IDENTITY THEFT

1
IDENTITY THEFT

• Presented by CITS IT Security
• Susan Bedwell
• April 24, 2003

2
What is Identity?

• That which makes us recognizable and accountable
  to society and its institutions
• The common manner in which all humanity
  associates both tangible and intangible
  attributes to a unique individual

3
What is Identity Theft?

• Is where someone uses the identity of another in
  a manner that adversely affects the victims
  reputation, assumes their privileges or impacts
  the victims family

4
Statistics

• RCMP predicts 20,000 new cases will surface in
  2002
• Identity fraud is the fastest growing kind of
  fraud according to the US Federal Trade
  Commission (FTC)
• The FTC says it accounts for 40 per cent of all
  consumer fraud complaints
• In 1992 Trans Union received 35,000
  Identity-theft calls then in 2000 there were
  between 600,000 to 700,000 calls

5
Statistics

• The Council of Better Business Bureaus in Canada
  estimates that identity theft costs 2.5 billion
  a year to consumers, banks, credit card firms,
  stores and other businesses. The council states
  identity theft is growing exponentially and many
  blame the advent of electronic communications
  The Internet
• According to Canada's social insurance registry,
  there are about 1.4 million more social insurance
  cards in circulation than there are people in
  this country

6
Types of Identity Theft

• Three common types of Identity Theft
• Tombstoning
• the dead child method
• Credit/Account take-over
• is where the criminal takes the identity of a
  living person
• Counterfeit documents
• using HW/SW to create counterfeit documents

7
Tombstoning

• Research obituaries or similar archive records to
  determine sufficient information on which to
  submit an application for a birth certificate
• Sometimes the Date of Birth is missing from the
  obituary but it can be obtained from the grave
  site
• With the birth certificate the criminal can then
  apply for secondary identification

8
Tombstoning

• Advantages
• No pre-existing SIN (In the case of children)
• Doesnt co-exist with living person
• No pre-existing history to trip over
• Long term impersonation
• Once established, little or no chance of being
  detected
• Disadvantages
• Person appears out of nowhere
• Must completely abandon old identity
• No credit history
• Documents issued at the same time, need to be aged

9
Account/Credit Takeover

• Criminal steals information about living person
  through a variety of means limited only by
  imagination
• People are their own biggest source of leaked
  information
• Intent is to mirror the victim to obtain assets

10
Account/Credit Takeover

• Advantages
• ID already established
• Net 20,000-30,000 each identity
• ID is easily abandoned
• Disadvantage
• Co-exist with a living person
• Never knows how good the credit rating is
• Never sure when misuse of ID has been discovered

11
Counterfeit Breeder Document

• Using Commonly Available Hardware and Software to
  create/alter real documents
• Off-set or web printing presses

12
How do they do it?

• A social insurance number and a date of birth are
  all that's needed to assume another person's
  identity
• Mail and garbage are two ways that criminals
  harvest information, people are usually their own
  leak
• Phone solicitation
• Once personal information obtained they apply for
  a Birth Certificate, new Identification and
  transfer Credit Cards to new address

13
How Is Identity Theft Discovered?

• An arrest is made on the street
• An individual discovers someone has been using
  their identity
• Inter-agency cross referencing of fraudulent
  names and addresses
• Complaints received from banks and financial
  institutions

14
Who is responsible to protect our identity?

• Each individual is responsible to protect their
  own identity
• There is no single agency responsible to protect
  an individuals identity

15
How to Protect Yourself

• Locked Mailbox
• Shredding name/address documents
• Check your Equifax report annually
• Dont provide SIN unless required by law
• Dont have cancelled cheques sent to residence

16
How to Protect Yourself

• When asked for personal information, ask how it
  will be used, why it is needed, who will be
  sharing it and how it will be safeguarded
• Never carry more ID than you need leave your
  passport, SIN card, birth certificate, extra
  credit cards, your driver's licence (if you don't
  need it) in a secure place at home
• Take advantage of technologies that enhance your
  security and privacy when you use the Internet,
  such as digital signatures, data encryption, and
  "anonymizing" services

17
How to Protect Yourself

• Don't give your credit card number on the
  telephone, by electronic mail, or to a voice
  mailbox
• Pay attention to the billing cycle for everything
  - if it's late call the company
• See article http//www.cbc.ca/consumers/indepth/
  identity/
• Ask that your accounts require passwords before
  any inquiries or changes can be made, whenever
  possible

18
How to Protect Yourself

• Choose difficult passwords NOT your mother's
  maiden name. Memorize them, change them often.
  Don't write them down and leave them in your
  wallet, or some equally obvious place
• Key in personal identification numbers privately
  when you use direct purchase terminals, bank
  machines, or telephones
• Find out if your cardholder agreement offers
  protection from credit card fraud you may be
  able to avoid taking on the identity thief's
  debts

19
Current Laws in Canada

• Sections 403 (Personation), 380(1) (fraud), 367
  (forgery) 362(1)(b) (false application for
  credit) sec 362((1)(a)uttering a forged doc)
• No Criminal Code offence for simple possession
  of false identification

20
Solutions Federal Govt

• A national identification card with biometrics
• Laws / legislation
• Co-operation amongst policing agencies
• Greater leadership from Federal Government
• Educate the public
• Co-ordinate and investigate identity theft
  nationally

21
Solutions - Provinces

• Consistent and compatible protocols for issuing
  documents, sharing information etc.
• Information systems that are compatible with one
  another
• Increased dialogue with one another

22
Websites and Resources

• Equifax Personal Credit Check
• http//www.equifax.ca/
• Better Business Bureau
• http//www.bbbvanisland.org/
• RCMP What is Identify Theft?
• http//www.rcmp-grc.gc.ca/scams/identity_e.htm
• Privacy Commissioner of Canada
• http//www.privcom.gc.ca/fs-fi/02_05_d_10_e.asp
• CBC News Mail Theft
• http//cbc.ca/cgi-bin/templates/view.cgi?category
  Canadastory/news/2002/03/16/mail_theft020316

23

24
(No Transcript)
25

• Questions?