Identity Theft Bryan Lewis, CISSP June 11th, 2007

1. Identity Theft Bryan Lewis, CISSPJune 11th, 2007

2. Topics we will cover today • UVa Incident - Why was my information disclosed and what can I do? • What is identity theft, why and how does it happen? • Scenario 1: My information has been disclosed • Scenario 2: My information is used maliciously • How to prevent it?

3. UVa Incident • Names, SSN, Birthdates of 5,735 faculty members exposed • Hackers accessed a compromised web server 54 times between May 20, 2005, and April 19, 2007. • Any faculty between 1990 and August 2003 affected • http://www.virginia.edu/itincident/

4. UVa Incident • Why was my first name wrong in the email I received on this issue? • Why does UVa have my SSN in a database in the first place? • Why is this information accessible from the internet? • Why isn’t more information available on what actually happened? • What has UVa done to help protect me?

5. U.Va. Has Paid for Credit Monitoring • One year complimentary subscription to triplealert (through Experian) • Unlimited access to your Credit Report • Daily monitoring of all three of your national credit reports and email alerts if key changes are detected. • $50,000 Identity Theft insurance provided by Virginia Surety Company, Inc.* • Personal assistance from a fraud resolution representative if you are to become a victim of Identity Theft.

6. How Information is Stolen

7. How Identity Theft Happens • Here are some of the most common ways identity thieves can gain access to your information. They: • Steal wallets and purses containing your identification, credit and bank cards, and your UVa ID. • Steal your mail, including bank and credit card statements, phone bills and tax information • Complete a “change of address form” to divert your mail to another location

8. How Identity Theft Happens (Cont) • Steal or illegally purchase personal information on the Internet • Call you claiming to be a well know reputable company, asking for personal information. • Send you an email, which appears to be from a reputable company, asking to respond or go to a web site and provide your personal information. This practice is know as “phishing” • Set up bogus web sites that look like familiar legitimate sites and ask you to provide personal information. This practice is known as “spoofing”.

9. What do they want with my info?

10. Scenario One • Your personal information has been disclosed

11. If your information is disclosed • Contact one of the three credit bureaus to request an initial fraud alert be added to your personal file. • Initial alert stays on for 90 days • Information will be passed on to the other two credit bureaus automatically • Equifax, Experian, TransUnion • U.Va. has paid for a one year monitoring service with Experian

12. If your information is disclosed • Notify your bank(s) and ask them to flag your account, contact you regarding any unusual activity and take the following actions in the event of such activity: • If checks were stolen, place stop payments on them. • If bank accounts were set up without your consent, close them. • If your ATM card was stolen, issue a new card, account number and PIN.

13. If your information is disclosed • Notify the issuers of the credit cards you carry. If unauthorized charges appear on your legitimate credit cards or if unauthorized cards have issued in your name: • Request replacement cards with new account numbers. • Monitor credit card bills for new fraudulent activity. If found, report it immediately to the credit card issuers and credit reporting agencies.

14. Scenario Two • Your stolen personal information is used to commit identity theft

15. If your Stolen Information is used

16. If you Confirm that you are a Victim • Check with any online accounts, merchants or payment services that you use for any fraudulent activity against your account. • Contact your local police department to file a criminal report. • Contact the Social Security Administration’s Fraud Hotline (800) 269-0271 to report the unauthorized use of your personal identification information. • Notify the Department of Motor Vehicles of your identity theft. Check to see whether an authorized license number has been issued in your name.

17. If you Confirm that you are a Victim • File a complaint with the Federal Trade Commission. Visit the Federal Trade Commission website at http://www.consumer.gov or call 1-877-438-4338 • Contact the local office of the United States Postal Service or go to its website www.usps.com/websites/depart/inspect/ and file an “Identity Theft via US Mail” complaint form with the Postal Inspector. • Document the names and phone numbers of everyone you speak to regarding the incident. Follow up your phone calls with letters. Keep copies of all correspondence.

18. If you Confirm that you are a Victim • Complete the Identity theft report • Part 1 of this report is a copy of the police report filed • Part 2 is documentation from the company or companies where the fraudulent activity took place. • An Identity theft report is required for an extended fraud alert on your account • Lasts 7 years • Five years of No credit card offers!

19. How do I protect Myself? • Check your credit report regularly. You may request your free annual credit report by visiting http://www.AnnualCreditReport.com or calling (877) FACTACT. • Coming Soon? Freeze your credit (HB 3056 )

20. Credit Bureaus • Equifax • (800) 525-6285 • Post Office Box 740241 • Atlanta, GA 30374-0241 • http://www.equifax.com • Experian • (888) 397-3742 • Post Office Box 9532 • Allen, TX 75013 • http://www.experian.com • TransUnion • (800) 680-7289 • Fraud Victim Assistance Division • Post Office Box 6790 • Fullerton, CA 92834-6790 • http://www.transunion.com

21. Resources • Fighting Back against Identity Theft • http://www.ftc.gov/bcp/edu/pubs/consumer/idtheft/idt04.pdf