by Heather Wells

In a recent article dated June 20, 2008 from npr.org, writer Dina Temple-Raston reports on the arrest of hundreds of people believed to be guilty of scamming the public out of millions of dollars of hard earned home equity.

She writes, “instead of stealing an identity to secure a credit card, scammers have been zeroing in on people they think have a lot of equity in their homes. They steal their identities, then go online and get a home equity line of credit on that person’s house and take the money.”

It’s a terrifying scenario for consumers who have worked hard for years to establish good equity and credit. As someone who works directly with victims of id theft, I know how frustrating it is for victims when the person who stole their identity is never caught or prosecuted. I am hoping that the news of these crooks getting arrested will bring about a feeling of justice for victims; that something is being done and people are being punished.

Temple-Rason concludes her piece with this warning, “the FBI is sending a specific message: If you are involved with mortgage fraud — whether on Wall Street with high-level investors, or on Main Street with ordinary homeowners — the bureau intends to catch and prosecute you.”

Score one for the little guy. For more, check out this video:

by Doug Pollack

So much of what is written about identity theft today centers around the way in which it is perpetrated, the nature of the fraud and how this is evolving, and the failure of companies to keep personal information of their employees, clients and customers secure. What doesn’t tend to be as newsworthy or prominent is how identity theft impacts the lives of people.

A recent article titled “Dealing with ID theft can be expensive, emotionally draining and time-consuming” addresses this subject. It references an FTC study that highlights that more than 27 million people became victims of identity theft in the past five years, and that 41 percent of them were still dealing with the problem two years after it occurred. If further concludes that the recovery process could take about 500 hours and cost about $3,000.

Heather Wells who heads the identity theft restoration team for ID Experts is quoted in this article as saying:

“The emotions they go through is pretty similar to what victims of other crimes experience.  First there is shock and disbelief. Sometimes shame is involved. They lose trust in other people. Sometimes problems with their spouses come up because it’s so stressful. Many cases involve family members or close friends who have done this. That’s probably the worst thing.”

While there is a lot that people can do to reduce their chances of falling victim to identity theft, the bad guys are continuing to grow in sophistication and an increasing percentage of ID theft is now perpetrated by organized crime groups residing outside the US. Combine this with the growing incidence of corporate data breaches which personal data is lost or stolen, and it would appear that the need for resources and assistance with ID restoration will only continue to grow.

by Doug Pollack

The Identity Theft Resource Center (ITRC) today released its annual survey  looking at the impact of identity theft crimes on the victim. This is the  fifth  of these annual studies  titled “Identity Theft: The Aftermath 2007″ .

The authors encourage readers to note that:

“It is critical that we remember these numbers are people. These are people with lives that have interrupted, altered, torn apart and/or impacted for years to come. They are people with feelings and emotions whose outlook on life and interactions with others may change due to the invasive nature of this crime.”

Some of the key findings of this study include:

- 62% of the people responding said that the thieves had committed financial crimes resulting in warrants issued to the victim, two-and-a-half times more than the prior year

- While a third of identity theft cases are perpetrated by persons known to the victim, in 2007 there was increase in ID theft due to scams

- Victims spend and average of 116 hours repairing damage done by an ID thief to an existing account, and 158 hours when dealing with a new account that was created with their identity

The ITRC is a non-profit organization that is “dedicated exclusively to the understanding and prevention of identity theft”.

by Doug Pollack

We all hear about how more and more identity theft is now being done with the internet. What you don’t hear as much about is how an increasing percentage of US-based identity theft is perpetrated by organized crime overseas.

A recent FBI press release titled “38 Individuals in US and Romania Charged in Two Related Cases of Computer Fraud Involving International Organized Crime” describes a frightening phishing scheme that:

“uses the Internet to target large numbers of unwary individuals, using fraud and deceit to obtain private personal and financial information such as names, addresses, bank account numbers, credit card numbers and Social Security numbers.  Phishing schemes often work by sending out large numbers of counterfeit e-mail messages, which are made to appear as if they originated from legitimate banks, financial institutions or other companies.”

The level of organization of this criminal enterprise and effectiveness of their efforts is remarkable.  According to the indictment:

“The Romania-based members of the enterprise obtained thousands of credit and debit card accounts and related personal information by phishing, with more than 1.3 million spam emails sent in one phishing attack.  Once directed to a bogus site, victims were then prompted at those sites to enter access device and personal information.  The Romanian “suppliers” collected the victims’ information and sent the data to U.S.-based “cashiers” via Internet “chat” messages.  The domestic cashiers used hardware called encoders to record the fraudulently obtained information onto the magnetic strips on the back of credit and debit cards, and similar cards such as hotel keys.  Cashiers then directed “runners” to test the fraudulent cards by checking balances or withdrawing small amounts of money at ATMs.  The cards that were successfully tested, known as “cashable” cards, were used to withdraw money from ATMs or point of sale terminals that the cashiers had determined permitted the highest withdrawal limits.  A portion of the proceeds was then wire transferred to the supplier who had provided the access device information.”

As organized crime becomes increasingly sophisticated in using our affinity for online commerce to their advantage, we should all be extra cautious, especially in watching out for something that has become as commonplace as the phishing scam.

by Doug Pollack

This past week there have been a flurry of articles about the state of litigation pending against LifeLock. An AP article titled “ID protection ads come back to bite the pitchman” is illuminating relative to how this situation has expanded. The “pitchman” noted in this article is Todd Davis, CEO of LifeLock who proudly displays his real social security number in ads that run on TV, newspapers and elsewhere.

Per the article,

“Now, Lifelock customers in Maryland, New Jersey and West Virginia are suing Davis, claiming his service didn’t work as promised and he knew it wouldn’t, because the service had failed even him. Attorney David Paris said he found records of other people applying for or receiving driver’s licenses at least 20 times using Davis’ Social Security number, though some of the applications may have been rejected because data in them didn’t match what the Social Security Administration had on file.”

As one can discern reading this article, Mr. Davis remains totally unrepentant. He defends their advertising, the nature of the $1MM guarantee that is at issue as part of the “deceptive practices” claim in the lawsuits, and the efficacy of their identity theft protection product even in the face of evidence that brings into doubt its effectiveness.

In an interview yesterday with Matt Lauer on the NBC Today Show, he was asked about whether LifeLock does anything for their customers that they can’t do themselves. While acknowledging that consumers can set fraud alerts and “opt out” of credit card offers pretty easily on their own, he defended what LifeLock does do that consumers can do for themselves, noting that it monitors numerous databases on the internet, for instance in chatrooms, where identity theft can occur. What he didn’t mention is that this capability was only added to the LifeLock offering very recently. Since the class action lawsuits were filed.

So it would appear now that the courts will help assess whether LifeLock has engaged in deceptive advertising practices and made misleading claims about its identity theft service.

by Doug Pollack

We know that over 10MM Americans this year will far victim to identity theft. But a recent survey by Bankrate asks people whether they are worried about this problem. The results indicate that people who personally know a victim of identity theft tend to be both more worried about this and also more proactive about protecting themselves.

The poll titled “Americans worry about ID theft; but consumers may be confused about the most effective strategies to protect their privacy” highlights:

“The results show that consumers who personally know a victim of identity fraud tend to be more concerned about the crime overall. Further, their concern pushes them to take more steps toward protecting their personal information, although there does seem to be some ambiguity as to the most efficient privacy protection actions.”

The following chart illustrates people’s answers to the question of how concerned they are about identity theft.

How concerned are you about having your identity stolen? Total Know an identity theft victim Don’t know a victim Very/somewhat concerned 81% 88% 76% Very concerned 40% 46% 36% Somewhat concerned 41% 42% 40% Not very/not at all concerned 19% 12% 24% Not very concerned 12% 7% 15% Not at all concerned 7% 5% 9%

So while most of us are concerned about identity theft, this is a problem area where most of us do very little to actually protect ourselves. If you talk with a friend or family member that has had to recovery their identity from theft, you will learn just how scary and time consuming that this can be. So don’t be complacent.

by Doug Pollack

An article published by the Wall Street Journal titled “Are Your Medical Records at Risk; Amid Spate of Security Lapses, Health-Care Industry Weighs Privacy Against Quality Care” discusses the growing incidents of data breaches and contributing factors within the health care world.

The article highlights the extent of this problem as follows:

“In a spate of recent security lapses at hospitals, health insurers and the federal government, private information on hundreds of thousands of patients, ranging from Social Security numbers to fertility-treatment and cancer records, has been compromised. The incidents have included the theft of an unencrypted laptop from an employee of the National Institutes of Health and the inadvertent posting of personal data unsecured on the Web from insurers WellCare Health Plans Inc. and WellPoint Inc.”

The premace here is that the health care industry is inclined to have greater incidence of data breaches due to the broader access to private patient information by employees and health care workers. This was illustrated in recent weeks by the highly publicized access to medical records of Britney Spears by works at the UCLA medical center.

“Health care isn’t the only industry whose slip-ups can upset consumers or expose them to identity theft. But hospitals are notable for the sheer number and types of employees — including billing staff, nurses, doctors, researchers and lab technicians — who have quick access to individuals’ private information.”

But there seem to be structural requirements for patient record access, dictated by the need to ensure high quality and emergency medical care, that will make it difficult to reduce the risks of data intrusion and breach.

“Many hospitals are reluctant to control access to data too tightly for fear that it will create red tape in emergency situations. “We have to be able to take care of patients, too,” says Wendy Mangin, president of the American Health Information Management Association and director of medical records and privacy officer at Good Samaritan Hospital, in Vincennes, Ind., which audits clinical staff’s access to medical data but doesn’t block it. ”

Unfortunately, it would appear that we will be seeing more rather than fewer data breaches within the health care industry for the foreseeable future.

by Doug Pollack

The Ponemon Institute today released a new study, sponsored by ID Experts, titled “Consumers Report Card on Data Breach Notification“. They describe the rationale and importance of this study as follows:

“It is well established that identity theft has become a very serious issue for Americans. But how well are organizations responding to consumers’ worries when their personal information is lost as the result of a data breach? We decided to conduct this study to find out if consumers who received notification about a data breach involving their personal information were satisfied with the organizations’ response and transparency. In other words, if the consumers had the ability to issue a report card on the current status of data breach notification would it be A for excellent or F for failing?”

The report provides a wealth of useful information to companies in order to effectively plan for a data breach response effort. Given an earlier Ponemon study estimate that around two-thirds of the $197 per person average cost of a data breach is in lost business and reputation, this report can assist companies in evaluating how elements of their data breach response effort can influence their customer retention rates and thereby attempt to reduce this very critical component of the cost equation.

Dr. Larry Ponemon states that:

“Data breach notifications are a failure if individuals do not have a clear understanding of their level of risk, available support, and the steps they need to take to respond to the loss of theft of their personal information. Our research strongly suggests that legal compliance is the primary goal of many companies’ notification efforts. This approach does not serve the best interests of consumers and contributes to a breakdown of trust that can impact a company monetarily as a result of increase in customer defection.”

To download a copy of this study, visit the ID Experts website and click on the New Ponemon Study link.

by Rick Kam
April 3, 2008

This conference is one of the largest IT conferences for public agencies with attendance approaching 20,000 professionals. Leading educators and technology solution providers focused on security, privacy, and “green” IT solutions.

Keynote speakers from Google, Sun Microsystems and others talked about the future of computing and how public agency IT professionals can create a more productive and secure computing environment.

I presented for ID Experts on the topic of how an “Independent Risk Analysis” provides public agencies a more effective solution to mitigate risk when they have a data breach (i.e. when the best security measures fail, what next). Highlights from my presentation included:

1. The requirements that prompted congress to enact public law requiring independent risk analysis
2. When an agency would implement an independent risk analysis
3. What are the benefits of doing an independent risk analysis
4. How to initiate an independent risk analysis
5. How to be better prepared before an agency has a breach

ID Experts was one of two companies awarded a government contract to provide Independent Risk Analysis to public agencies in the U.S. This was a great opportunity for us to explain to public agencies how our solution helps them assess and certify the level of risk for an affected breach population and develop an effective risk mitigation plan.

by Doug Pollack

This past week, there were two class action lawsuits filed against LifeLock, one in its home state of Arizona and one in New Jersey. Following on a recent lawsuit filed against LifeLock by Experian, one of three US credit bureaus, these class action lawsuits also assert that LifeLock is engaged in deceptive advertising relative to the level of protection provided by their service against identity theft. The LifeLock offering depends almost entirely upon the placement of perpetual fraud alerts as the means for protecting their subscribers from identity theft.

As noted by David Paris, an attorney involved in this matter, in an article on the CNBC website titled “N.J. Class Action Lawsuit Filed Against LifeLock Alleging Deceptive Marketing Regarding Limited Level of Protection Against Identity Theft“:

” ‘While fraud alerts may be effective in limited instances, they certainly cannot provide the comprehensive identity protection that LifeLock deceptively advertises,’ said Paris. ‘For instance, fraud alerts cannot stop the use of existing account numbers, and contrary to LifeLock’s advertisements, lenders are certainly not required to contact the subscriber before extending credit to a potential identity thief.’ ”

The article and comments from Mr. Paris also address the alleged deceptive nature a severe limitations on the highly publicized $1MM LifeLock Guarantee:

“According to the Complaint, LifeLock also misleads subscribers by advertising its $1 million service guarantee. ‘Potential LifeLock subscribers are enticed by the ’safety net’ of what appears to be a one-million dollar insurance policy against any losses sustained as a result of identity theft,’ said Paris. ‘In actuality, once you get beyond the limitations and disclaimers, you find that the guarantee is limited to fixing failures in LifeLock’s services and paying third-parties to attempt to restore subscriber losses.’ ”

Hopefully these lawsuits will help bring visibility and clarity to consumers as to the differences in identity theft protection services. Most services, including those provided by the company that sponsors this blog, ID Experts, do not rely on fraud alerts as a primary or sole means of protection, nor do they make questionable or misleading large dollar guarantees. It is unfortunate that brash marketing tactics have made it difficult for consumers to make an informed product decision based on the facts related to differences in these services.