Identity Theft:How It Happens, Impact on Victims,

and Legislative Solutions

• Beth Givens

• Privacy Rights Clearinghouse

• 3rd Annual Privacy and Security Conference

• Nov. 7-8, 2002, Toronto, ON

Presentation Overview

1.Identity theft description & statistics

2.How the thieves obtain personalinformation

3.Impacts on victims

3.a Video segment of two victims

4.Legislative and industry solutions

5.Tips for consumers

6.Resources

I. What Is Identity Theft?

• Using someone else’s personal information for fraudulent purposes

• Account takeover

• Application fraud– new credit cards, loans, utilities, apartment

rental, cell phone, car purchase . . .

• Criminal identity theft

How Many Victims Are There?

• 500,000+ victims estimated per year U.S.

• 83,000 calls/mo. -- 50% from victims– Trans Union’s Fraud Dept., 500,000/yr.

• 1 in 5 adults (Image Data survey, 1999)

Victims in Canada

• Fastest-growing white-collar crime

• Increasing at about 55% per year– According to an Edmonton detective– CTV News, Sept. 29, 2001

• At least 12,000 victims per year

• There are 5 million more SINs issued than the Canadian population– According to Oct. ‘02 Auditor General report

Caseloads Are Increasing:Los Angeles County Sheriff

LA Sheriff Dept.ID Theft Caseload

Year 2000 Year 2001 Year 2002

Cases per yearPercent increase

2,119 4,149 + 96%

Estim. 6,000+ 45%

+ 283%

Cases per officer / yrIdeal caseload = 20

423 592 600

Source: Joe Dulla, LASD , Oct. 24, 2002

Why Is This Crime Is Rampant?

• Easy credit

• Inadequate application verification

• Ease of obtaining ID information…SSN

• Sloppy information security in workplace

• Inadequate law enforcement resources

• Penalties for convictions too weak

2. How Do Thieves Obtain Identification Information?

• Wallet theft

• Dumpster diving

• Access to credit reporting data bases

• Family, relatives, household workers ...

• Access to H.R. files in workplace

• An “Inside Job”

• “You’re protected against hackers, viruses and worms, but what about Rose in Benefits?”

• Magazine Ad for Computer Associates, eTrust Security Solutions (2001)

How Info Is Obtained, cont’d.

• Mail theft

• Change of address

• Telephone and Internet “spoofing”

• Internet

• Most identity theft is opportunistic

• Most victims do not know how the thief obtained their personal information

3. What Happens to Victims?

• Little help from the authorities

• Difficulty working with credit industry

• Abusive collection agencies

• Time-consuming

What Happens, Cont’d

• Emotionally scarred

• Lost opportunities

• Worst-case scenarios– criminal record– fraudulent work, unemployment, or

welfare record

• Must be savvy consumer

Credit Bureaus’ Fraud Depts.

• Phone # Canada U.S.•

• Equifax (800) 465-7166 (800) 525-6285

• Experian (N / A) (888) EXPERIAN

• Trans Union (877) 525-3823 (800) 680-7289

– Quebec (877) 713-3393

Identity Theft in Canada

• Recovering from identity theft in Canada is likely to be easier than in the U.S. . . because:

– Fewer credit reporting agencies– Fewer credit issuers– Fewer provinces and territories, and thereby

fewer government agencies to deal with.

• What’s Wrong With This Picture?

• The identity thief is in jail!

Video Segment

• Victims tell their own stories (5 min.)

• “Stolen Identity: The Crime of the Millennium” (1999)

• Produced by Sun & Moon Productions, Selene Kassin, distributed by Aims-Multimedia.com

4. Legislative Solutions

• Federal (U.S.) Identity Theft and Assumption Deterrence Act (18 USC 1028)

• Federal crime when anyone knowingly transfers or uses, without lawful authority, a means of

identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of federal law, or that constitutes a felony under any applicable State

or local law.

U.S. Federal Law, cont’d.

• Took effect in 1999

• Federal felony

• Establishes identity theft clearinghouse within Federal Trade Commission– Toll-free number: (877) IDTHEFT– Data base, to be shared w/ law enf.– Web site: www.consumer.gov/idtheft

State Laws

• Most of the states now criminalize ID theft– Listed on FTC website:– www.consumer.gov/idtheft

• California– Incremental approach, several laws each year – www.leginfo.ca.gov

California Statutes

• Criminalizing identity theft

– Misdemeanor / felony “wobbler” for use of personal information for unlawful purposes

– Requires notation of court record if imposter is convicted in victim’s name

– California Penal Code 530.5 (1997)

Information trafficking

• Penalties for trafficking in personal information– Every person who, with the intent to

defraud, acquires, transfers, or retains possession of personal identifying information of another person, is guilty of a crime punishable by up to $1,000 and one year in county jail.

– California Penal Code 530.5

Police report - credit report

• Correcting the credit report - with police report from victim

– If victim submits police report to credit bureau listing the fraudulent accounts, the credit bureau must remove (block) them and inform the credit grantors that the information has been removed.

– California Civil Code 1785.16(k)

Jurisdiction of record

• Establishing jurisdiction of record as victim’s own locale

– Local police department must take a police report, even if crime is committed elsewhere

– California Penal Code 530.6

Access to documentation

• Credit issuer must give documentation to victim and to law enforcement

– Copies of applications, checks, account statements, etc.

– California Penal Code 530.8

Security “freeze”

• Security alerts and security freezes

– Beginning Jan. 2003, credit bureaus must enable consumers to establish “freeze,” prohibiting the credit bureau from giving report to anyone without consent

– California Civil Code 1785.11.1 & .2

Protection from debt collectors

• Protection from debt collector harassment– No creditor can sell a consumer’s debt to a

collection company once the individual has reported the fraud to the credit bureau

– California Civil Code 1785.16.2– Victim may seek injunction against debt

collector who pursues payment– California Civil Code 1798.92-97

Address-change checking

• Address verification

– Credit issuer must verify address if (1) an application of credit shows a different address than the one on the preapproved offer, and (2) when a request for a duplicate card comes within 10 days of request for change of address

– California Civil Code 1747.06

Credit card no. truncation

• Truncation of credit card number on transaction slip

– No more than the last 5 digits of a credit card number may be printed on electronic receipts, effective January 2004

– California Civil Code 1747.9

The shredding law

• Destruction of customer records -- the “shredding” law

– Businesses are required to shred, erase, or otherwise destroy records containing personal information upon disposal

– California Civil Code 1798.80-82

The “hacker” notice law

• Disclosure of computer security breaches

– Requires business or government agency to notify individuals when personal information such as SSN and DOB has been accessed in a computer breach

– California Civil Code 1798.29

Restrictions on SSNs

• Confidentiality of Social Security Numbers

– Individuals & commercial entities may not:– publicly display or post SSNs– print SSNs on ID cards or badges– require people to transmit SSNs over the

Internet unless encrypted

SSNs, cont’d.

• Confidentiality of SSNs, cont’d– Individuals & commercial entities may not:– require people to use the SSN to logon to the

Internet without a password– print SSNs on mailed documents

– Phased in from July 2002 - July 2005– California Civil Code 1798.85

Criminal identity theft

• Dealing with criminal identity theft– Judicial process for clearing your name– California Penal Code 530.6(b)

– Data base of criminal ID theft victims– California Attorney General -- (888) 880-0240– California Penal Code 530.7– See PRC Fact Sheet 17(g)

Industry Responses

• Uniform fraud affidavit– major credit issuers now accept it– coordinated by Federal Trade Commission– www.consumer.gov/idtheft

• Automated profiling programs to detect fraud

– phone call or letter from credit issuer to the victim -- early detection

Industry Responses, cont’d.

• Credit monitoring services -- $40-$80/yr.

– PrivacyGuard.com– Intersections.com– Consumerinfo.com– Equifax.com

Industry Responses, cont’d.

• Identity theft insurance -- $40 - $140/yr.

– PromiseMark.com– Identityfraud.com– TrueLink.com– Travelers Insurance, low-cost rider– Chubb Insurance, no cost

Recommended Credit Industry Reforms

• Criminalizing identity theft is not enough

• See our report and survey results: “Nowhere to Turn: Victims of Identity Theft Speak Out”– CALPIRG & Privacy Rights Clearinghouse– at PRC web site:

www.privacyrights.org/ar/idtheft2000.htm

Credit Industry Reforms ...

• Free credit report annually– Early detection– Only 6 states require free reports

• Notice to consumer when credit report is accessed (Colorado)

Credit Industry Reforms ...

• Improve fraud flag process and penalize credit issuer when fraud alerts are ignored

• Improve address-change confirmation

• Credit application verification more rigorous

Other Recommended Reforms

• Restrict uses of SSNs & credit headers– Prohibit sale of SSNs on the Internet– Remove SSNs from public records posted

on Internet

• Improve Dept. of Motor Vehicles procedures– dup/replacement licenses flagging for fraud

• Biometrics?

5. Tips to Prevent and Minimize Identity Theft

• Check credit report at least once / year

• Clean out your wallet

• Don’t carry your SSN / SIN card

• Shred household papers before disposing

• Shred workplace papers and e-files

• Protect outgoing and incoming mail

Tips, cont’d.

• Have new checks sent to the bank branch

• Limit who obtains your SSN / SIN

• Watch for monthly account statements

• Don’t give out personal information on the phone unless you make the call

6. Resources

• “Identity Theft: What to Do if It Happens to You,” Fact Sheet 17a

• “Coping with Identity Theft,” FS 17

• “Nowhere to Hide” by PRC & CALPIRG

• www.privacyrights.org/identity.htm

Resources, cont’d.

• Identity Theft Resource Center

– Fact sheets for victims covering all phases of the crime recovery process

– One-to-One victim assistance– Affiliated with the Privacy Rights Clrgh.– www.idtheftcenter.org

Resources, cont’d.

• “When Bad Things Happen to Your Good Name” by Federal Trade Commission– (877) IDTHEFT

– www.consumer.gov/idtheft– FTC statistics at www.consumer.gov/sentinel

• “Identity Theft Survival Kit” and “From Victim to Victor” by Mari Frank, Esq. – www.identitytheft.org

Web Sites -- Identity Theft

• PRC www.privacyrights.org• Identity Theft Resource Center

www.idtheftcenter.org• FTC www.consumer.gov/idtheft• M. Frank www.identitytheft.org• CALPIRG & USPIRG www.pirg.org

Reporting ID Theft in Canada

• PHONEBUSTERS National Call Centre

• Ontario Provincial Police Anti-Rackets

• Toll Free: (888) 495-8501

• Toll Free Fax: (888) 654-9426

• Email: info@phonebusters.com

• Web: www.phonebusters.com

Resources for Canadians

• Royal Canadian Mounted Police– Identity theft pages– www.rcmp-grc.gc.ca/scams/identity.htm– www.rcmp-grc.gc.ca/news/nr-01-09.htm

• Privacy Commissioner of Canada– “Identity Theft: What It Is & What You Can Do”– www.privcom.gc.ca/fs-fi/02_05_d_10_e.asp

Resources for Canadians ...

• Ontario Information & Privacy Commission– “Identity Theft and Your Credit Report”– www.ipc.on.ca/english/pubpres/if-you/credit.htm

• Ontario Ministry of Consumer & Bus. Svcs.– ID theft tips with emphasis on birth certificates– www.cbs.gov.on.ca/mcbs/english/55XMZ8.htm– www.cbs.gov.on.ca/mcbs/english/575RNJ.htm

Resources for Canadians ...

• Credit Reporting Agencies• Equifax Canada

– Reporting fraud (800) 465-7166– www.equifax.com/EFX_Canada/

• Trans Union Canada– Reporting fraud (877) 525-3823– www.tuc.ca

• Acknowledgements: Ontario OIP and Public Interest Advocacy Centre

Canada Identity Theft Study

• “Identity Theft: Do Canadian Consumers Deserve Better Protection?”

• Public Interest Advocacy Centre

• Due Spring 2003

• (613) 562-4002

• www.piac.ca

Contact Information

• Beth Givens, Director• Privacy Rights Clearinghouse

– 3100 - 5th Ave., Suite B– San Diego, CA 92103

• Phone: (619) 298-3396• Fax: (619) 298-5681• E-mail: bgivens@privacyrights.org• Web: www.privacyrights.org