Slashdot Mirror
The Ultimate Identity Theft Prevention Plan
Ben Rothke writes "It's a fallacy that our elected officials take forever to get things done. Two examples where Washington acted with speed are with the National Do Not Call Registry and the Sarbanes-Oxley Act. The National Do Not Call Registry was slated to take effect on October 1, 2003, but various marketing associations challenged its legitimacy and even if the FTC had the jurisdiction to enforce it. Notwithstanding, President Bush speedily signed the bill authorizing the no-call list to go into effect in September 2003 and the United State Court of Appeals upheld the constitutionality of the registry in February 2004. On June 25, 2002, WorldCom revealed it had overstated its earnings by more than $7 billion by improperly accounting for its operating costs. Senator Paul Sarbanes then introduced Senate Bill 2673 that same day where it passed 97-0 less than three weeks later. The House and Senate formed a Conference Committee to reconcile the differences between Sarbanes's bill and Representative Michael Oxley's bill (HR 3763) and on July 24, 2002, the Sarbanes-Oxley Act of 2002 was passed." Read on for the rest of Ben's review.
Stealing Your Life: The Ultimate Identity Theft Prevention Plan
author
Frank W. Abagnale
pages
256
publisher
Broadway Books
rating
8
reviewer
Ben Rothke
ISBN
0767925866
summary
exposes the tactics of today's identity theft criminals and offers strategies to thwart them
The bottom line is that when politicians really want votes and PR, they can act swiftly. The frustration is exacerbated when politicians choose to do nothing when it comes to identity theft. In Stealing Your Life: The Ultimate Identity Theft Prevention Plan, Frank Abagnale details the frustration that consumers face (and will face in the years to come) when their identities are stolen, the ease at which the criminals carry out such crimes, and the months and often years of effort required to regain ones identity.
Abagnale's tenure on the criminal side long ago gives him the advantage that he knows firsthand how criminals think and such an outlook is pervasive throughout the book. Looking at the current state of identity protection, he states that he is personally horrified at how easy identity theft is. In fact, he calls it "a crook's dream come true". The book details incident after incident where criminals and criminal gangs obtained credit in someone else's name with ease.
What makes this worse is that the book shows how we haven't even scratched the surface of the identity theft problem. Everyone, including the FTC agrees that current identity theft figures are quite low, due to the fact that so many cases go unreported or undetected.
The book notes that lenders often miscategorize a good deal of identity theft because it looks like delinquent bills, as opposed to a crime. Only later does the victim realize what has been going on and complains, at which time it becomes apparent that fraud was involved. But by that time, the money has been written off as a credit loss and then appears as negative information on the victim's credit report.
Like many other books on the subject of identity theft, Stealing Your Life: The Ultimate Identity Theft Prevention Plan covers the main issues, and makes numerous suggestions on how to control your identity. What is interesting about the book is that Abagnale also focuses on why identity theft is so popular for today's criminals. One of the main reasons it that the person committing the crime has the odds significantly stacked in their favor. The book quotes a Gartner study that found that identity thieves have roughly a 1 in 700 chance of getting caught by law enforcement, which is a figure any criminal would jump at.
The books 13 chapters are written in an easy to read and compelling style. The early chapters detail the prime causes of what makes identity theft such a problem and astutely notes that a large part of the problem is that financial services companies are conducting business today by doling out credit like candy and do almost nothing to ascertain that people really are who they say they are when applying for credit. In addition, issuers of credit in their haste to rack up more business frequently accept a social security number from an applicant at face value, without demanding proof. The book lists many examples of where children and dead people have been given credit.
In chapter 6, the book lists 20 steps one can take in the hope of preventing identify theft. The author notes that since the punishment for identity theft, and the recovery of stolen goods from identity theft are so low, the only viable source of action is prevention by the individual. All 20 steps are fundamental, from protecting your social security number and examining your financial statements, to using a shredder and more.
Chapter 8 lists one of the more important points of the book, in which Abagnale writes that all credit and personal information should be opt-in based, as opposed to the prevalent opt-out requirement. Such an approach is what one would hope Congress would mandate, but does not have the tenacity to do. The problem is that if a consumer does not opt-out, they are giving the financial institution permission to share their personal information with the hundreds and often thousands of affiliates they share data with.
Companies obviously prefer opt-out, which shifts the burden to the consumer to take action to keep their information from being shared. With opt-in, the burden shifts and the financial services company has to prove that consumers granted their consent to have their personal information shared. National opt-in requirements would significant stem the flow of personal information, which is in part why identity theft is so easy to carry out.
Aside from a glaring error in chapter 12 where Abagnale erroneously writes that true authentication is impossible on the Internet and occasionally hawking companies he has financial dealings with, Stealing Your Life: The Ultimate Identity Theft Prevention Plan is an interesting and entertaining book on a subject of the fasting growing crime in the USA.
The book details what happens when an apathetic Congress and financial services industry do almost nothing to protect their constituents, and the thieves who have never had it easier. These identity thieves are able to acquire gigabytes of personal information without ever having to leave their workstations. When you factor in that the odds are in their favor of never being prosecuted, it leaves nearly every individual at risk for identity theft.
With Congress dropping the ball and doing nothing, Abagnale shows that it is up to each individual to take responsibility for protecting their own personal information. Stealing Your Life: The Ultimate Identity Theft Prevention Plan is indeed a great place to start such an approach.
Ben Rothke is a security consultant with BT INS and the author of Computer Security: 20 Things Every Employee Should Know
You can purchase Stealing Your Life: The Ultimate Identity Theft Prevention Plan from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The bottom line is that when politicians really want votes and PR, they can act swiftly. The frustration is exacerbated when politicians choose to do nothing when it comes to identity theft. In Stealing Your Life: The Ultimate Identity Theft Prevention Plan, Frank Abagnale details the frustration that consumers face (and will face in the years to come) when their identities are stolen, the ease at which the criminals carry out such crimes, and the months and often years of effort required to regain ones identity.
Abagnale's tenure on the criminal side long ago gives him the advantage that he knows firsthand how criminals think and such an outlook is pervasive throughout the book. Looking at the current state of identity protection, he states that he is personally horrified at how easy identity theft is. In fact, he calls it "a crook's dream come true". The book details incident after incident where criminals and criminal gangs obtained credit in someone else's name with ease.
What makes this worse is that the book shows how we haven't even scratched the surface of the identity theft problem. Everyone, including the FTC agrees that current identity theft figures are quite low, due to the fact that so many cases go unreported or undetected.
The book notes that lenders often miscategorize a good deal of identity theft because it looks like delinquent bills, as opposed to a crime. Only later does the victim realize what has been going on and complains, at which time it becomes apparent that fraud was involved. But by that time, the money has been written off as a credit loss and then appears as negative information on the victim's credit report.
Like many other books on the subject of identity theft, Stealing Your Life: The Ultimate Identity Theft Prevention Plan covers the main issues, and makes numerous suggestions on how to control your identity. What is interesting about the book is that Abagnale also focuses on why identity theft is so popular for today's criminals. One of the main reasons it that the person committing the crime has the odds significantly stacked in their favor. The book quotes a Gartner study that found that identity thieves have roughly a 1 in 700 chance of getting caught by law enforcement, which is a figure any criminal would jump at.
The books 13 chapters are written in an easy to read and compelling style. The early chapters detail the prime causes of what makes identity theft such a problem and astutely notes that a large part of the problem is that financial services companies are conducting business today by doling out credit like candy and do almost nothing to ascertain that people really are who they say they are when applying for credit. In addition, issuers of credit in their haste to rack up more business frequently accept a social security number from an applicant at face value, without demanding proof. The book lists many examples of where children and dead people have been given credit.
In chapter 6, the book lists 20 steps one can take in the hope of preventing identify theft. The author notes that since the punishment for identity theft, and the recovery of stolen goods from identity theft are so low, the only viable source of action is prevention by the individual. All 20 steps are fundamental, from protecting your social security number and examining your financial statements, to using a shredder and more.
Chapter 8 lists one of the more important points of the book, in which Abagnale writes that all credit and personal information should be opt-in based, as opposed to the prevalent opt-out requirement. Such an approach is what one would hope Congress would mandate, but does not have the tenacity to do. The problem is that if a consumer does not opt-out, they are giving the financial institution permission to share their personal information with the hundreds and often thousands of affiliates they share data with.
Companies obviously prefer opt-out, which shifts the burden to the consumer to take action to keep their information from being shared. With opt-in, the burden shifts and the financial services company has to prove that consumers granted their consent to have their personal information shared. National opt-in requirements would significant stem the flow of personal information, which is in part why identity theft is so easy to carry out.
Aside from a glaring error in chapter 12 where Abagnale erroneously writes that true authentication is impossible on the Internet and occasionally hawking companies he has financial dealings with, Stealing Your Life: The Ultimate Identity Theft Prevention Plan is an interesting and entertaining book on a subject of the fasting growing crime in the USA.
The book details what happens when an apathetic Congress and financial services industry do almost nothing to protect their constituents, and the thieves who have never had it easier. These identity thieves are able to acquire gigabytes of personal information without ever having to leave their workstations. When you factor in that the odds are in their favor of never being prosecuted, it leaves nearly every individual at risk for identity theft.
With Congress dropping the ball and doing nothing, Abagnale shows that it is up to each individual to take responsibility for protecting their own personal information. Stealing Your Life: The Ultimate Identity Theft Prevention Plan is indeed a great place to start such an approach.
Ben Rothke is a security consultant with BT INS and the author of Computer Security: 20 Things Every Employee Should Know
You can purchase Stealing Your Life: The Ultimate Identity Theft Prevention Plan from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The summary extract on the front page has nothing to do with the rest of the summary or the article.
Or I'm confused again...
It is absolutely correct that in order to combat identity theft effectively, information sharing must be opt-in. In fact, even to report your information to a credit reporting agency, you should have to explicitly authorize such reporting.
Of course, the credit bureaus and other data brokers who make money off your data would scream and holler. They would decry how "credit reporting is a benefit -- it lets you get credit easily and cheaply." Funny thing though -- you cannot refuse this "benefit".
Fizz
Yes, Congress can act rapidly. Unfortunately, it almost always results in a bad law. Sarbanes-Oxley is a great example, it costs a lot more than it saves. The most efficient way to prevent the problems it is designed to curb is by keeping the tax on stock dividends at the same as the tax on capital gains. If a company gives a dividend, it cannot play the accounting games that lead to the abuses that SOX was designed to stop.
The truth is that all men having power ought to be mistrusted. James Madison
The Do Not Call registry was timely? People have been complaining about unwanted phone solicitations for years and years. That is actually an excellent example of Congress showing that it is incapable of moving quickly enough.
And, finally, lets not forget about the USA PATRIOT act. That passed in 1 night in response to 9/11, and I'm sure my fellow Slashdotters will agree that it was brimming with righteousness and justice. Thank christ Congress acted quickly on that one.
No, I'm afraid kneejerk reactions by Congress are not the answer you seek. The elephant in the room that no one in Congress wants to recognize is that identify theft is so easy now only because we have tied ourselves to our Social Security numbers, something that was never supposed to happen and something that fundamentally undermines the idea of individual privacy and freedom. Do not look to the people who created this problem in the first place to fix it without continuing to divest you of your personal liberties.
Most of us have no life or identity to steal...
If the name of the author is familiar, it is because Frank Abagnale's exploits were popularized in the 2002 movie Catch Me If You Can. Leo DiCaprio played the Abagnale, with Tom Hanks as Carl Hanratty, the FBI agent tracking him down.
Given Abagnale's extensive knowledge and experience in check (and other) fraud, he speaks with some authority on the sad state of how easy identity theft can be.
Look, man, I was really high when I wrote that chapter; you've got to give me a break.
--
This post brought to you by OnlyIAmMe(TM) ID Theft Prevention, Inc.
Secure your identity today! Plans start at $1,995 for a limited time.
It is my understanding that in at least of the 30 of the 50 states you can "freeze" your credit, not allowing someone else (or yourself) to take out loans, get a credit card, etc. Choicepoint and the other 2 (asshole) credit bureaus are lobbying against this.
It really gets my goat that, contrary to what is in the social security act (it is illegal to use it for anything except SS purposes), our SSNs have become the defacto identifier in terms of any goverment, university, or financial application. Its like a freakin username with no password.
The entire notion of "identity theft" simultaneously preys on the fears of individuals by creating the specter of more bogeymen and promotes the Consumer Information mega-industry.
You want to stop "identity theft?" Make the collection and sale of personal data against the law. Oh wait. That would mean participating in your government.
Today's lesson: we've all gotten exactly what we've put into this issue.
Got Trader Joe's? friendwich.com RSS feeds work now!
No. No matter how many times you post this, Slashdot will continue to be a primarily US-centric site. There is nothing you can do about this. I suggest you either find a site tailored for your country or learn to relax. Do people on British sites that refer to "our Prime Minister" complain that those sites are assuming all of their readers are from Britain?
Are you one of those guys that posts in every Linux article insisting we call it GNU/Linux or that we start using the term "Gibibyte" (which sounds like someone with a stutter trying to say "Gigabyte" for base-2 storage numbers?
Aside from a glaring error in chapter 12 where Abagnale erroneously writes that true authentication is impossible on the Internet
While strictly speaking, from a theoretical standpoint, he is, as you say, wrong about true authentication being impossible it is also important to consider the audience to whom this book is speaking. In fact, it can be very difficult for the average user, in practice, to be certain that a particular electronic transaction is secure (there have been several recent studies confirming this). This combined with the fact that the phishers, identity thieves, spammers, and other malcontents are actively subverting the system to trick users in ever more sophisticated and clever ways means that from a practical standpoint, for the average user, this may be good advice (i.e. to consider internet transactions to be unsecured or at the very least suspect). I know that this is Slashdot and we all know better here (i.e. we wouldn't be easily fooled by phishers or get hit with a rootkit or keylogger...or so we hope), but if experts have difficulties then just imagine how the average users feel.
Agreed, Sarb-Ox was put together and passed very quickly, and it shows.
Consultants are in the business of selling billable hours, nothing more. It doesn't matter if they are accountants, lawyers or MBAs. Their advice is what led to the meltdowns at Enron, MCI, etc. They were trying to find clever ways to reinterpret SEC rules and GAAP(Generally Accepted Accounting Procedures). GAAP are not written by the government. The SEC trusts the financial services industry to police itself with its own written policies. That trust was violated.
Sarb-OX was a knee-jerk reaction that created more rules, more oversight, and more billable hours for the financial services industry. The intent was good, but the implementation was flawed, it rewarded the guilty.
Much like our income tax system should be simplified, so should the SEC and GAAP rules be simplified. The amount of paperwork and billable hours that are created just for executives to move a sale, or a loan, or a payment from Q3 to Q4 just to maintain a stock price in the short term to get their bonus is an enormous drain on our entire economy.
Imagine a world where the accounting rules were so simple that the Financial Services Industry could only bill half of the hours next year.
Please can article-posters to slashdot stop assuming all readers are in the USA
Don't you think it a bit trivial to make such a request? Where does it stop? Can article-posters to slashdot stop assuming that all readers can read English? Can article-posters to slashdot stop assuming that all readers are on planet earth? Can article-posters assume that all readers know what a "Washington" is? What is an "elected official"? Stop the madness and stop assuming! (I'm assuming you know what sarcasm is)
How SOx is presented as an "obviously good" thing. It's killing ipos, it's preventing the little companies from going public and getting funding. Now they can't turn to the public anymore and can only rely on big institutional investors. Yeah, hurray for Sox.
\u262D = \u5350
ID theft is just one of the many, many problems with the credit system in the US. The worst problem is with reporting - things are reported to credit bureaus that have nothing to do with credit, much of it is deliberately false both from credit companies and third party debt collector scum, and finally what the credit report is permitted to be used for.
Good examples are credit card companies deliberately not reporting credit limits to drop your coveted 'score' (so you are ALWAYS over the limit), to third party debt collectors re-aging old debt, to out and out falsifying payment records, etc...
And, then there are other things like medical bills. Why are unpaid medical bills on a credit report? It is not credit, and has no bearing on your ability or desire to pay your mortgage or car loan. Tough luck that you didn't have insurance - you should have thought about that before you went and got cancer. Or what about that fenceline dispute you had with your neighbor that you took to small claims court. You lost, there was no monetary award, yet a judgement still appears on your 'credit' report. Plain wrong.
Oh, and then there is permissible purpose. Exactly what does a credit report have to do with a job? How about insurance? How many people were 'right-sized' into 'bad credit'? Now you can't get another job because your credit is bad? C'mon, does anyone see something wrong with this? Credit reports are about useless for determining credit worthiness for a myriad of reasons, and we want them applied here to? Give me a break. Got 'bad' credit? Can't rent now either - so where the hell are you supposed to live? The problem of people using credit reports for things other than granting credit is big and getting a lot bigger, but will anyone stand up an write Congress about it? And you can forget cable, direct tv, cell phone plans, satellite radio, or any other services. Down in Texas they are raising gas utility rates on people who have bad credit. Wake up people! Not all people have bad credit on purpose even in the absence of ID theft.
The system is a horrible disgrace - designed to bilk billions out of the public - nothing more, even if you leave ID theft out of it altogether.
Until there are laws passed that are stronger than the FCRA and impose criminal penalties and much higher fines, you will never see the end of this.
It does not matter what you do, it's wrong.
Pass a federal law that states (reiterates?) that an individual has ownership of their personal data.
Any use of that data would require opt-in or, better yet, payment to its owner.
The credit reporting firms are snooping on us now and making money from it. Let's see how viable their business model would be if the free lunch were taken away. Screw parasitic middlemen.
Get your teeth into a small slice: the cake of liberty
It seems to me that we'd go a long way in fixing identity theft if we stopped treating knowledge of personal info as proof you are that person. My cable company uses my social security number as "proof" that it's really me - but god only knows how many people know my social security number. My bankers, my employer (and everyone who can touch the payroll system) my doctors office, my insurance companies. The list is very long.
It should be illegal to use the SSN as a shared secret, and anyone who does use it as a secret identifier should be liable for any expenses they incur. VISA would be a lot more effective at combating fraud if they had to pay for every false credit card opened in my name.
Even better, if we didn't have to treat SSNs as secret information anymore, it'd make our lives a lot easier. The SSN is a great primary key for me - it's one number I can remember, and it does a good job of uniquely identifying me. I want to be able to give it to more people.
If Congress really can act quickly when it wants to, a good way to bring this about is to require all members of Congress to publicly disclose their SSN on January 1st 2008.
It would have been nice if they had taken some time to consider what the problem was, and then decide if additional legislation was required.
I am not familiar with the entire text of Sarbanes-Oxley. I am familiar with the effects of some parts of that act and I have a hard time understanding the need for it. A lot of time and effort is spent on activities that generate a lot of paperwork, with few obvious returns for anyone.
Maybe it's just me? You see, I was under the impression that it was illegal for executives to falsify SEC filings and steal from the shareholders BEFORE Sarbanes-Oxley. The need for this legislation was never obvious to the likes of me.
Sociopaths like Ken Lay and Bernie Ebbers are going to do what they are going to do regardless of the laws on the books. The existing laws didn't stop Lay and Ebbers, and I doubt that the Sarbanes-Oxley act would have made any difference. Perhaps it would have have made their thefts more difficult to pull off, but at the end of the day if a group of executives and board members band together and tell the same lie, it's really hard for the auditors to prove otherwise.
FWIW, Enron was quite open about what they were doing - it was all in the notes of their SEC filings. Unfortunately, nobody paid any attention to what they were doing as long as the stock kept increasing in value.
I just don't think Sarbanes-Oxley is a good example of a law period, never mind a law that was rushed through the legislative process.
For the record: I am *NOT* a libertarian. I have no use for libertarian ideology. It is naive and completely unworkable.
It just seems to me that the solution to criminal problems (and theft on this scale is clearly a criminal problem) is dull, ordinary police-work. It's very effective, but it takes time and resources and it does not generate a ton of publicity when the politicians need to be seen doing something about an issue they simply do not understand.
I do wonder if there would have been the political will to authorize an investigation and infiltrate the likes of Enron and Worldcom when their stocks were still going up? Would the public have been in favour of hauling Lay and Ebbers off to jail when their own investments were still doing great?
I would like to thing so, but somehow I doubt it...
*** Where are we going? And what's with this handbasket?