5 types of Identity Theft

Here is an article on the 8 Types of Identity Theft which Jake enumerates as

1. Financial
2. Insurance
3. Medical
4. Criminal
5. Driver's License
6. Social Security
7. Synthetic
8. Child

His article on About.com is here
http://idtheft.about.com/od/Basics/a/The-8-Types-Of-Identity-Theft.htm

I will write more on this later and maybe just update this post. There are really 5 Basic Types that lead to 10 or 11 common manifestations.

The 5 Basic Types of Identity Theft are:

1. Driver's License
2. Character/Criminal
3. Medical
4. Social Security
5. Financial

This article from SHRM regarding employer liabilities in 2008 highlights these 5 types of ID Theft (Michael Hall is no relation that I'm aware of):
http://www.shrm.org/LegalIssues/FederalResources/Pages/EmployersFaceLiabilityforFiveKindsofIdentityTheft.aspx

The 10 or 11 Common Types of Identity Theft therefore and what the Basic Type they are based on are:

1. Financial (Financial)
2. Insurance (Financial/Medical)
3. Medical (Medical)
4. Criminal (Character/Criminal)
5. Driver's License (Driver's License)
6. Social Security (Social Security)
7. Synthetic (Combination from the 5)
8. Child (Any of the Basic 5 from a Minor)
9. Business (Usually Financial but based on a Federal Tax ID, not an SSN)
10. Deceased (Any of the Basic 5 from a Deceased person)
11. Cloning (Combination of Character/Criminal and another type thus impersonating the victim)

Now that I have fleshed out this outline, I probably need to do a basic post on what Identity Theft is, but this is a good definition for starters and I got it from the FTC years ago:

“Identity Theft occurs when someone uses your personally identifying information, like your name, Social Security number, or credit card number, without your permission, to commit fraud or other crimes.”
I also read an article from Kroll that I can not share... that added "or to conceal the thief's true identity."

Perhaps more on this later.

College Students at High Risk for Identity Theft

A story from Austin, TX new station KXAN on the BBB, college students, and identity theft.

Some good tips but it mentions that you should look for "https://" for a secure website when shopping online but then also tells the story of someone who put in credit card info for a purchase on a completely fake website.

http://www.kxan.com/news/local/austin/college-students-most-prone-to-id-theft

You need a plan to mitigate damages when they happen. There is no way to avoid a determined ID thief particularly when your info is captured as collateral damage or incidentally.

Countrywide ID theft scam

Incredible. They caught 2 of the men responsible for the Countrywide data breach. I don't think the punishment fit the crime myself.

This is a good article for people who still ask me "how did someone get my Social Security Number/Bank Account number/Date of Birth/et al. Here are some highlights and the link back:

Rebollo was arrested in 2008 after FBI investigators found that he was using a flash drive to download data from about 20,000 customers a week for two years.

Rebollo then sold the information to Wahid Siddiqi, 28, formerly of Thousand Oaks, for $500 and earned a combined $50,000, federal investigators said. He later pleaded guilty to unlawfully disclosing Social Security numbers in at least 50,000 [INSTANCES].

Siddiqi is serving a 3-year prison sentence after pleading guilty to fraud and admitted to selling the information to third parties, including an undercover FBI agent.

Read more: http://moneywatch.bnet.com/economic-news/news/calif-man-sentenced-in-countrywide-id-theft-scam/6306326/#ixzz1ZY45ALbr