Dumpster-Diving for Your Identity

The NYT magazine has a story titled Dumpster-Diving for Your Identity - the author interviews two convicted identity thieves talking about their methods and successes.

Comments

Shredding doesn't offer much protection either...

[shakamojo]

Remind me to check my dumpster here at the office for a NYT login...

But seriously, we use a shredding company here at my office for our important papers. They're supposed to do all the shredding "on site" in their truck. Yesterday they were here to empty our shred bins, and they brought in a big trash bin to haul our stuff out to the truck. One of these bins was sitting in the hallway, and no one was around, so I took a peek inside. It was papers from an accounting firm down the street! I mean, we're supposed to be paying these guys to keep our info secure, but here they are waiting until their bin is full before they shred anything?! Needless to say, I had a long conversation with our facilities manager after this...

If you want something done right, better do it yourself! I'm now using a $30 shredder BEFORE I dump anything in our shred bins! Who knows where our important documents have been travelling to before they actually got shredded?!

This is why I burn all my important docs, credit card offers, old checks, etc... at home, who knows who is going through your trash? All they need is an account number, and a shredded document can be taped back together with enough motivation and time... (although with some people being easy marks, I guess the harder you can make it, the better!)

avoid recycling bins for financial mail

[js7a]

''It was the first time I had ever been to the dump,'' Massey recalled, wrinkling his nose. ''I said, 'I'm not going to get dirty,' so I wandered over to a shed where the recycling was stored. I notice there's a big barrel for recycled paper that's full of discarded tax forms from an accounting firm.'' Each form had the person's name, date of birth, Social Security number -- all the information necessary for taking out a line of credit.

My local police department recently published a blurb asking residents to dispose of identity theft-related materials (e.g., financial statements, anything with a SSN, etc.) in the ordinary garbage, instead of the "mixed paper" recycling bins as we've been asked by the rest of the city government.

It seems that identity thieves are very happy about the shared, clean, and portable "mixed paper" recycling containers found throughout my (rather affluent) city, and they tend to pick them up, quickly sort through the cereal and microwave dinner boxes for the good stuff, and have the container back before anyone notices.

Presumably today's dumpster divers have the luxury of avoiding coffee grounds, so you can go a long way towards protecting yourself by dumping the financial correspondence in with the smelly stuff.

The solution is easy

[Kirk Troll]

If you're so worried about ID theft, then maybe you should keep a close eye on your credit card bills, credit scores, etc.. Buy a paper shredder. Shred all bank statements and whatnot before you throw them out. Internet-shminternet, dumpster diving is the fastest way to someone's finances. Get the carbons at the gas station, or stores where they still use the old carbon-thinger credit card machine.

I knew someone who got screwed big time by a gas station who would keep the carbons, and double bill her every time she filled up, the cash going straight into the owners pocket. She was a dope for letting it go on so long, as she never bothered scrutinizing her Visa bills. Turned out the station was owned by a Russian mobster. This was long before the world wide weeb.

Just don't toss your sensitive data into the dumpster where any bum can get your CC number.

Re:The solution is easy

[A Commentor]

How does that protect you from the information theft that occurs with others that you have to deal with? If you have to see the doctor, and had it billed to insurance, most likely you're Social Security Number was seen by many people. Anyone of them could copy the number name and start opening accounts. I guess you could avoid the doctor offices too.

Having gone through this a few years back, it not as simple as you state. They didn't have any personal Credit Card numbers, just the SS # and they opened new accounts with that. Luckily one of the companies actually took time and flag the application for inconsistencies... Credit Report showed working at a computer company, yet the application said I cut hair... not many people make that kind of job change. The lady actually track me down, and I was able to clean it up relatively easy. If I had to wait for the next review of my credit report (which is recommended every year) with could be upto 12 months before this is detected, would make it much harder to clean up.

When a few companies was questioning me, as if I was involved in the scheme: "How did you find out about this if you weren't involved", it was quite satisfying to respond: "Mrs. X at company Y actually inspected the credit application and contacted me to verify that I didn't sign-up. She was the first to notify me and you can reach her at: xxx-xxxx. Don't blame me for your companies lack of verification."

Re:The solution is easy

[Elwood P Dowd]

If you have to see the doctor, and had it billed to insurance, most likely you're Social Security Number was seen by many people.

And those people don't necessarily work for your doctor or your insurance agency. I worked as a temp for a few weeks at a medical imaging billing company. Since a doctor that works in medical imaging processes a *ton* of patients, the billing becomes a large portion of their office's work. This is (I suspect) almost always outsourced.

My first day on the job, they handed me a stack of several hundred people's names, addresses, phone numbers, SOCIAL SECURITY NUMBERS AND MEDICAL RECORDS. This is pre-HIPAA. Dunno how it works now.

Let alone identity theft, one of the records they handed me that week was a well known elected politician's totally routine mammogram. Her results were clear. Imagine what that kind of leak could do to an election if it were not.

Obviously their entire business process needed to be completely redesigned if they wanted to provide some semblance of privacy. And you don't know if this company handles your bill or not. And such a redesign would raise their costs astronomically. It might even make them non-competitive with in-house billing. This doesn't mean it's ok, it just means it's not going to happen unless they're forced.

Obviously, I could go on and on.

Anonymous FTP

[Eberlin]

One electronic version of "dumpster diving" would be looking through a company's website/anonymous FTP server. Sometimes, a few moronic folks decide to store otherwise-vital information in these "undisclosed" locations that anyone can get into over the web.

Somewhat popular among the consulting types, they upload client data to an FTP server, then fly off to the client's office, and download it from there...or maybe use it as a means to "share" data among themselves. Some forget to password-protect it, relying instead on security through obscurity.

How is this related to dumpster diving? Well, if you look hard enough, those servers are just like public-access trash bins fit for people to...um...recycle data.

If you're a consulting group, make sure you treat your client data with absolute confidentiality. If you're a business working with consultants, make sure they don't leak your info to the world.

Compost them, don't burn them!

[wart]

Fireplaces produce too much air pollution. The ecologically correct way to dispose of these sensitive documents is to first shred them. Then mix the paper shredding into your backyard compost bin or worm bin and let nature dispose of it cleanly.

I doubt that many id theives would want to rummage through your compost bin, if they even thought to look there in the first place.

For added security, add a couple of large dogs to your backyard. They will help deter personal property thieves in addition to compost-diving identity thieves!

Abolish the SSN!

[jcr]

I have had way too many people asking for my SSN in the last few years. It started with my dentist's secretary demanding it, and when I declined to provide it, she insisted that they needed it for my dental records.

I told her, "You're not offering me a job, and I'm not opening an iterest-bearing account with you. You don't need my SSN, and you're not getting it."

About a month ago, a freaking cell phone provider asked me for an SSN just to get an account with them? WTF?

-jcr

What I wonder when I read these

[soft_guy]

When I read about guys like this - they are always idiots. Basically he got caught because he was hanging around a bunch of crazy drug addicts.

I keep wondering if for every guy like this they catch, there must be like 3 guys who are really careful and "normal people" (i.e. professionally minded, don't take drugs or hang around prostitutes, etc.) who do these type of crimes to build up some large amount of money, then move someplace and live off the interest. Those would be the guys that would be real hard to catch.

I wonder if those kind of criminals exist and in what numbers?

Re:Get a locking mailbox too.

[JediTrainer]

In Canada, hardly anybody has a curbside mailbox anymore (or even mail delivered to individual homes), unless you live on a farm or something. How's it work in other countries?

Most neighbourhoods here have a bank of mailboxes, each with a lock (small door, but deep enough to hold a standard letter envelope). Walk (or drive, if lazy) down the street to your mailbox. I guess Canada Post likes that system because they can deliver our mail much easier this way - essentially in bulk. Each bank has a pair of larger parcel boxes, in case you get a deliver that doesn't fit in your letter-size box. The nice man leaves you a key for 'compartment A or B', you take your package out, and deposit the key in the mail slot so the mailman can retrieve it with tomorrow's mail.

My only annoyance is some neighbours, who don't like receiving junk mail, leave it on top of the cabinet, leaving the garbage for everyone else to see. Why they can't just take it home and stick it in their recycling box is beyond me.

Re:Solution: Max Your Credit

[John Meacham]

A credit rejected letter is an identity theifs DREAM! by law, credit rejection letters contain not only pertinent stuff like your social security number, but they must give you a copy of your credit report if asked to show why you were denied. Once a thief gets your credit report it is all over. the credit report has every bank account and credit card number you own. as well as a lot of other personal info.

Trust no one with a fax...

[mi]

If it is not bad intention, it is just stupidity. For a while, I had a fax number, which was the same as that of some medical lab (or insurance company) -- except for the area code.

Twice a week a fax would arrive from a doctor's office in my area -- thanks to an absent minded "office manager" or some such. Due to the nature of the business, all faxes contained not only the patients' names, SS#, but also diagnoses, health histories -- the works! I called them back every time -- boy, were the morons surprised... They never even bothered to check the fax ID string, which I had configured to my company's name.

Not to give any ideas, but how difficult is it for a scumbag to get a phone number similar to that of a claims department of an insurance company?.. Or a mortgage department of a bank? You can guess the other steps she/he will need to make. Mind you, completely passive and impossible to detect. No dumpster diving involved either -- totally white-collar job...

We can moan about the need to use encryption and authentication, but faxes don't have this feature at all. As long as this sort of information passes over telephone lines unencrypted, your info is not safe.

Re:Shredding doesn't offer much protection either.

[pla]

The Cheapo shredder usually shredes only vertically, and does so usually so that there are about 20 cuts down one page
...
On the other hand, good commercial shredders litterall demolish the paper, turning it into sawdust like material that would be impossible (virtually) to reconstruct.

I have the second-cheapest cross-shredder I could buy from WallyWorld (Yeah, I know, evil, but show me a Mom&Pop that carries cross-shredders). For USD$25, I end up with 0.25" by 1.5" confetti. Good luck putting that back together.

And for a teensy bit extra security, when I empty the bin, I dump a cup of water on it for good measure. 15 minutes later I have paper mache - Even if you could still recognize a word here and there, how do you scoop it out of the wet blob to reassemble without obliterating it?. I suppose I could go a step further and burn it as well, but really, why bother? Anyone wanting my personal data that badly can get it a lot easier than searching my garbage for paper mush.

Attacking the actual problem

[tempshill]

The easiest problem to attack here is that it's too easy to open a credit card account. If this were made a grueling, lengthy process requiring written correspondence, with extra safeguards for changing addresses, then all the credit card side of identity theft would be mooted.

The FTC website says that if you're the victim of identity theft, you can contact the credit bureaus to put a FRAUD WARNING on the top of your credit card report. This makes me wonder whether we should all just do this anyway.

I have read that in Europe, getting a credit card is difficult and not instantaneous, and that identity theft (at least, on the credit card side) is less of a problem.

This is where you should be worried...

[blankmange]

I work for the fed. Our sensitive material is shredded through a large, commercial shredder. It only does a vertical shred, so you could reconstruct fairly easily. The best part is this: once the shredding is bagged, it goes out to our dumpster out back in the alley. It is not secure, guarded, or anything else.

Also, per our regulations, if you don't run it through the shredder, you have to manually tear up the piece of paper 6 times. This is social security numbers, addresses, medical information, etc.

I have often wondered how wrong this is, but my boss never seems concerned when I bring it up.