Identity Theft FBI Norfolk (757) SA Mark T. Park

Cyber Unit Computer based Crimes Computer based Crimes Forensic analysis Forensic analysis Internet Scams Internet Scams Other crimes with a cyber nexus Other crimes with a cyber nexus Child Pornography Child Pornography Cyber is high on the national and regional priority lists Cyber is high on the national and regional priority lists

Introduction Video

IDENTITY THEFT Definition Definition Why and How Why and How Tools and Methods Tools and Methods Minimizing Your Risk Minimizing Your Risk Indications of ID Theft Indications of ID Theft What to do if Victimized What to do if Victimized

What is Identity Theft? Someone uses bits and pieces of information about a person. (ex: SSN) Someone uses bits and pieces of information about a person. (ex: SSN) Represents him or herself as that person for fraudulent purposes. (ex: Obtaining credit cards or loans, getting a cell phone, etc.) Represents him or herself as that person for fraudulent purposes. (ex: Obtaining credit cards or loans, getting a cell phone, etc.) Worse case, someone commits a crime in the victim’s name. (ex: Internet fraud) Worse case, someone commits a crime in the victim’s name. (ex: Internet fraud)

Who is at Risk ? EVERYONE (including children and the deceased) EVERYONE (including children and the deceased) Over 6 million people victimized every year Over 6 million people victimized every year Trans Union receives over 2,000 fraud reports a day Trans Union receives over 2,000 fraud reports a day

AT WHAT COST? Approximately $6000 Mean Loss Per Victim Approximately $6000 Mean Loss Per Victim 600 Hours to Recover 600 Hours to Recover Estimated annual loss of $53 Billion in U.S. for Businesses and Consumers. Estimated annual loss of $53 Billion in U.S. for Businesses and Consumers. Number of victims and total losses are probably much higher because not all agencies classify certain crimes as ID Theft. Number of victims and total losses are probably much higher because not all agencies classify certain crimes as ID Theft.

Federal Legislation Identity Theft and Assumption Deterrence Act (18 USC 1028) Identity Theft and Assumption Deterrence Act (18 USC 1028) –1028(a)(7) “conventional ID Theft” This section makes it a crime to knowingly transfer, possess, or use without lawful authority a means of identification of another person with the intent to commit unlawful activity. Makes Identity theft a felony. Penalty of 5 years enhancements allowable (phishing, terrorism) Makes Identity theft a felony. Penalty of 5 years enhancements allowable (phishing, terrorism) Allows for victim restitution. Victims are not liable for bills accumulated by the imposters Allows for victim restitution. Victims are not liable for bills accumulated by the imposters

Why is it so prevalent ? Social Security numbers are commonly used as ID (often when not required) Social Security numbers are commonly used as ID (often when not required) Criminals can steal mail Criminals can steal mail Dishonest employees can obtain credit card information and victim’s information Dishonest employees can obtain credit card information and victim’s information Internet is a great source of information Internet is a great source of information Simple method – stealing someone’s wallet Simple method – stealing someone’s wallet

How do thieves use stolen identities? To commit financial fraud: To commit financial fraud: Phone/Utilities fraud (18%) Bank Fraud (17%) Employment Related Fraud (14%) Credit card fraud (26%) Credit card fraud (26%) Loan Fraud (5%) Concealment of Criminal Identity/Record Concealment of Criminal Identity/Record Restart with a “ Clean Slate ” Terrorism Terrorism

METHODS: SKIMMING Where a thief temporarily steals a credit card and runs it through a “skimmer” which is a credit card reader to steal information off of the card. Where a thief temporarily steals a credit card and runs it through a “skimmer” which is a credit card reader to steal information off of the card.

MAGNETIC STRIPE READERS & CARD PRINTERS

This ATM looks normal …

Look closer…a skimmer was placed in front of the card reader

Anything “look” amiss here?

Hidden camera to Record your PIN Entry

The Internet as a Tool Identities could be easily purchased online Identities could be easily purchased online You can purchase a fake drivers license You can purchase a fake drivers license Identities are frequently bought and sold in bulk on the Internet by criminals at an average cost of $14 to $18 for each stolen identity Identities are frequently bought and sold in bulk on the Internet by criminals at an average cost of $14 to $18 for each stolen identity

Phishing

Phishing Defined Phishing is the term coined by hackers who imitate legitimate companies in s and fake websites to trick people in to sharing personal information. Phishing is the term coined by hackers who imitate legitimate companies in s and fake websites to trick people in to sharing personal information. Victims include AOL, Best Buy, eBay and the Federal Trade Commission. Victims include AOL, Best Buy, eBay and the Federal Trade Commission. As of May 2007 there were over 37,000 fake web sites As of May 2007 there were over 37,000 fake web sites

Phishing Derivatives Spear Phishing - Uses More Targeted Information Against Specific Group Spear Phishing - Uses More Targeted Information Against Specific Group Vishing – Prompt by to Call Toll Free Number to “Verify” Personal Information Vishing – Prompt by to Call Toll Free Number to “Verify” Personal Information Whaling – targets top level executives. Whaling – targets top level executives.

How “Phishing” Works The typical phishing scam usually starts with an message. (ex: work from home, post your résumé, Viagra) The typical phishing scam usually starts with an message. (ex: work from home, post your résumé, Viagra) The directs the victim to a fake web page, sometimes containing false addresses, fictitious web addresses, malware. The directs the victim to a fake web page, sometimes containing false addresses, fictitious web addresses, malware. The “Lure” often contains a place for the victim to enter personal data. The “Lure” often contains a place for the victim to enter personal data. Sometimes the scam opens the real web page, but uses a fake pop-up screen. Sometimes the scam opens the real web page, but uses a fake pop-up screen.

Earthlink

Citibank

Paypal

Paypal

AOL

E-Bay

CVV Phishing Scheme CVV Code (3 Digits) on the Back of Credit Cards CVV Code (3 Digits) on the Back of Credit Cards Call from Person Claiming to be with your Credit Card Company Call from Person Claiming to be with your Credit Card Company Already have Card Number Already have Card Number Sound Official, and Only ask for CVV code Sound Official, and Only ask for CVV code

ADDITIONAL TRICKS USED BY THIEVES Dumpster Diving Dumpster Diving Mail Theft Mail Theft Shoulder Surfing Shoulder Surfing Social Engineering Social Engineering IRS IRS Service of Court documents Service of Court documents Credit Card companies Credit Card companies

Minimize Your Risk Use secure mailbox for outgoing mail Use secure mailbox for outgoing mail Shred trash Shred trash Cancel lost/stolen cards ASAP. Cancel lost/stolen cards ASAP. Use credit cards, not debit cards online Use credit cards, not debit cards online Check your credit at least once a year Check your credit at least once a year Activate computer protections: keep software up to date, install virus and spyware software, and utilize your firewall Activate computer protections: keep software up to date, install virus and spyware software, and utilize your firewall Enable encryption on wireless routers Enable encryption on wireless routers Erase your hard drive when you dispose of your old computer Erase your hard drive when you dispose of your old computer Use “disposable” to thwart would-be spammers Use “disposable” to thwart would-be spammers Check web URLs and links carefully Check web URLs and links carefully

INDICATIONS OF ID THEFT Unauthorized Charges on your Accounts Unauthorized Charges on your Accounts Credit is denied despite good credit history Credit is denied despite good credit history Contact from creditors regarding debts you did not obtain or authorize Contact from creditors regarding debts you did not obtain or authorize Credit card and bank statements that are not received in the mail as expected Credit card and bank statements that are not received in the mail as expected

What should a victim do first ? File a report with local police File a report with local police File a complaint with the Federal Trade Commission File a complaint with the Federal Trade Commission Close accounts that were compromised or opened fraudulently Close accounts that were compromised or opened fraudulently Place a fraud alert on your credit reports and review your credit report Place a fraud alert on your credit reports and review your credit report

What’s a Fraud Alert? Legally requires creditors to use “reasonable policies and procedures” to verify your identity before issuing credit in your name. Legally requires creditors to use “reasonable policies and procedures” to verify your identity before issuing credit in your name. There are 2 types of Fraud Alert: There are 2 types of Fraud Alert: - Initial Alert: for 90 days - Extended Alert: for 7 years. Available if you’ve been a victim of identity theft and you provide the consumer reporting company with an Identity Theft Report

Online Identity Theft In addition to reporting to local police, file an FTC identity theft complaint at In addition to reporting to local police, file an FTC identity theft complaint at You can also report online thefts by filing complaint with (a joint effort of the FBI and the National White Collar Crime Center) You can also report online thefts by filing complaint with (a joint effort of the FBI and the National White Collar Crime Center)

Identity theft complaints and the FBI The FBI will except complaints from the victim, IC3 or another agency The FBI will except complaints from the victim, IC3 or another agency Generally the FBI handles larger more complex cases with multiple victims and/or large monetary losses Generally the FBI handles larger more complex cases with multiple victims and/or large monetary losses Smaller cases are referred to local agencies. Smaller cases are referred to local agencies.

Questions ?