Post on 14-Dec-2015
Identity Theft:How It Happens, Impact on Victims,
and Legislative Solutions
• Beth Givens
• Privacy Rights Clearinghouse
• 3rd Annual Privacy and Security Conference
• Nov. 7-8, 2002, Toronto, ON
Presentation Overview
1.Identity theft description & statistics
2.How the thieves obtain personalinformation
3.Impacts on victims
3.a Video segment of two victims
4.Legislative and industry solutions
5.Tips for consumers
6.Resources
I. What Is Identity Theft?
• Using someone else’s personal information for fraudulent purposes
• Account takeover
• Application fraud– new credit cards, loans, utilities, apartment
rental, cell phone, car purchase . . .
• Criminal identity theft
How Many Victims Are There?
• 500,000+ victims estimated per year U.S.
• 83,000 calls/mo. -- 50% from victims– Trans Union’s Fraud Dept., 500,000/yr.
• 1 in 5 adults (Image Data survey, 1999)
Victims in Canada
• Fastest-growing white-collar crime
• Increasing at about 55% per year– According to an Edmonton detective– CTV News, Sept. 29, 2001
• At least 12,000 victims per year
• There are 5 million more SINs issued than the Canadian population– According to Oct. ‘02 Auditor General report
Caseloads Are Increasing:Los Angeles County Sheriff
LA Sheriff Dept.ID Theft Caseload
Year 2000 Year 2001 Year 2002
Cases per yearPercent increase
2,119 4,149 + 96%
Estim. 6,000+ 45%
+ 283%
Cases per officer / yrIdeal caseload = 20
423 592 600
Source: Joe Dulla, LASD , Oct. 24, 2002
Why Is This Crime Is Rampant?
• Easy credit
• Inadequate application verification
• Ease of obtaining ID information…SSN
• Sloppy information security in workplace
• Inadequate law enforcement resources
• Penalties for convictions too weak
2. How Do Thieves Obtain Identification Information?
• Wallet theft
• Dumpster diving
• Access to credit reporting data bases
• Family, relatives, household workers ...
• Access to H.R. files in workplace
• An “Inside Job”
• “You’re protected against hackers, viruses and worms, but what about Rose in Benefits?”
• Magazine Ad for Computer Associates, eTrust Security Solutions (2001)
How Info Is Obtained, cont’d.
• Mail theft
• Change of address
• Telephone and Internet “spoofing”
• Internet
• Most identity theft is opportunistic
• Most victims do not know how the thief obtained their personal information
3. What Happens to Victims?
• Little help from the authorities
• Difficulty working with credit industry
• Abusive collection agencies
• Time-consuming
What Happens, Cont’d
• Emotionally scarred
• Lost opportunities
• Worst-case scenarios– criminal record– fraudulent work, unemployment, or
welfare record
• Must be savvy consumer
Credit Bureaus’ Fraud Depts.
• Phone # Canada U.S.•
• Equifax (800) 465-7166 (800) 525-6285
• Experian (N / A) (888) EXPERIAN
• Trans Union (877) 525-3823 (800) 680-7289
– Quebec (877) 713-3393
Identity Theft in Canada
• Recovering from identity theft in Canada is likely to be easier than in the U.S. . . because:
– Fewer credit reporting agencies– Fewer credit issuers– Fewer provinces and territories, and thereby
fewer government agencies to deal with.
Video Segment
• Victims tell their own stories (5 min.)
• “Stolen Identity: The Crime of the Millennium” (1999)
• Produced by Sun & Moon Productions, Selene Kassin, distributed by Aims-Multimedia.com
4. Legislative Solutions
• Federal (U.S.) Identity Theft and Assumption Deterrence Act (18 USC 1028)
• Federal crime when anyone knowingly transfers or uses, without lawful authority, a means of
identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of federal law, or that constitutes a felony under any applicable State
or local law.
U.S. Federal Law, cont’d.
• Took effect in 1999
• Federal felony
• Establishes identity theft clearinghouse within Federal Trade Commission– Toll-free number: (877) IDTHEFT– Data base, to be shared w/ law enf.– Web site: www.consumer.gov/idtheft
State Laws
• Most of the states now criminalize ID theft– Listed on FTC website:– www.consumer.gov/idtheft
• California– Incremental approach, several laws each year – www.leginfo.ca.gov
California Statutes
• Criminalizing identity theft
– Misdemeanor / felony “wobbler” for use of personal information for unlawful purposes
– Requires notation of court record if imposter is convicted in victim’s name
– California Penal Code 530.5 (1997)
Information trafficking
• Penalties for trafficking in personal information– Every person who, with the intent to
defraud, acquires, transfers, or retains possession of personal identifying information of another person, is guilty of a crime punishable by up to $1,000 and one year in county jail.
– California Penal Code 530.5
Police report - credit report
• Correcting the credit report - with police report from victim
– If victim submits police report to credit bureau listing the fraudulent accounts, the credit bureau must remove (block) them and inform the credit grantors that the information has been removed.
– California Civil Code 1785.16(k)
Jurisdiction of record
• Establishing jurisdiction of record as victim’s own locale
– Local police department must take a police report, even if crime is committed elsewhere
– California Penal Code 530.6
Access to documentation
• Credit issuer must give documentation to victim and to law enforcement
– Copies of applications, checks, account statements, etc.
– California Penal Code 530.8
Security “freeze”
• Security alerts and security freezes
– Beginning Jan. 2003, credit bureaus must enable consumers to establish “freeze,” prohibiting the credit bureau from giving report to anyone without consent
– California Civil Code 1785.11.1 & .2
Protection from debt collectors
• Protection from debt collector harassment– No creditor can sell a consumer’s debt to a
collection company once the individual has reported the fraud to the credit bureau
– California Civil Code 1785.16.2– Victim may seek injunction against debt
collector who pursues payment– California Civil Code 1798.92-97
Address-change checking
• Address verification
– Credit issuer must verify address if (1) an application of credit shows a different address than the one on the preapproved offer, and (2) when a request for a duplicate card comes within 10 days of request for change of address
– California Civil Code 1747.06
Credit card no. truncation
• Truncation of credit card number on transaction slip
– No more than the last 5 digits of a credit card number may be printed on electronic receipts, effective January 2004
– California Civil Code 1747.9
The shredding law
• Destruction of customer records -- the “shredding” law
– Businesses are required to shred, erase, or otherwise destroy records containing personal information upon disposal
– California Civil Code 1798.80-82
The “hacker” notice law
• Disclosure of computer security breaches
– Requires business or government agency to notify individuals when personal information such as SSN and DOB has been accessed in a computer breach
– California Civil Code 1798.29
Restrictions on SSNs
• Confidentiality of Social Security Numbers
– Individuals & commercial entities may not:– publicly display or post SSNs– print SSNs on ID cards or badges– require people to transmit SSNs over the
Internet unless encrypted
SSNs, cont’d.
• Confidentiality of SSNs, cont’d– Individuals & commercial entities may not:– require people to use the SSN to logon to the
Internet without a password– print SSNs on mailed documents
– Phased in from July 2002 - July 2005– California Civil Code 1798.85
Criminal identity theft
• Dealing with criminal identity theft– Judicial process for clearing your name– California Penal Code 530.6(b)
– Data base of criminal ID theft victims– California Attorney General -- (888) 880-0240– California Penal Code 530.7– See PRC Fact Sheet 17(g)
Industry Responses
• Uniform fraud affidavit– major credit issuers now accept it– coordinated by Federal Trade Commission– www.consumer.gov/idtheft
• Automated profiling programs to detect fraud
– phone call or letter from credit issuer to the victim -- early detection
Industry Responses, cont’d.
• Credit monitoring services -- $40-$80/yr.
– PrivacyGuard.com– Intersections.com– Consumerinfo.com– Equifax.com
Industry Responses, cont’d.
• Identity theft insurance -- $40 - $140/yr.
– PromiseMark.com– Identityfraud.com– TrueLink.com– Travelers Insurance, low-cost rider– Chubb Insurance, no cost
Recommended Credit Industry Reforms
• Criminalizing identity theft is not enough
• See our report and survey results: “Nowhere to Turn: Victims of Identity Theft Speak Out”– CALPIRG & Privacy Rights Clearinghouse– at PRC web site:
www.privacyrights.org/ar/idtheft2000.htm
Credit Industry Reforms ...
• Free credit report annually– Early detection– Only 6 states require free reports
• Notice to consumer when credit report is accessed (Colorado)
Credit Industry Reforms ...
• Improve fraud flag process and penalize credit issuer when fraud alerts are ignored
• Improve address-change confirmation
• Credit application verification more rigorous
Other Recommended Reforms
• Restrict uses of SSNs & credit headers– Prohibit sale of SSNs on the Internet– Remove SSNs from public records posted
on Internet
• Improve Dept. of Motor Vehicles procedures– dup/replacement licenses flagging for fraud
• Biometrics?
5. Tips to Prevent and Minimize Identity Theft
• Check credit report at least once / year
• Clean out your wallet
• Don’t carry your SSN / SIN card
• Shred household papers before disposing
• Shred workplace papers and e-files
• Protect outgoing and incoming mail
Tips, cont’d.
• Have new checks sent to the bank branch
• Limit who obtains your SSN / SIN
• Watch for monthly account statements
• Don’t give out personal information on the phone unless you make the call
6. Resources
• “Identity Theft: What to Do if It Happens to You,” Fact Sheet 17a
• “Coping with Identity Theft,” FS 17
• “Nowhere to Hide” by PRC & CALPIRG
• www.privacyrights.org/identity.htm
Resources, cont’d.
• Identity Theft Resource Center
– Fact sheets for victims covering all phases of the crime recovery process
– One-to-One victim assistance– Affiliated with the Privacy Rights Clrgh.– www.idtheftcenter.org
Resources, cont’d.
• “When Bad Things Happen to Your Good Name” by Federal Trade Commission– (877) IDTHEFT
– www.consumer.gov/idtheft– FTC statistics at www.consumer.gov/sentinel
• “Identity Theft Survival Kit” and “From Victim to Victor” by Mari Frank, Esq. – www.identitytheft.org
Web Sites -- Identity Theft
• PRC www.privacyrights.org• Identity Theft Resource Center
www.idtheftcenter.org• FTC www.consumer.gov/idtheft• M. Frank www.identitytheft.org• CALPIRG & USPIRG www.pirg.org
Reporting ID Theft in Canada
• PHONEBUSTERS National Call Centre
• Ontario Provincial Police Anti-Rackets
• Toll Free: (888) 495-8501
• Toll Free Fax: (888) 654-9426
• Email: info@phonebusters.com
• Web: www.phonebusters.com
Resources for Canadians
• Royal Canadian Mounted Police– Identity theft pages– www.rcmp-grc.gc.ca/scams/identity.htm– www.rcmp-grc.gc.ca/news/nr-01-09.htm
• Privacy Commissioner of Canada– “Identity Theft: What It Is & What You Can Do”– www.privcom.gc.ca/fs-fi/02_05_d_10_e.asp
Resources for Canadians ...
• Ontario Information & Privacy Commission– “Identity Theft and Your Credit Report”– www.ipc.on.ca/english/pubpres/if-you/credit.htm
• Ontario Ministry of Consumer & Bus. Svcs.– ID theft tips with emphasis on birth certificates– www.cbs.gov.on.ca/mcbs/english/55XMZ8.htm– www.cbs.gov.on.ca/mcbs/english/575RNJ.htm
Resources for Canadians ...
• Credit Reporting Agencies• Equifax Canada
– Reporting fraud (800) 465-7166– www.equifax.com/EFX_Canada/
• Trans Union Canada– Reporting fraud (877) 525-3823– www.tuc.ca
• Acknowledgements: Ontario OIP and Public Interest Advocacy Centre
Canada Identity Theft Study
• “Identity Theft: Do Canadian Consumers Deserve Better Protection?”
• Public Interest Advocacy Centre
• Due Spring 2003
• (613) 562-4002
• www.piac.ca