This week President Bush signed into law the Identity Theft Enforcement and Restitution Act of 2008.  As reported in the Washington Post, this law will:

“make it easier for prosecutors to go after cybercrooks, while ensuring that identity theft victims are compensated for their time and trouble when convicted identity thieves are forced to cough up ill-gotten gains.”

It can take the victim of ID crime hundreds of hours to restore themselves to pre-theft condition. This law enables them to be compensated for this time at a level:

“equal to the value of the time reasonably spent by the victim in an attempt to remediate the intended or actual harm incurred by the victim from the offense.”

The FBI has set up a clearinghouse for addressing cybercrime complaints called the Internet Crime Complaint Center. It works closely with a range of law enforcement agencies and private sector organizations.

As someone who works on behalf of victims of id theft, I have seen the cases of medical identity theft increase over the past few years. It’s hard to tell whether this is because medical id theft is becoming more well-known and therefore reported more often by the public, or if this type of fraud is actually growing in number. I think it’s a little of both.

In a recent article from the Chicago Tribune, reporter Judith Graham interviews several id theft experts including Pam Dixon from the World Privacy Forum. Dixon describes most medical id theft perpetrators as “people working in the health-care sector” who have access to people’s social security numbers, insurance information, and health records. According to Dixon, these id thieves sell this type of stolen data for cash or use it themselves to commit fraud upon private health insurance companies and federal programs such as Medicare and Medicaid.

Graham also interviews James Quiggle from the Coalition Against Insurance Fraud in DC, who says that “with almost 50 million people considered uninsured today, medical identity theft may become a growing problem as more people become desperate enough to turn to crime to find treatments that they cannot otherwise get.”

I’ve personally seen victim’s credit reports with collection accounts for ER visits, cancer treatments, and children’s medications. It’s paints a sad story for all involved parties, including the id theft victim, of course.

So, whether it’s done for profit or out of desperation, consumers need to be aware that medical id theft can happen to them and be informed and remain vigilant. People should continually check their credit reports, insurance benefit statements, and health records for discrepencies and fraud.

The World Privacy Forum website has some great information on this topic.

by Doug Pollack

Most of us are unaware of the severe emotional stress that can come about as a result of identity theft. It is gratifying to see the Wall Street Journal exposing this issue so dramatically in today’s article titled “How to Make Identity Theft Worse“.

Ms. Jordan’s article describes poignantly how commonplace it is for illegal aliens to use a citizen’s name and social security number in order to appear legal to their employer. But also how difficult it is and how long that it can take in order to rectify this type of identity theft.

“Audits from the Internal Revenue Service are never welcome. But when Emerita de Jesus received a letter for failing to report earnings at a North Carolina poultry plant, it had a particularly unpleasant twist: The California housewife had never worked at the facility. Instead, a Mexican worker there had used Ms. de Jesus’ name and Social Security number to get hired. The situation caused years of grief for Ms. de Jesus, who fought a protracted battle beginning in 2003 to clear her name with creditors, the IRS and the poultry plant, House of Raeford Farms Inc. The case, which was finally solved a few months ago, isn’t isolated. It is an example of an unexpected consequence of the government’s crackdown on undocumented workers: a surge in identity theft.”

And while this type of identity theft is now on the rise, partially due to more rigorous government requirements that workers provide valid name and social security credentials in order to be employed, the mechanisms to deal with this type of identity theft do not seem to be working. The article goes on to describe what Ms. de Jesus, a legal US resident, went through and how long that it took, to identify and resolve all of the dimensions of this ID theft. Her husband describes how:

“In 2004, however, his wife received another letter from the IRS regarding yet another year’s income that hadn’t been reported. The couple hired a private detective who confirmed a woman continued to work at the House of Raeford under Ms. de Jesus’ name. “We contacted 50 senators, 30 government departments and two governors,” says Ms. de Jesus, who declined to be interviewed but provided a written statement. “The system did not work.”

With 8 million illegal immigrants in the US workforce, this problem is not likely to get better any time soon. We can only hope that the IRS puts in place systems and procedures that enable US citizens and taxpayers to more easily and permanently resolve the effects of this type of identity theft.

By Rebecca Seaman

A modified bill that would allow victims of ID Theft to recoup costs in federal court and which would impose harsher restrictions on cyberattacks passed in the Senate this week. The bill, known as the Identity Theft Enforcement and Restitution Act, still needs to be approved by the House, but is a much needed step in the right direction to further protect consumers. More details are available in the July 31 article from SC Magazine.

Interestingly, the bill would make it a felony to use various types of malware known as keyloggers and spyware to damage more than 10 computers, regardless of the extent of the damage. Previously, attacks resulting in less than $5,000 worth of damage were only classified as misdemeanors.

Patrick Leahy (D-VT), a co-sponsor of the bill said in a statement released Thursday: “The Senate’s action moves us in the right direction to provide critical tools to combat cybercrime and to protect the privacy of all Americans. I hope the leadership in the House will quickly act to pass this legislation and send it to the president for signature.”

The incidence of Identity Theft perpetrated through CyberCrime is a fast growing epidemic, and legislation such as this is great initiative to protect consumers from these crimes. However, it’s important that these bills move quickly through Congress if they are going to keep up with scammer’s increasingly sophisticated attacks. Hopefully, this bill and others like it will move rapidly. Stay tuned. 

I’ll admit I’m a fan of Clark Howard. For those of you that don’t know him, he has a very popular radio show, The Clark Howard Show, and is a advocate for consumers in their financial affairs.

On today’s program, he became very animated talking about Freecreditreport.com. This is a website from one of the three large credit bureaus, Experian, that oddly enough requires that you pay for their service, despite the interesting name.

I thought that it would be useful to highlight some excerpts from his comments. He is obviously not a fan of this offering, and believes that their mass media advertising (who hasn’t seen the television ad with the kid in the seafood restaurant singing about his identity theft?) is deceptive.

The following are quotes from his show today:

“Freecreditreport.com, the ripoff non-service from Experian, is ripping you off, stealing money right out of your wallet…charing you a ripoff fee month after month after month”

“If you are currently subscribing to Freecreditreport.com, stop it! You are throwing your money away…why pay for it, they are liars at Experian. Liars, liars, liars.”

I have always found it amazing that Experian can advertise their service under that name when they require that you purchase their “triple advantage” service for a monthly fee of around $13 a month in order to get a “free” credit report. Maybe I just don’t have a good grasp of the english language. Doesn’t free, mean without cost?

Data breaches are on the rise, despite preventative measures such as state notification laws. Specifically, the Washington Post reports that data breaches reported by businesses, governments and universities are up 69 percent this year. Businesses alone accounted for a 27 percent increase in breaches, or one third of all those reported.

This may not be as alarming a trend as it may appear on the surface. In fact, it may be that businesses are simply more aware of breaches now that they know what to look for and have a better understanding of how breaches occur. Likewise, with the implementation of state notification laws, businesses may feel more compelled to report a breach than they were in the past.

Linda Foley, founder of The Identity Theft Resource Center, a nonprofit organization in San Diego, points out that “Part of this may be that organizations are finding out about more breaches because they’re really starting to look for them,” Foley said. “The other part is that companies are coming forward because they want to control the flow and spin of the disclosure.”

Regardless of how these breaches are occurring, businesses need to remain vigilant in preventing a breach, rather than focusing on damage control once a breach has occurred. Lost or stolen laptops remain the largest reported cause of business related breaches. They account for 20 percent of all reported cases, while hacking was the least cited. In other words, these breaches were largely preventable.  By making breach prevention a matter of policy (For example-evaluating risk and implementing tough cyber-security rules), businesses are less likely to experience a breach, and better prepared to manage one that does occur.

by Heather Wells

In a recent article dated June 20, 2008 from npr.org, writer Dina Temple-Raston reports on the arrest of hundreds of people believed to be guilty of scamming the public out of millions of dollars of hard earned home equity.

She writes, “instead of stealing an identity to secure a credit card, scammers have been zeroing in on people they think have a lot of equity in their homes. They steal their identities, then go online and get a home equity line of credit on that person’s house and take the money.”

It’s a terrifying scenario for consumers who have worked hard for years to establish good equity and credit. As someone who works directly with victims of id theft, I know how frustrating it is for victims when the person who stole their identity is never caught or prosecuted. I am hoping that the news of these crooks getting arrested will bring about a feeling of justice for victims; that something is being done and people are being punished.

Temple-Rason concludes her piece with this warning, “the FBI is sending a specific message: If you are involved with mortgage fraud — whether on Wall Street with high-level investors, or on Main Street with ordinary homeowners — the bureau intends to catch and prosecute you.”

Score one for the little guy. For more, check out this video:

So much of what is written about identity theft today centers around the way in which it is perpetrated, the nature of the fraud and how this is evolving, and the failure of companies to keep personal information of their employees, clients and customers secure. What doesn’t tend to be as newsworthy or prominent is how identity theft impacts the lives of people.

A recent article titled “Dealing with ID theft can be expensive, emotionally draining and time-consuming” addresses this subject. It references an FTC study that highlights that more than 27 million people became victims of identity theft in the past five years, and that 41 percent of them were still dealing with the problem two years after it occurred. If further concludes that the recovery process could take about 500 hours and cost about $3,000.

Heather Wells who heads the identity theft restoration team for ID Experts is quoted in this article as saying:

“The emotions they go through is pretty similar to what victims of other crimes experience.  First there is shock and disbelief. Sometimes shame is involved. They lose trust in other people. Sometimes problems with their spouses come up because it’s so stressful. Many cases involve family members or close friends who have done this. That’s probably the worst thing.”

While there is a lot that people can do to reduce their chances of falling victim to identity theft, the bad guys are continuing to grow in sophistication and an increasing percentage of ID theft is now perpetrated by organized crime groups residing outside the US. Combine this with the growing incidence of corporate data breaches which personal data is lost or stolen, and it would appear that the need for resources and assistance with ID restoration will only continue to grow.

The Identity Theft Resource Center (ITRC) today released its annual survey  looking at the impact of identity theft crimes on the victim. This is the  fifth  of these annual studies  titled “Identity Theft: The Aftermath 2007″ .

The authors encourage readers to note that:

“It is critical that we remember these numbers are people. These are people with lives that have interrupted, altered, torn apart and/or impacted for years to come. They are people with feelings and emotions whose outlook on life and interactions with others may change due to the invasive nature of this crime.”

Some of the key findings of this study include:

- 62% of the people responding said that the thieves had committed financial crimes resulting in warrants issued to the victim, two-and-a-half times more than the prior year

- While a third of identity theft cases are perpetrated by persons known to the victim, in 2007 there was increase in ID theft due to scams

- Victims spend and average of 116 hours repairing damage done by an ID thief to an existing account, and 158 hours when dealing with a new account that was created with their identity

The ITRC is a non-profit organization that is “dedicated exclusively to the understanding and prevention of identity theft”.

We all hear about how more and more identity theft is now being done with the internet. What you don’t hear as much about is how an increasing percentage of US-based identity theft is perpetrated by organized crime overseas.

A recent FBI press release titled “38 Individuals in US and Romania Charged in Two Related Cases of Computer Fraud Involving International Organized Crime” describes a frightening phishing scheme that:

“uses the Internet to target large numbers of unwary individuals, using fraud and deceit to obtain private personal and financial information such as names, addresses, bank account numbers, credit card numbers and Social Security numbers.  Phishing schemes often work by sending out large numbers of counterfeit e-mail messages, which are made to appear as if they originated from legitimate banks, financial institutions or other companies.”

The level of organization of this criminal enterprise and effectiveness of their efforts is remarkable.  According to the indictment:

“The Romania-based members of the enterprise obtained thousands of credit and debit card accounts and related personal information by phishing, with more than 1.3 million spam emails sent in one phishing attack.  Once directed to a bogus site, victims were then prompted at those sites to enter access device and personal information.  The Romanian “suppliers” collected the victims’ information and sent the data to U.S.-based “cashiers” via Internet “chat” messages.  The domestic cashiers used hardware called encoders to record the fraudulently obtained information onto the magnetic strips on the back of credit and debit cards, and similar cards such as hotel keys.  Cashiers then directed “runners” to test the fraudulent cards by checking balances or withdrawing small amounts of money at ATMs.  The cards that were successfully tested, known as “cashable” cards, were used to withdraw money from ATMs or point of sale terminals that the cashiers had determined permitted the highest withdrawal limits.  A portion of the proceeds was then wire transferred to the supplier who had provided the access device information.”

As organized crime becomes increasingly sophisticated in using our affinity for online commerce to their advantage, we should all be extra cautious, especially in watching out for something that has become as commonplace as the phishing scam.