Identity Theft and the Impact on the Telecom Industry Debbie Ogle Corporate Security Fraud Manager January 27, 2005

2 Part I The Truth About Identity Theft

3 What is Identity Theft?  Identity theft is the fraudulent use of a person’s name and identifying data by someone else to obtain credit, merchandise, or services  All that identity thieves really need to open new accounts under your name or to drain your existing accounts are three pieces of information: –Your full name –Your date of birth –Your Social Security Number

4 How Does Identity Theft Occur?  Obtaining information from businesses or other institutions by: –Stealing records from employers –Bribing an employee who has access to these records –Hacking into an organization’s computer  Rummaging through trash in a practice known as “dumpster diving”  Obtaining credit reports by posing as a landlord, employer, or someone else who may have a legal right to the information  Stealing wallets and purses containing identification and credit and bank cards

5 How Does Identity Theft Occur?  Stealing mail, including credit card statements, pre-approved offers, new checks, or tax information  Completing a change of address form to divert your mail to another location  “Skimming” - stealing credit and debit card numbers as your card is processed by using a special information storage device  “Phishing” - scamming information from you by posing as a legitimate business person or government official

6 What Can Happen Once Your Identity is Stolen?  New credit card accounts can be opened, which show up on your credit report when not paid  Utility services can be established in your name (phone, electricity, etc.)  New bank accounts can be opened and bad checks written on those accounts  Counterfeit checks and debit cards can be used to drain your existing bank account  Auto loans can be obtained in your name  Your name can be given to police during an arrest

7 How is Identity Theft Discovered?  According to a survey in 2003 by the Federal Trade Commission (FTC): –52% of victims (approximately 5 million people) discovered identity theft by monitoring their accounts –26% (approximately 2.5 million people) reported they were alerted to suspicious account activity by companies such as credit card issuers or banks –8% reported that they first learned of identity theft when they applied for credit and were turned down

8 Is Identity Theft Really a Big Problem?  The Department of Justice says identity theft is the nation’s fastest growing financial crime  A survey released by the Federal Trade Commission showed that 27.3 million Americans have been victims of identity theft in the last five years  In the last year alone, 9.9 million people were victims of identity theft  Last year’s identity theft losses to businesses and financial institutions totaled nearly $48 billion  Consumer victims reported $5 billion in out-of-pocket expenses

9 Cases of Identity Theft  In testing the security of online merchant Guess before buying a pair of jeans, a 19 year old novice programmer was able to break in and retrieve 200,000 customer names and credit card numbers  A 22 year old student from Bulgaria issued a fake credit card in the name of Microsoft Chairman Bill Gates as part of a global crime gang producing counterfeit driver’s licenses and passports in more than 25 countries  A 16 year old recently discovered he had a DUI on his record before he even had a driver’s license; perpetrator had also opened credit card accounts and obtained a mortgage  Last year Visa, MasterCard, and American Express confirmed that an unknown hacker had accessed 8 million credit card records from a merchant processor; a research and advisory firm estimates that at least 1% of those accounts (80,000 consumers) will become targets of fraud

10 What is Being Done About Identity Theft?  The Identity Theft and Assumption Deterrence Act enacted by Congress in 1998 made identity theft a federal crime  Violations are investigated by the Secret Service, FBI, Postal Inspection Service, and Social Security Administration  In most cases, conviction for identity theft carries a maximum of 15 years imprisonment

11 How Can You Minimize the Risk of Identity Theft?  Periodically review your credit report looking for inquiries you did not initiate, accounts you did not open, and unexplained debts on your true accounts  Place passwords on your credit card, bank, and phone accounts  Do not give out personal information on the phone, through the mail, or over the Internet unless you have initiated the contact  Deposit outgoing mail in post office collection boxes instead of home mailbox  Shred charge receipts, copies of credit applications, insurance forms, physician statements, check and bank statements, and expired charge cards

12 Part II The Impact of Identity Theft on the Telecom Industry

13 How is Identity Theft Impacting the Telecom Industry?  According to a survey released in March 2004 by the Telecommunications Risk Management Association (TRMA), identity theft is the leading type of fraud affecting the telecom industry  According to the FTC, phone or utility fraud ranks second only to credit card fraud in number of fraud cases reported  Identity theft is being used to steal products and services from telecom companies  Fraudulent phone accounts are being established and kept in good standing in order to commit more serious crimes

14 How is Fraud Being Perpetrated Against Telecom Companies?  Phone accounts are being paid using stolen credit cards and banking information  Accounts are being established using stolen identities for people unable to obtain service  Residential and small business accounts are being established and cell phones are being ordered against those accounts  Customers are receiving calls from perpetrators pretending to represent telecom companies insisting that customers provide their credit card or bank information to pay past due accounts

15 What is BellSouth Doing to Combat Identity Theft?  Corporate Security developed a comprehensive Corporate Fraud Program that focuses on the prevention, detection, investigation, and correction of fraud  Corporate Security investigates identity theft cases and works with law enforcement to track and apprehend perpetrators  Credit Verification Group assists victims of identity theft in clearing their records  Customer Markets working on improvements to the customer authentication process –Completed trial for “out-of-wallet” customer authentication tool –Conducting trial with Network, Small Business, and Accounts Receivable to identify fraudulent small business accounts prior to installation

16 Who is Liable?  Ligand Pharmaceuticals settled a negligence lawsuit in San Diego over identity thefts that occurred when personnel records were left in an unlocked area; a worker discovered the records and used them to open fraudulent credit accounts  Federal class action lawsuit settled for $2.5 million for identity theft and invasion of privacy against car dealerships that placed 168 loans in plaintiffs’ names without their knowledge  $81 million lawsuit filed against Bank of America accusing the bank and an employee of scheming to get thousands of unauthorized consumer credit reports and selling them to third parties

17 Questions? Corporate Security Fraud Managers Debbie Ogle Cheryl Jordan