Combating Identity Theft

An anonymous reader writes "Net-Security is running an interesting article about some of the problems facing organizations when it comes to identity theft. From the article: 'Identity theft is the major security concern facing organizations today. Indeed, for the banking industry, it is the number one security priority for 2006. Identity security has developed beyond the simplest form of authentication where one party issues and verifies identities within a closed group of users. While easy to do, this approach is extremely hard and costly to scale upwards and offers no interoperability with other authentication networks.'"

Comments

Um...

[ShaniaTwain]

Can't they just use 'whois'?

It's useless...

[Anonymous Coward]

There's really no point to fighting identity theft. If someone wants your identity, they'll take it.

--CowboyNeal

They're not helping themselves

[Kombat]

A big part of the problem is that the banking industry isn't always taking advantage of their own safety checks. For example, take a look at these stories to see how merchants pretty much ignore the signatures on the back of credit cards.

Re:They're not helping themselves

[Mattcelt]

To put it simply: it isn't painful enough.

VISA actually requires that merchants, in some circumstances, NOT challenge the person using the card. (Have tou noticed that many merchants won't even ask for a signature for purchases below a set limit now?) Why? Because the cost of turning away potential sales - including fraudulent ones - is many multiples of VISA's cost of lost revenue due to fraudulent activity and theft.

What's more is that merchants, not the credit card issuers or underwriting banks, are the ones ultimately responsible for more than 90% of chargebacks. So if the merchant sells a product to someone using a fake card, and the rightful owner of that card challenges it, the merchant takes the loss, not VISA. So for the most part there's really not a direct reason for VISA to curb fraudulent activity at all.

So security in this case actually leads to loss of sales, and therefore loss of revenue for VISA. The customer is indemnified, VISA and the banks are insulated, and the merchant gets screwed - until they raise their prices to make up for the loss. And even then, it's the customer who bears the ultimate financial burden. IOW, VISA has every incentive to make it easier for people to use their cards, even if that means more identity theft.

Re:They're not helping themselves

[Bogtha]

Here in the UK, we use the Chip and PIN system, which has been in effect for a while and practically mandatory since Valentine's Day.

Penalties

[Paladin144]

I think the identity theft problem could be solved fairly easily if we persuaded Congress to pass legislation stating that whenever a company (or government branch) loses person's private information then that person is owed, say $1,000. I think banks would get serious about the public's privacy pretty damn quick. Now all we need to do is get Congress to pass this legislation, which is clearly pro-consumer and somewhat burdensome to big-finance...

Uh... okay. I guess I'm living in fantasyland.

Nevermind.

Alternative systems?

[RingDev]

As noted, hardening identity security is extremely costly and difficult. Another option may be to reduce the importance of an identity, make them easier to get rid of and recreate. For example, if someone grabs your credit ID and maxes you out, you'll have to battle for years to get your credit rating restored. If a system could be developed to trivialise the impact of Identity Theft, then the importance of security would decrease from its current point. Yes, it's treating the symptoms, but in this case it could be the cheapest and easiest way to having a safe experience for customers.

-Rick

IMPOSTER

[Anonymous Coward]

**I** am Anonymous Coward, this ^^^ guy stole my nick. Don't believe a word he says!

You don't need to see his identification

[Billosaur]

The key lies in the use of an authentication platform that is flexible enough to accept the digital credentials of any participating organisation. An additional advantage of the integrated approach is that it need not err towards the lowest common denominator digital identity solution - i.e. username/password. Therefore, should an organisation within the integrated identity group want to be able to use stronger identity for some, if not all, of its transactions then this is possible without interfering with the requirements of other participants. As such, one organisation may consistently have high transaction values that would justify and require a more robust authentication solution than lower value transactions would. This is based upon a financial risk versus cost of solution basis but does allow for the widespread use of a single smart card-based solution.

Except that people are completely resistant to the idea of a single id card (the so-called "National Id"), even though it makes sense, given the sheer quantity of different forms of id that are required:

• Social Security Card
• Driver's license
• Passport
• Membership cards
• Health insurance cards
• Credit cards
• Debit cards

In the end, we're saddled with all these differet ids (let's not even get into usernames and passwords for on-line banking or web site membership). And all these ids share the common feature of having to be tied back to an individual somehow. The problem lies in the fact that thieves can get their hands on pieces of data (address, SS#, phone number, DL#, etc.) that allow them to replicate you and then use that information to either utilize resources you already have or create new resources that they can exploit (mortgages, loans, etc.).

Until there's some kind of global standard, defining just what identifies you as you, and there is a system for storing, retrieving, and updating that information in a manner that foils potential thieves, identity theft will continue to be a problem for the forseeable future.

It's mostly paper - checks, etc...

[AnonymousPrick]

From here: Clark Howard's Identity Theft Section

Mar 11, 2005 -- How identity theft really occurs
Identity theft has become huge, as we all know. But how and why does it occur? Many people think that identity theft occurs because of what we do online. But just slightly more than 10 percent happens online. Almost all of it occurs when someone steals your checkbook, your wallet or your mail. The Internet actually helps in reducing ID theft, according to the Better Business Bureau. Monitoring your checkbook and credit card status online is a huge deterrent to identity theft because people find things quickly and can report them right away. So, if you still have a checkbook and you refuse to part with it, keep it at home and know where it is at all times. This is especially important for businesses, which are expected to keep a higher standard of security when it comes to securing checks. Businesses have liability for checks written that are stolen. So, keep very good track of your checks if you own a business.

Theft? Fraud!

[TechyImmigrant]

It's not theft. It's fraud.

Re:Theft? Fraud!

[Neoncow]

I prefer to think of it as identity sharing.

A statement and a story

[Anonymous Coward]

merchants pretty much ignore the signatures on the back of credit cards

This is common knowledge. I haven't signed the back of my card in over 10 years. What's funny is when a cashier actually looks at the back of the card and then just procedes on even though there's no signature. Let's face it though, even if they did check, it's a worthless security measure anyway. Any crook with even a primitive grouping of nerve endings in their skull can take the few minutes to come "close enough" to the signature on the back of the credit card they just stole.

Interesting side note about the saying that the "banking industry" no taking advantage of their own saftey checks. When I went to get a cashiers check for the down payment on some real estate (around $13K), my bank gave me MASSIVE amounts of grief because my signature on the cashiers check request did not match the signature they had on file for me, nor did it match the signature on my drivers license (all three were different). I ended up having to produce another form of picture id (which for most people is difficult, since usually it's your drivers license that has a picture, for some it could also be a student id, for many you're SOL) and signing another signature card. Turns out that while the signature card is not used generally to check the signature on checks (it's bank stated purpose), the bank does check it for transactions over $10K.

Re:A statement and a story

[fumblebruschi]

Bear in mind that the signature on the back of the card is not a security measure for you; it's security for the store.

If you look at the card, you'll see a notice by the signature field that says "NOT VALID UNTIL SIGNED." This is because the card constitutes a binding contract between you and the credit card company. Until you sign it, the card is not a financial instrument.

Let's say you don't sign the card, and you use it to but $1500 worth of stuff at a store, and then you don't pay the credit card bill. The credit card company is not legally obligated to pay the store for the goods you bought, because the unsigned card was not a binding agreement. You can be prosecuted for acting in bad faith, but the store won't get its $1500.

That's why the store needs you to sign it--and that's why, when I was a cashier (for my sins) I would often have to ask people to sign their credit cards.

Incredulous customer: But don't you see how ridiculous that is? I might have just stolen this card and be forging the signature on it!

Me: That's true, but remember, I'm not doing this to protect you; I'm doing it to protect the store.

Technically, by insisting on a signature, I was performing good-faith assurance. Sure, the guy might be signing a fake name; but a store can't be held legally responsible for detecting forged signatures, since it's not reasonable that a minimum-wage cashier be required to be trained in forgery. (Court cases have upheld this.) As long as the card has a signature on it, the credit card company has to reimburse the store for whatever gets bought. That's the only thing the store cares about.

The lesson? Remember that the only person who has any interest in protecting you is yourself.

Re:A statement and a story

[6*7]

'If you look at the card, you'll see a notice by the signature field that says "NOT VALID UNTIL SIGNED."' ...
'The credit card company is not legally obligated to pay the store for the goods you bought, because the unsigned card was not a binding agreement.'

That's a nice though, but I'm wondering how an online transaction fits into this scheme?

That last line is the killer.

[khasim]

Until there's some kind of global standard, defining just what identifies you as you, and there is a system for storing, retrieving, and updating that information in a manner that foils potential thieves, identity theft will continue to be a problem for the forseeable future.

The more "global" you make it, the more problems you have from the people who manage the system.

If a single item will "identify" you, then the value of that single item skyrockets.

As the value goes up, so does the incentive to break the system so that you can cash in on it.

Re:Make it harder

[Knackered]

They don't want to make it harder to get credit. The whole basis of their profitability is giving easy credit to people who will draw on the credit, and pay them interest. Making it too hard to get credit would make them less profitable. It's only when the cost of identity fraud exceeds the profitability from easy granting of credit that they'll change.

ID theft sucks and it's only getting worse

[bogie]

I was just an ID theft victim. Some douche in Philly opened up a cell phone account with all my info. Now I have to constantly watch my credit for the next year. It's bad enough knowing that your name,address, SS#, etc, all are floating around in 50,000 different legitimate locations, but it really sucks when someone with malicious intent gets ahold of that information. There really isn't anything anyone can do for you either once your information is stolen. You can only file a police report and then notify the credit agenices. Real damage gets done and peoples lives have been completely turned upside because of ID theft. Sadly many people end up battling ID theft for years and years. It's only going to get worse.

Paradoxical ID Theft

[1337p1rt3]

After reading the article I found a couple of the points to be near disturbing, to such an extent I choked on my coffee.

1. This allows individuals to use one form of identity to authenticate themselves to a range of different organisations.

This is a security breech in it of its self. The idea is to make a system harder to get into, by allowing users to have a single token for a multi-organizational environment you are essentially defeating the purpose of information security. ONLY one person has to sell their information or loose it for a single person to attack a vast amount of networks.

2. For a start, the enormous investment involved in issuing digital certificates on smart cards, for example, can be recouped to some extent, by deriving revenue from allowing other organisations to authenticate their users with the same identity.

A part of Information Security is Information Control. This is an easy way to loose control of a secure environment. The CIO is relying on a secondary company that he/she is not physically monitoring to maintain positive control of their security environment. I for one would allow NO ONE access to my tokens or authentication system that didn't reside behind my firewall. Information security should not be about cost effectiveness. It is no secret that it is not cheap. Though cross organizational security is becoming more robust with software and a wider array of risk management, there is still the human factor that no one can control, i.e. there is no cure of human stupidity.

3. On the upside

There is of course a way to manage this kind of environment; intense risk management. The amount of resources the organization would have to dedicate to risk management almost makes this concept not cost effective. There would have to be an entire task force not associated to any of the corporations and would have to manage and asses security risks. The reason being is to gather non-biased information. This would be costly and time intensive.

4. There are alternatives?

The alternative and one that I am seeing become more common is to share a single platform but on the backside enforce a stronger security measure. Example, John logs in via a token system that is shared and then re-authenticates via biometrics on the backside. There goes cost effectiveness right out the window. The best biometric systems are very expensive and timely to roll-out. SafLink offers a great solution but is very costly and does not include hardware. Biometrics is the way to go albeit there is still a chance of a security breech if a hacker gains access to local cache files that store the bio-information. It would be near impossible to break the algorithm but there is still that chance.

I guess with all security there is that same risk. There is no truly secure system, but we all make out as best we can. As security becomes more intense so will the possibilities of intrusion, for every action there is reaction.

Lenders are liable for ID theft, not victims

[max born]

I was a victim of ID theft 5 years ago. A credt card company (Next Card IIRC) gave someone a credit card who had only my name and SS#, wrong date of birth and wrong address. Anyway this guy went to Vegas and ran up quite a bill. It was only when the card remained unpaid that the company bothered to track down the real me.

They wanted me to sign an affidavit. I told them I wan't signing anything, it wasn't my problem. I quoted the following from CHAP. 41, SUBCHAP VI, sections b and e of U.S. Code TITLE 15 which states:

(b) Burden of proof
In any action which involves a consumer's liability for an unauthorized electronic fund transfer, the burden of proof is upon the financial institution to show that the electronic fund transfer was authorized or, if the electronic fund transfer was unauthorized, then the burden of proof is upon the financial institution to establish that the conditions of liability set forth in subsection (a) of this section have been met, and, if the transfer was initiated after the effective date of section 1693c of this title, that the disclosures required to be made to the consumer under section 1693c(a)(1) and (2) of this title were in fact made in accordance with such section.

(e) Scope of liability
Except as provided in this section, a consumer incurs no liability from an unauthorized electronic fund transfer.

Anyway, they took care of everything after that. Including my credit rating.

Re:Lenders are liable for ID theft, not victims

[LandKurt]

I told them I wan't signing anything, it wasn't my problem.

Isn't it great how they shift the problem to the consumer by calling it identity theft. They didn't steal your identity, they stole the credit card companies money by fooling them. They should call it credit company bamboozling, but that would make it sound like their problem instead of yours.

Re:Useless information

[Anonymous Coward]

The functionality is already available as far as the credit reporting agencies not providing your information for marketing purposes.

You can protect yourself from identity theft by taking your name off of the credit bureaus mailing lists. The credit bureaus are one of the biggest offender when it comes to selling your name and information to the credit card companies who in turn send you all those pre-approved applications. One call to the Opt Out Request Line (for Equifax, Trans Union, Experian and Consumer Credit Associates) is all it takes to permanently remove your name from all marketing lists that the credit agencies supply to direct marketers. You can also opt for a two-year period, renewing your request at any time in the future.

1-888-567-8688

To get rid of most other junk mail, write a letter giving your complete name, name variations and mailing address to:

Mail Preference Service
Direct Marketing Association
P.O. Box 9008
Farmingdale, NY 11735

1-800-407-1088 Opt-Out from all mailing and telemarketing lists

Other sources:
http://www.dmaconsumers.org/cgi/offtelephonedave
http://www.dmaconsumers.org/cgi/offmailinglistdave
http://www.dmaconsumers.org/optoutform_emps.shtml