Identity Theft: World s Fastest Growing Crime!! Detective Jackelyn Weibel, CFE. Allegheny County District Attorney Investigations Unit

Transcription

1 Identity Theft: World s Fastest Growing Crime!! Detective Jackelyn Weibel, CFE Allegheny County District Attorney Investigations Unit

2 Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully obtains and uses another person s personal data in some way that involves fraud or deception, typically for economic gain. -U.S. Department of Justice

3 In 2017, the number of identity theft victims in the U.S. rose to 16.7 million! Cost of lost data amounts to over $17 billion. Children most targeted over 1 million children were victims in million Americans faced increased risk due to Equifax hack. Account takeovers increased 61% over 2015 totaling $1.4 million incidents. 13% of people who reported to law enforcement did NOT want a report taken. 61% of victims between 30 and 59 years old. 1 in 5 people think stealing online information is not as bad as stealing property in real life. -Javelin Strategy

4 Most at risk? Children 35% higher risk than adults. Smart phone owners 33% higher risk than general public. Persons with personal information on a social media site. Deceased people account for 25% of all identity theft. College students because they have good credit. Victims of data breaches have much higher risk.

5 Discovery Is KEY!! 50% of victims discover their identity has been stolen within three months. 15% of victims do not discover their identity has been stolen for 4 or more years. Over 50 million Americans are utilizing a credit monitoring service. 44% of consumers view their credit reports using AnnualCreditReport.com or CreditKarma.com

6 Most Common Theft Methods: Skim information from transactions inside a store. Paper mail theft. Data breach. Hacking computer networks and databases. Redundant IT equipment (external memory sources). Shoulder surfing Dumpster diving

7 Top States for ID Theft Florida Georgia California Arizona Texas 26% of victims had to borrow money from family or friends 22% lost time at work 15% sold possessions to pay for expenses caused by ID theft 7% obtained a payday loan to make ends meet. -Experian

8 Synthetic Identity Theft Emerging as a major fraud activity in the past 5 to 7 years. Fraud that involves the use of a fictitious identity. Thieves create new identity using combination of real and fabricated information, or sometimes entirely fictitious information. Typically fraudsters obtain a real Social Security number and pair it with a name not associated with that number. They usually seek SSN that aren t being used regularly, such as children or the deceased. Children s SSNs are 51x more likely to be used in this type of fraud. Often the fraud will remain unnoticed for years. Fraudsters build a credit profile for SSN by applying for credit (which is declined). Once file has been established, new credit is granted for that person.

9 Piggybacking Fraudsters exploit the authorized user process by actively recruit cardholders with good credit to add unknown persons/identities (synthetic identity) to their credit cards, often just for a few days. A credit card may or may not be issued to authorized user. The point is that the new person sits on the account for a period of time and inherits the cardholders credit history. Once tradelines are reported to credit bureau, the synthetic identity can be removed by credit history is retained. Legitimate cardholders will receive a fee for this service. This often leads to bust out schemes where unsecured credit is issued to synthetic identity; these credit cards/lines are maxed out, paid with a counterfeit check

10 Card Cracking Schemes Account fraud where a fraudster convinces an account holder to act as an unknowing accomplice in stealing money from your financial institution or a post on social media announcing a contest to win money or a gift card. Offers of quick cash You give fraudster your checking account info including debit card number, PIN and online banking info. Checks deposited into your account remotely. Checks are counterfeit but funds are available now. Fraudsters immediately withdraw money via ATM. Or they ask you to wire them the money. Once checks are returned, your account goes into the negative. You get a kickback or quick cash you were promised. You report your debit card as stolen or compromised.

11 Medical Identity Theft

12 70 million medical records stolen in Anthem breach. 2.3 million people in America were victims of medical identity theft in 2014 up 22% from the previous year. 20% of victims reported receiving incorrect diagnosis because of incorrect information on their medical history. 65% of victim paid an average of $13,500 to pay bills associated with medical ID theft. 47% of victims were exploited by family. Consequences include: Incorrect treatment for victims; False health insurance claims filed; Denial of legitimate medical claims; Arrest for illegal activity by fraudster.

13 What to look for An Explanation of Benefits (EOB) form from your insurance for treatment you never received. Bills/collection calls from doctors or hospitals where you never had service. Notices from your health insurer that you are close to you exceeding your spending cap. What to do HIPPA requires medical service providers to inform you of their privacy practices INCLUDING how to access your medical record. You will have to fill out a form and may have to pay a fee. Does your insurance have online access to your medical records? Get a copy of your MIB (Medical Information Bureau) record. This bureau is used by insurance agencies to share information. You have the right to get one free copy per year.

14 Child Identity Theft

15 Minor s identifying information used by another person for imposter s benefit. 1.3 million children have their identity stolen annually; 50% of those are under the age of 6. Children 19 and younger represent 8% of total victims. Often the perpetrator is known to the child (family member, daycare provider). Targets children because of the length of time it takes to discover the theft. Foster children most at risk.

16 Senior Identity Theft In 2014, reports of identity theft targeting people 50 and older represented about 36% or 2.6 million instances. More susceptible to acts of deception and manipulation. Worked diligently their whole life to achieve good credit. Seniors rarely check their credit reports.

17 49% of individuals 50 years and older are victims. Often scammers are known to the senior (in home aids, doctor s offices). Perpetrators often send mailings to seniors causing them to provide their information voluntarily. More susceptible to acts of deception and manipulation. Florida is state with highest reported senior ID theft cases. Seniors rarely check their credit reports.

18 Seniors Targets of: Medical identity theft Estate identity theft (theft after death) Tax fraud Phone scams Military identify theft (to claim military benefits) Wire transfer fraud Familiar fraud (perpetrators are relatives or friends)

19 Government Identity Theft Also known as Documents/Benefits Theft Stealing personal information to obtain government assistance such as: Social Security retirement benefits; Social Security disability benefits; Medical insurance; Welfare benefits. In 2014, the IRS reported paying out $5.2 BILLION in fraudulent federal tax returns. IRS claims to have stopped an additional $24 BILLION from being refunded to fraudsters. SSA and IRS do not make initial contact using .

20 IRS Tax Fraud Number of affidavits filed with IRS for the first 9 months of 2016 which claimed ID theft dropped 50% to 237,750 from 512,278 in Through September of 2016, 787,000 fraudulent returns requesting over $4 billion were stopped. Dollar amount of fraudulent refunds for 2016 tax year approximated $239 million down from $829 million in IRS now holds Security Summit each year to better combat fraud.

21 Financial Identity Theft Individuals or businesses can be affected. Personal information everywhere! Billion dollar business. Most common type of identity theft!

22 WHO?? Retail Merchants and Their Employees Restaurant Employees Bank Employees Drug Addicts Terrorist Groups Organized Crime Members Illegal Immigrants Your Family Members Your Employees Neighbors

23 WHERE?? Your mailbox Your trash Retailers Restaurants Grocery stores Hospital or health care facilities Discarded/stolen computers Internet Your motor vehicle ATM machines On the telephone Software sharing programs

24 HOW?? Phishing Theft of your trash ( Dumpster Diving ) Purse or wallet theft Dishonest employees Public Records Shoulder surfing Pharming Skimming devises Counterfeit documents EBay & Craigslist scams

25 Identity Theft Schemes Database Hacking Social Engineering Skimming Spam - Spyware Dishonest Employee Fraudulent new accounts Counterfeit Cards/Checks

26 CARD SKIMMING Suspect uses a wedge to store information. contained on credit card strip. Downloads info later to computer. Uses info to create counterfeit cards with your personal information.

27 Suspect uses a wedge to store information. contained on credit card strip. Downloads info later to computer. Uses info to create counterfeit cards with your personal information.

28 Why is skimming so popular? Equipment available over Internet Equipment user friendly Equipment mobile If discovered, its difficult to determine the owner Skimmed information can be sent via anywhere in the world shortly after it is stolen. Victims have no idea their information has been compromised until they receive their financial statements.

29 Restaurants Hotels Gas Stations ATM Machines WHY? Most Common Places High customer volume Credit card often used for payment High employee turnover Convert placement possible

30

31 ATM SKIMMING INSTALLING SKIMMER AT THE DRIVE UP ATM

32 CREDIT CARDS Magnetic strip on back made up of tracks similar to an audio tape Information read by swiping card through a reader device Information includes: Your name Account number Issuing bank

33 Standard ATM machine?

34 False front is attached to ATM with card reader to copy magnetic strip info on your card

35 Look at the pamphlet holder

36 Note the hole in the side

37 Camera/transmitter housed inside

38 Camera can view keypad and monitor and send wireless picture up to 200 meters.

39 Digital Robbery Thermal Imaging Allows ATM Theft From a Distance ATM pins can be stolen using a thermal imaging camera. When ATM users press keys to enter their PIN, they leave behind a residual heat from their fingers.

40 TOOLS OF THE TRADE

41 PHISHING The theft of personal information using s that look legitimate million phishing s are sent EVERY DAY with losses total more than $1 billion dollars a year. will reference a link which will take the victim to an authentic looking web site for a major company. When victim provides personal information, it is used by the thief to commit identity theft.

42 UNKNOWN S/SPAM Could launch bad Spyware. Could cause victim to respond to fraud scheme (i.e. Phishing ). Could cause victim to give up personal info when making a purchase. Best practice is to delete unknown or suspicious looking s.

43 Example of an Unknown Opening this file will launch illicit program

44 Phishing Scenario involving ebay Victim receives an allegedly from ebay and clicks on the link

45 Victim inputs their login information which is captured by the thief

46 Thief captures additional information on the next screen and then redirects victim to legitimate site

47 EBay is shutting down 30 phishing sites per day! Fake ebay site Real ebay site

48 PHARMING Computer hacker using a malicious code acquires domain or host name information for a legitimate website and then redirects traffic to another identical looking (bogus) website. Usually banking or retail websites. Most often used to steal passwords, PIN numbers or bank information. US Airways, QVC, PNC Bank, American Express

49 Vishing Social Engineering Using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he or she will profit. Often uses VoIP Voice Over IP or Caller ID spoofing

50 SMS SMiShing SMiSHing scams frequently seek to direct the text message recipient to visit a website or call a phone number, at which point the person being scammed is enticed to provide sensitive information such as credit card details or passwords.

51 Example SmS SMiShing TEXTS Congratulations, your entry in our store drawing has won you a $100 gift card. Please click the link to accept your prize. This is an alert notice concerning a large withdrawal from your account. Please respond with your account number to confirm you made the withdrawal. As a valued customer, we are now offering access to our new app. Please click on the link to install. You have been selected for jury duty. If you cannot make it, please call xxxx and have your name and social security number ready.

52 Consumers Rights for Unauthorized Debit and Credit Card Use

53 Fair Credit Reporting Act (FCRA) governs consumers right for fraudulent use of credit cards. Electronic Funds Transfer Act (EFTA) governs consumers right for fraudulent use of debit cards. Consumer protection is stronger for credit cards: Charge-back rights; Credit dispute rights; Credit line available now.

54 Debit and Credit Cards Not Equal Debit Cards: If you report within 2 days of discovery, loss is limited to $50; If you report between 3-60 days, loss limited to $500; After 60 days, no protection for fraudulent use of card! Credit Cards: Regardless of report date, loss is limited to $50. If credit card company has a zero liability policy, you still must report losses within 60 days of the fraudulent charges.

55 Corporate Responsibility Businesses maintain personal identifying information for clients and employees. Many cases of employees stealing this information to sell for profit or for this personal gain. Secure information kept in paper or electronic format. Hackers often gain access to databases. Businesses have a responsibility to notify law enforcement and FTC if they are aware that any personal identifying information could have been compromised.

56 Safeguarding Information Keep only what personal information is necessary. Properly dispose of sensitive material by shredding it. Utilize anti-virus software and firewalls. Limit access of sensitive information. Conduct background checks on all potential employees. Regularly educate and train employees on security issues. Require strong passwords that are not to be shared. Have a plan to respond to security incidents.

57 Social-Media and Identity Theft Fraudsters are taking note of personal information such as your birth date on socialmedia sites. Use the highest privacy setting available. Do not accept friend invites from strangers. ANTIVIRUS SOFTWARE!

58 Preventing Identity Theft Promptly remove mail from mailbox and deposit outgoing mail in secure receptacles. Empty your purse/wallet of extra credit or ID cards including your social security card. Make a copy of all items in your wallet and keep in secure location. Examine all credit card and bank statements each month. Do not use birthdates, phone numbers or house numbers as PIN. Never write down your PIN.

59 Report stolen credit cards or any transactions that you did not make immediately. Never respond to unknown or phishing s. Shred all solicitations, bills and document with any financial information using a cross cut shredder when discarding.

60 Make inquiries on unexpected bills. If providing financial information over the Internet, ensure the information is encrypted and the site is secure ( Never give out information over the phone. Always shield your hand and the screen when using the ATM machine, even if no one is around. Consider placing a fraud alert on your account with all three major credit bureaus. Never leave transaction receipts behind. Order and review your credit report once a year at or

61 Important Contacts Equifax Experian Transunion FTC FTC-HELP IFCC For victims of fraud on the Internet

62 Remember... Get good anti-virus software on your computer and smart phone. Secure your Social Security card and other unneeded credit cards. Monitor your credit report at least once a year.

63 Questions???

64 Detective Jackelyn Weibel Allegheny County District Attorney s Office 1444 Hillsdale Avenue Pittsburgh, PA (412) jweibel@da.allegheny.pa.us