IDENTITY THEFT

1. IDENTITY THEFT Targeting aModern Problem with Modern Solutions Developed by Greg Nelson, CPCUand Lynn Davenport, CPCUFor the CPCU Society’s Information Technology Interest Group

2. Overview • Understand the implications of identity theft. • Describe methods that thieves use to steal identities. • Understand the financial and non-financial losses resulting from identity theft. • Discuss the insurability of and availability of insurance for identity theft. • Understand ways to reduce risk of identity theft.

3. What is Identity Theft? “Identity theft occurs when someone uses your name, address, Social Security number (SSN), bank or credit card account number, or other identifying information without your knowledge to commit fraud or other crimes.” - Federal Trade Commission

4. Unfortunate Victims Sample Case Studies: Michelle Brown: (More than $50,000) • Thief stole apartment rental application from her landlord. • Used her personal information to spend more than $50,000: new car, liposuction, to rent properties, and to participate in drug trafficking. • Perpetrator went to prison under Michelle’s name.

5. Unfortunate Victims Sample Case Studies: Lt. Col. John Stevens: ($27,000 Jeep in Dallas)($113,000) • Got a call one day from creditors wondering why he hadn’t paid for his new $27,000 Jeep in Dallas, where he had never lived. • Discovered 33 fraud accounts in his name after someone stole his PIN number, leaving him with $113,000 in unpaid debt. • Took 3 years and $6000 to straighten things out, unable to secure credit to buy a vacation home.

6. Unfortunate Victims Sample Case Studies: Tracey Thomas: (“Only” $500) • SS number stolen from health insurance card by a hospital employee. • Rented an apartment, set up utilities, opened credit card accounts. Imposter defaulted on almost $15,000 worth of goods and services. • Out of pocket loss was only $500 but she had to use 400 hours of vacation to work on clearing her name, and she was unable to get a legitimate mortgage.

7. Unfortunate Victims Sample Case Studies: Linda Trevino: (Could not get a job) • SS number stolen from health insurance card by a hospital employee. • Rented an apartment, set up utilities, opened credit card accounts. Imposter defaulted on almost $15,000 worth of goods and services. • Out of pocket loss was only $500 but she had to use 400 hours of vacation to work on clearing her name, and she was unable to get a legitimate mortgage.

8. The Problem BBB & Javelin 2006 Identity Fraud ReportUpdated from 2003 study • Identity theft = Number 1 consumer complaint • Annual victims = 9 million • 1 in 23 people = victims of ID theft • Average fraud per victim = $6383 • Average out of pocket cost to fix = $440/1180 • Average time to fix problem = 40 hours • Between 2003 & 2006, number of victims decreased but cost and time to resolve the problems have increased. • Cost to buy a stolen identity???

9. Are You at Risk?

10. Look in your wallet . . . • Did you find your Medicare card in your wallet?The identification number on your Medicare card is your Social Security number. Only carry this card when you are going to a doctor's appointment or know you will need it. • How many cards have your Social Security number?Thieves love your Social Security number. With your number, they can impersonate you and obtain new credit accounts. Make sure your SSN is not listed on your driver’s license or bank checks. Do not carry your Social Security card with you. • Which of these is a safe place in your home to store all the pieces of paper that have personal information about you? • On the table just inside the front door • In the kitchen junk drawer • Next to the telephone • In a secure desk drawer • On the piano • In a locked file cabinet

11. Internet increases the risks of identity theft. Myths & Misperceptions • Only 9% of identity theft is from online activity. • The 2005 ChoicePoint scandal is an example of a situation where identity thieves posed as authorized clients to access information that impacted 51 million consumers. This impersonation enabled them to gain access to ChoicePoint’s customer data. No one hacked into ChoicePoint’s system to steal identities; this was an old-fashioned scam. So online transactions really aren’t any riskier than the paper shuffle in terms of ID theft.

12. Consumers are helpless to protect themselves. Myths & Misperceptions • 63% of fraud is created by friends/family, lost or stolen wallets, stolen home computers, and stolen mail. • Consumers detect almost half of ID theft cases and detect them faster. A key part of self-detection is credit monitoring and credit reports.

13. How to Steal an Identity:Need Key Info • Social Security number • Medical ID cards • Utility bills • Property taxes • Student ID cards • Driver’s license number • Pre-approved credit cardsolicitations

14. Old Fashioned Paper Scams • Steal wallet or purse, steal from your home • “Dumpster Diving” • Steal mail from mailbox

15. ATM Scams

16. Electronic Scams “Pre-texting”,which is the use of false pretenses to get your personal information. They may call you, pretend they are from a survey firm or one of your trusted creditors, and ask you some questions. When they get the info they want, they use it to call your financial institution and pretend they need information about their account.

17. Electronic Scams “Phishing” is another scam that is growing with increasing sophistication (grew 13-fold during 2004). Has anyone ever received an email from PayPal warning that your account has been disabled, and you must log on through the link to reactivate your account? It’s a scam! Thieves email you a false link that appears to be from a trusted business such as eBay or your bank. However, when you click on the link and confirm account information or enter passwords, thieves record your personal information and use it later.

18. Sample Scam 1 Let’s look at a real phishing attempt that was received in an email. You’ll notice it was not addressed to anyone by name, it’s very generic. The person who received this does have a PayPal account, so how would he or she know if this is real? They went directly to the PayPal website (not through the link) and logged into her account. On the account Resolution page, there were no open cases and no problems were found. They forwarded this email to spoof@paypal.com as directed by the website’s security page, and received the response on the next page.

19. Sample Scam 1 This was the response from spoof@paypal.com So, it was definitely a scam! Who knows what would have happened if she’d clicked on the link in the email.

20. Sample Scam 2

21. Phishing Risk Tips A few tips to help reduce the risk of phishing: • Don’t use the link in the email. Log into the website directly by typing its correct address into your browser. • Make sure you’re on a secure website when submitting sensitive information. Be aware: • Phishers can now forge both the “https://” and a legitimate-looking web address. Again, don’t depend on links.

22. Phishing Risk Tips More tips to help reduce the risk of phishing: • They can also forge the yellow lock you see at the bottom of a secure site. Double click on the lock and you should see the security certificate for the site. If you get any warning that the site’s address doesn’t match the certificate, do not continue. • Monitor your online accounts by regularly logging into them and checking your statements for accuracy. • Keep your Internet security patches up to date. • Report phishing by forwarding the email to: reportphishing@antiphishing.org and the FTC at spam@uce.gov. Keep the original email intact, including all headers.

23. Types of Losses Financial Losses • Credit card bills, loans, contracts, etc. • Cost to clear credit record • Cost of notarizing fraud affidavits & mail • Cost of time off work to handle situation Non-financial Losses • Time and effort to clear record • Damage to reputation • Emotional impact • Time spent in jail

24. Is ID Theft Insurable? • Loss must be definite • Loss must be accidental and fortuitous • Potential loss must be large enough that it would cause hardship • Chance of loss must be calculable • Peril must be unlikely to happen to many of the group at the same time • Cost of insurance must be economically feasible

25. Buy InsuranceMany companies offer ID theft insurance • AIG, Allstate, Chubb, Fireman’s Fund, Travelers, Encompass, Farmers, Liberty Mutual, MetLife • Endorse homeowners policy • Buy separate policy • ISO Identity Fraud Expense Coverage • Third party vendors • Features: Limit of $15,000 to $30,000 • Legal fees • Time off from work • Expenses to clear credit records • But you still have HASSLE factor!

26. An Ounce of PreventionWhat you can do to reduce the hassle factor! • Protect your personal info and ID • Electronic Safeguards • Paper Safeguards • General Safeguards Check out the detailed Fact Sheet at www.privacyrights.org for information on how to reduce your risk.

27. An Ounce of PreventionWhat you can do to reduce the hassle factor! Electronic Safeguards • Use strong passwords (alpha-numeric-character, at least 8 digits) • Don’t write your passwords near your computer • Don’t click on a link in an email that asks for personal info, type in the web address of the institution you already know • Don’t send credit card or SS # through e-mail, unsecured (sits on up to 30 servers)

28. An Ounce of PreventionWhat you can do to reduce the hassle factor! Paper Safeguards • Protect mail with vacation hold and locking mailbox Shred paper documents, including credit card solicitations • Monitor bills and review listing of items that have been charged

29. An Ounce of PreventionWhat you can do to reduce the hassle factor! General Safeguards • Keep key info out of wallet/purse; keep it in secure place (no SSN card in wallet!) • Check credit record periodically, free annually by Federal Law • Decline free credit card offers (call 888-5 OPT OUT) • Don’t give info to people you don’t know, by phone, email, internet, or in person • Photocopy the contents of your wallet, both front and back. If ever lost or stolen, you’ll have copies of account numbers and phone numbers to cancel your cards. Also photocopy your passport when traveling and give a copy to a non-traveling family member. (keep in a safe place)

30. Beware and Be Aware ID Theft can happen to ANYONE. Know your risk areas! • Lock up confidential documents & files • Maintain a consistent privacy and document retention policy • Shred confidential documents appropriately • Be aware of risks with wireless hot spots and the information you transmit • Encourage coworkers to do the same!

31. Hot Topic: Auto ID Theft Auto Cloning – Theft of your car’s identity! How common is it? • Been around for a long time, becoming more popular for organized crime rings. • 225,000+ cloned vehicles seized by National Insurance Crime Bureau (NICB) in the past three years in U.S. • 30% of cars purchased online are either flood vehicles or clones.

32. Hot Topic: Auto ID Theft Auto Cloning – Theft of your car’s identity! How does it happen? • Bad guy copies a Vehicle Identification Number (VIN) from a car (any car in parking lot or dealer lot) • Creates a fake VIN sticker and title • Steals a similar make/model car and replaces its VIN with the fake one. • Now the stolen car is a clone of the legitimate car, and can be registered in another state. • The stolen car is then sold to an innocent purchaser.

33. Hot Topic: Auto ID Theft Auto Cloning – Theft of your car’s identity! What happens if you bought a stolen car unknowingly? • Insurance is void, car can be seized by authorities and you’ll be stuck with the car payments.

34. Hot Topic: Auto ID Theft Auto Cloning – Theft of your car’s identity! How do you protect yourself? • Check your VIN numbers in multiple locations on your car to make sure they match. If they don’t, don’t buy it. • Use resources to check history of the car before you buy. • Resources • www.nicb.org • www.carfax.com • www.autofax.com • www.autoconsumerguide.com

35. Key ResourcesWhere to go for help Federal Trade Commission • http://www.consumer.gov/idtheft/ Credit Bureaus • Equifax: 1-800-525-6285; www.equifax.com • Experian: 1-888-EXPERIAN (397-3742); www.experian.com • TransUnion: 1-800-680-7289; www.transunion.com Annual Free Credit Report (Federal Law) • www.annualcreditreport.com Social Security Administration Fraud Line • 1-800-269-0271

36. Target preventionbefore ID thieves target you!For more information:http://www.privacyrights.org/identity.htm