Subscribe
Printer Friendly
Share this PagePrivacy
Every one loves a "Top 10" this time of year, so here is a great one from our friends at Kroll Fraud Solutions. It was put together by Brian Lapidus - Kroll Fraud Solution chief operating officer and identity theft expert.
Enjoy!
1. Beware the Word "Prevent"
No person and no product can prevent identity theft. As long as criminals can benefit from stealing, there will be theft. Sensitive personal information (SPI) is everywhere, housed and archived in a mind-boggling variety of ways. Individuals and companies can reduce access to SPI and improve safeguards around it by working to change how we share, collect, store and dispose of information.
2. There Are No Guarantees
This mantra holds true for a lot of things in life and dealing with identity theft is no exception. While a number of instances of fraud can be restored to pre-theft status, some identity dilemmas simply can’t be fixed. If you’re on the ‘no fly list’ thanks to an imposter or an error, you’ll stay there. A third-party solution cannot deliver a remedy.
3. Watch for "Shoulder Surfers" and "Skimmers"
Shield the entry of personal identification numbers (PINs), and be aware of people standing entirely too close by when using your credit or debit card in public. Especially with the advent of cell phone cameras, a sneaky, shoulder surfing thief can get your private information pretty easily, if you’re not careful. It’s also advisable to use teller machines that are familiar to you, so you are in a better position to identify when the equipment looks different or doesn’t “feel right.” Your increased awareness may reveal a skimmer’s attempt to steal PINs and banking details at that site.
4. Keep Your Social Security Card Safe at Home
Unless you’re on your way to fill out a job application, there are very few reasons to carry around the crown jewel of SPI. At lunch a few weeks ago, the woman beside me opened her wallet for a credit card and there was her Social Security card, too. Remember, ID theft and fraud are not exclusively credit-related – thieves can use a clean Social Security number to construct a whole new life.
Additional note from Dave: I regularly receive emails from Fight Identity Theft visitors explaining how they just had their purse or wallet stolen with their Social Security card inside. Remove that card today!
5. Destroy Before You Dump That Old Computer
Erasing data just enables the computer to write over that space again; it doesn’t actually eliminate the original bits and bytes. Physically remove the hard-drive to ensure you’re not tossing out or passing along your personal details. Our company is often called upon to recover data from an erased or damaged drive; we’re very good at it – and so are some professional thieves.
Additional note from Dave: You could also consider using a software tool like Eraser to do a complete wipe of your drive. If you physically remove your drive, smash the drive with a hammer (find someone strong) before throwing it in the trash.
6. Choose "Forget Me’ Instead of "Remember Me"
How many Web sites do you frequent that invite you to enable an automatic log on the next time you visit? Don’t check that box! When convenience trumps confidentiality, you’re asking for trouble. The harder you make it for hackers to follow your trail into an online store or bank account, the better.
Additional note from Dave: This is absolutely necessary when using public computers. In fact, you should avoid accessing any secure sites from a public computer (like a library, internet cafe) or when using a public wireless network or wifi hotspot.
7. Don’t Rely On Fraud Alerts Or Credit Freezes Alone
Fraud alerts are meant to stop an identity thief from opening new accounts in your name. Credit freezes let you restrict access to your credit report, which would also make it hard for someone else to open new accounts. But, neither one will stop a thief from trading your SPI for cash, or using it for tax fraud or in any of the countless other ways fraudsters exploit stolen identities.
8. Practice Prudent Posting
Social networking sites on the internet enable individuals around the world to chat, share photos, recruit employees, date, post resumes, auction property, and more. Because the Web makes it possible for any posted document to link with another, any data you put out online have the potential to stay there for what amounts to electronic eternity.
Additional note from Dave: I suggest creating usernames or an email address that don't contain your name or anything traceable to you, whenever possible. You also might consider using different usernames on different sites. This makes sense because if someone is able to determine that you use "CatLuvr55" on one site, it's an easy search to track down "CatLuvr55" on any other sites where you have a profile.
9. Keep That Key
When you check out of a hotel where you were issued a card-key to unlock the door to your room, don’t leave the card-key behind. Hold on to it until you’re safely home and can shred or otherwise discard it safely. Some say it’s an urban myth that the card-keys hold vital details like credit card numbers, while others report having tested and confirmed the presence of private data coded into the magnetic strip. Even if there’s no definitive answer, why risk it?
Additional note from Dave: Not sure I'm convinced on this one. I'd need to see more data showing that it is a problem. Snopes.com debunks this pretty thoroughly.
10. What’s In Your Wallet?
Make photocopies of the personal material in your wallet: Driver’s license, credit cards, insurance cards, all of it – front and back. Should your wallet be lost or stolen, you won’t be left wondering what was actually taken, and you’ll be able to quickly notify the appropriate agencies about what has taken place.
The BBC is reporting that 25 million Britains were exposed to the threat of identity theft when the HM Revenue & Customs (similar to the IRS in the U.S.) lost a CD containing personal data.
Ouch!
This has to be one of the worst data breaches ever, since the CD was not encrypted (just password protected) and the data included:
- Name
- Address
- Date of birth
- Bank account details
- National insurance number
In case you're not familiar with that last item, it's similar to the Social Security Number here in the U.S. What else could a potential thief want?
The CD with the data was sent to another HMRC location by a lower level employee via regular mail instead of using an encrypted network connection or some other secure method. The CD never showed up at the other office and officials are now trying to determine if it was stolen or just lost.
"The data lost - bank account numbers, names and addresses - represents a gold mine for the thieves and is much more valuable to them than credit card numbers or taxpayer id numbers," said Gartner analyst Avivah Litan.
"In fact, in the black market, bank account numbers sell for the highest price, or between $30 and $400 (£15 to £200), which is significantly more than the fifty cents to five dollars that criminals pay for credit cards."
This disaster has already forced the resignation of HMRC's chairman - Paul Gray. I'm guessing the employee involved was also "sacked," as the Brits like to put it. Let's hope so.
More coverage on the BBC site - Q&A: Child Benefit Records Lost | Analysis: How Worried Should You Be?
Have you seen ads like this on the internet and wondered if they're for real?
Well, they're for real, but I don't advise signing up for this kind of deal. Here's why...
When you see any "free" offer, you should be very careful. Very few things are really free. You should ask yourself these kinds of questions:
Question:
An ipod costs $69 to $399 dollars. How are they paying for it if they're giving it to me for free?
Answer: You have to give them something of value.
Question:
What do I have that's valuable to them?
Answer: A lot.
- Your personal information - you have to give them your name, email, home address, gender, date of birth, and phone number. They use this information to send offers to your email account, to your home via direct mail, and to your phone with telemarketers.
- Your credit card - you also are required to sign up for one of the offers they present to you. All of these offers will involve giving them your credit card number. The offers are things like a Blockbuster online rental membership, DVD and music clubs, credit card offers, ringtones & horoscopes. They are paid a bounty from these companies when you sign up. Companies will pay anywhere from $10 - $70 per sign up.
- Your friends and family - in order to qualify for the free item you have to get 5 friends or family members to sign up AND request one of their offers.
See how the money is now adding up? The company will receive possibly $40 per sign up which equals $240 (6 users x $40).
Were you worried they weren't going to make any money on this deal? Don't worry, they will still make more.
In fact, Eliot Spitzer, the fireball New York Attorney General has recently filed suit against Gratis Internet, the parent company of sites Freeipods.com, FreeCDs.com, FreeDVDs.com, and FreeVideoGames.com (just an aside - "gratis" means "free" in Spanish).
The suit alleges that Gratis:
"... sold personal information obtained from millions of consumers under a strict promise of confidentiality.
From 2000 through 2004 Gratis made numerous explicit promises to the users of its web sites about protecting personal information. Among the promises the company made were:
'We will never give out, sell or lend your name or information to anyone';
'We will never lend, sell or give out for any reason your email address or personal information';
'We at [Gratis web site] respect your privacy and do not sell, rent or loan any personally identifiable information regarding our customers to any third party'; and
'Please note that we do not provide your E-mail address to our business partners.'
Even on its sign-up pages, Gratis promised consumers that it 'does not . . . sell/rent emails.'
However, the Attorney General’s investigation confirmed that Gratis’s owners, Peter Martin and Robert Jewell, repeatedly violated these promises during 2004 and 2005 by selling access to lists of millions of Gratis’s customers to three independent email marketers. The marketers then sent hundreds of millions of email solicitations to those users, on behalf of their own customers. In each of these deals, Gratis wrongfully shared between one and seven million confidential user records.
This is believed to be the largest deliberate breach of a privacy policy ever discovered by U.S. law enforcement.
Need another reason to avoid offers like these?
Here's a good one - if you jump through all their hoops and qualify for your free ipod, you'll have to send them an IRS W-9 form, since the iPod's value will have to be counted as revenue.
What information is provided on a W9? Oh, only your name, address, and Social Security Number. Is that the kind of information you want in the hands of these people? I don't think so.
Save your pennies and buy your own stinking iPod. That's what I recommend.
Fidelity Investments lost a laptop that had sensitive employee information for 196,000 current and former HP employees. The employes were told this week that they are at risk for identity theft and that they should take steps to protect themselves.
Here's part of the email that went out to HP employees:
"This is to let you know that Fidelity Investments, record-keeper for the HP retirement plans, recently had a laptop computer stolen that contained personal information about you, including your name, address, social security number and compensation."A web site has been set up that "includes some immediate steps that you can take to protect yourself, as well as information about how to enroll for a 12-month period of credit monitoring at no cost to you and a Fidelity call center number in case you have additional questions."
This is just the latest in string of laptop losses that have affected employees at Sun, Cisco and IBM. It's unclear if the laptops are being targeted because of the information they contain, or if it's just random theft. My guess would be random theft.
When I worked in the corporate world, laptops disappeared on a regular basis. Thieves are able to dress like the typical corporate type (tan slacks, blue dress shirt, just the right amount of hair mousse) and sneak into one of our offices. From there they'd look for an unattended laptop, pick it up, and carry it out the door as if they were rushing off to attend the next staff meeting.
Anyway...
Fidelity has good news for those affected. It appears the data was encrypted and the encryption key has expired on the machine - making the data more difficult to extract.
Here's Fidelity's take on the situation:
"At this time, we are unaware of any misuse of the information contained in the software on the laptop," said Fidelity spokeswoman Anne Crowley. "The application was running on a temporary license from a third-party software vendor. The license has expired. Since the expiration of the license, the scrambled data would be difficult to interpret and generally unusable.
We have taken steps to implement extra security processes requiring additional authentication for access to those HP accounts as well as other measures to prevent unauthorized use. We have also employed additional security controls above and beyond our already significant monitoring activity to identify if there is any unusual activity in these accounts. Further, we have reviewed activity in the HP accounts and have found no indication of unusual or suspicious activity."
The bottom line is that no matter how careful you are, someone else's blunder can expose you to identity theft. The only way to avoid it is to withdraw from modern society. I'd personally rather have the 401k money.
To shred or to tear: that is the question. Robert Cockerham of cockeyed.com decided to put the matter to a test. His test subject? A newly received Chase Mastercard pre-approved application.
Step 1: Robert tears the application into small pieces.
Step: 2: Robert meticulously lines the torn pieces up and tapes them together, like so.
Step 3: Robert fills out the application, replacing the current billing address with a new one (his parent's house) and using his cell phone as the phone number on the new account.
With that, he mails it in.
Step 4: Robert excitedly receives his new credit card at his parent's house and activates it using his cell phone.
Analysis:
- Tearing up your sensitive documents is not sufficient.
- Some creditors will process applications, even if they've been torn up, taped together and have a new address.
- A criminal could easily apply for credit in your name, change the address, and activate the account via a pre-paid cell phone. You wouldn't even know what happened until creditors started calling you about your unpaid bills.
- You must destroy all sensitive documents using a cross-cut shredder
before placing them in the trash.
- Better yet, opt-out of pre-approved offers and give your shredder and the recyclers a rest.
Read the whole story on Cockeyed.com.
Remember that scene in National Treasure where Nicolas Cage pulls a thumb print off Diane Kruger's champagne glass and uses it to get into the super-secret room housing the Declaration of Independence? If not, rent it tonight and take a look.
So, is that really possible or is it just one of those movie-inspired myths? Unfortunately for security vendors, it's pretty close to the truth.
A study at Clarkson University revealed that fingerprint scanners were fooled 90% of the time by fake fingerprints created from gelatin, dental plaster, or even Play-Doh! Another option is for a thief to just cut one of your fingers off and use it on the scanner.
So should you care about this high-tech biometrics stuff? What does this have to do with your life? Well, the Albertsons grocery store chain has recently implemented a biometric finger scan for payment and identification in some stores and both Wal-Mart and Costco are supposedly discussing doing the same thing.
Before there's wide-spread adoption, hopefully these security questions will be resolved. One company trying to do that is Luminetx. They recently patented their vein scanner (designed initially for medical purposes) for use in biometric scans. Evidently your vein layout is extremely unique and can't be faked or bypassed (so far).
Whether it's your finger, eyeball, or arm, get ready for high-tech features at your local grocery or big box store. They're coming.
I've seen a number of stories, most recently in yesterday's Times Online, that describe surprise and fear over what Google knows about its users.
This is silly, in my opinion.
Sergey Brin and Larry Page - Founders of Google
The Times Online headline is "Big Google is Watching You" and the article states:
"Google has an extraordinary amount of information about its users. It logs all the searches made on it and stores this information indefinitely. Because every computer has a unique IP (internet protocol) address, every visit to every website can be traced back to the computer making it — a fact which is well known in geek circles but remarkably under-publicised outside them."
and
"Users of Google’s Gmail service, who are already having their e-mails scanned to place targeted ads, have given the company their identity, a full record of all their searches and copies of all their e-mails, stored indefinitely. Users of Google’s Toolbar are inadvertently giving the company a list of not just all their searches but also of every single website they visit. And, as the lawsuit makes clear, all this information is potentially vulnerable to subpoena."
Maybe I'm one of those geeks that realizes that this happens on virtually EVERY web site you visit.
What's a Log File and What Does it Look Like?
When you visit a web site, most will keep a log of what information is requested along with the IP address of who requested it. What does the log file look like? Here's a real sample from the Fight Identity Theft site:
192.168.1.100 - - [29/Sep/2005:09:56:28 -0400] "GET /how-to-report-scams.html HTTP/1.1" 200 22806 " http://search.yahoo.com/search?p=how+to+report+a+scam" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
So here's what this glob of code shows...
- First is the person's IP address (I changed it to protect the visitor's privacy)
- The date and time of the request
- What was requested (in this case, our "How to Report Scams" page)
- The referring web site (in this case, the person did a Yahoo search for "how to report a scam")
- The type of browser being used (Microsoft Internet Explorer 6)
- And the operating system (Windows NT 5.0 = Windows 2000)
This is how web sites work. They collect data and log the data for later analysis (e.g. "How many people visit my homepage?" "What did a person search for to find my web site?", etc.)
What Information Are You Sharing and Can You Hide It?
So what information are you sharing as you browse the web? ShowIpAddress.com is one of many sites that will show you what a log file can capture about you. The only personally identifiable piece of information is your IP address. That number is assigned to you by your Internet Service Provider (ISP). One way or another that number can be traced back to you as an individual, even if you are surfing during work at a Fortune 500 company or other large organization.
Does that make you scared, angry, or just plain nervous? Maybe it should, maybe it shouldn't. In either case, you can browse anonymously if you choose.
There are many products and services that allow you to web surf anonymously. Most will route your requests through their servers, thus hiding your IP address. Anonymizer.com has been around for a long time and they provide a service where you can use their site to browse anonymously for free.
But, back to Google...
Are they evil because they log this information? Powerful, yes, because so many people use their services, but I wouldn't say evil.
When I choose to sign up for a service like Gmail, I know that they will be reading my email content so they can serve up related ads. That's how they make money. That's how I can have a 2.5 gigs of free storage for my messages. Yahoo has a similar policy. Same with MSN Hotmail.
When I choose to use Google search I have to know that they log what I'm searching for and analyze it to spot user patterns. The same thing happens at Yahoo and MSN.
I have to realize that sites, like Google, store this information and will use it to improve their product and to make money. I also have to realize that it could be handed over to the government.
This is all part of the trade-off we make every day between security/privacy and convenience. If you are extremely concerned with privacy you probably shouldn't be using the internet and you certainly shouldn't sign up for a service that clearly states it will read and store your email messages. If you're concerned that your search history or email messages could be revealed at a later date you should consider using a product that protects your anonymity, like Anonymizer.
Here's the bottom line...
When information is aggregated, abuses, information leaks, subpoenas, and profiteering can occur. When it does occur it should be exposed and fought. I just don't see where Google has done anything evil or different than any other web site on the internet.
Feel differently? Then please append a comment to this story.
Peer-to-Peer (P2P) file sharing networks exist so people can download free mp3 files, DVDs, movies, etc. They work by having each member of the network share some personal files while downloading files from other people's computers. Share and share alike, right?
This has understandably driven the RIAA (Recording Industry Association of America) as well as the people in Hollywood crazy. So crazy that they are suing people they catch sharing copyrighted materials. We're not going to go into the ethics either way on this argument. Maybe some other time...
The problem is that people are not only sharing their ripped CDs and DVDs, they're also sharing (accidently, I'm guessing) sensitive files on their hard drive like tax returns, bank statements and cancelled checks.
A blogger recently decided to do a few searches on Gnutella, a major P2P network, for sensitive documents. It took him only 10 minutes to find a handful.
Take a look at what he dug up... (maybe it's your tax return)
What is the lesson you should learn?
- Avoid P2P networks PERIOD! The software that enables the network is often full of spyware and the files you download can be infected with viruses and other malware. Not good.
- Keep control of other users on your computer, especially if they are teenagers. If they install file-sharing software on your computer it may be your tax return (along with your SSN, DOB, address, etc.) showing up all over the internet.
- If you do decide to use file sharing software, make sure you've clearly designated a single folder to share and make sure you don't accidently drop your scanned bank statements in the folder.
Digital Privacy: A Curmudgeon's Guide
Do you feel it's a losing battle trying to keep your information private? If you do, you're smart. It's impossible to live in our modern society without people knowing more about you than you'd like.
* Your doctor wants you to hand over your families' health history and you social security number.
* The supermarket wants to track how often you buy frozen pizza.
* The government now wants your garbageman to report any suspicious behavior going on in your basement.
What's the solution? Get grumpy. When people ask for information, say no. If they insist, ask for their manager. Ask why they need the information. Does this require some backbone? Yes it does. Just reach around with your arm. You'll find you still have one.
David Holtzman, a privacy curmudgeon, as he puts it, says people respond in different ways to privacy concerns. His categories include the Curmudgeon, the Ignorer, the Avoider, the Deceiver and the Aggressor:
"Ignorers think that there is no problem; Avoiders go out of their way to not be in a situation where they have to give information; Deceivers deliberately give false information whenever possible; and Aggressors get indignant and talk about lawsuits or write nasty letters."
Curmudgeons don't lie or avoid privacy issues. They meet them head on. Here are his six guidelines for becoming a privacy grump. Some are extreme. Don't feel bad if you don't follow all of them. I don't. Just realize that you are exchanging convenience for information:
* Just Say No - If the information requested doesn't have anything to do with product or service you're buying, just say no.
* Pay Up Front - When requesting medical services.
* Ask Why - If they answer, "the computer system requires the information", ask again.
* Pay Cash - Cash transactions can't be tracked.
* Don't Use Wireless Devices - Cell phones and other devices can track and record your whereabouts.
* Don't Use "Convenience Cards" - They are designed to track and analyze your purchasing habits.
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion. You can find us on Facebook or Twitter.
Fight Identity Theft Newsletter
Enter your email address and keep up to date. More info | Unsubscribe
Recent Blog Entries
- May, 2010 (1)
- March, 2010 (1)
- February, 2010 (1)
- January, 2010 (3)
- December, 2009 (1)
- November, 2009 (5)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (38)
- Government (21)
- Identity Theft (39)
- Junk Mail (5)
- Phishing (13)
- Privacy (19)
- Scam (32)
- Technology (52)
- Telemarketing (2)
- Viruses (11)
- Visitor Stories (1)
- Worms (11)
