Identity Theft Skeptic Ends Up As Fraud Victim

An anonymous reader writes "British TV host Jeremy Clarkson recently wrote a newspaper editorial ridiculing the uproar that had occurred after the British government admitted to losing two compact discs containing the personal information on 25 million people. To support his claim about the overhyped risks of identity theft, he published his bank account information in the article. Proving that some identity thieves have a sense of humor, a week later, he found out that someone had set up an automatic bank transfer for $1000 to a diabetes charity from his account. This comes less than a year after the CEO of LifeLock, an identity theft protection company which publishes the CEO's social security number on its website, himself was a victim of financial fraud. Back in July of 2007, a man in Texas was able to secure a $500 loan from a payday loan company using the CEO's widely publicized SSN. Will this latest incident finally prove that identity theft is real, and that publishing your own financial info is an invitation for fraud?"

Comments

If you give it away

[Bongo Bill]

If you give personal information away freely, is it really accurate to call taking it theft?

Of course, what defrauders do with it might constitute stealing. But that's less "identity theft" and more "money theft" if you ask me.

Re:If you give it away

[Billosaur]

Well, giving away the information for free doesn't make it a crime for you to possess the information. If you then use it, claiming you are a person you are not, that's fraud and illegal in most jurisdictions.

Re:If you give it away

[Jhon]

When I freely publish my business name and address in the phonebook, is it really accurate to call it theft when someone breaks in to my store and steals my stuff? Granted, it's not the same thing, but to publish your personal information does not give someone the right or permission to use that information for fraud any more than publishing my business address gives someone the right or permission to commit B&E.

With regards to "identity theft" vs "money theft", the end result is usually the theft of money. The label of "identity theft" basically describes HOW the theft took place...

Re:If you give it away

[Hognoxious]

If you then use it, claiming you are a person you are not, that's fraud and illegal in most jurisdictions.

And any bank and its imbecile staff that allows you to pretend to be someone you aren't because they can't be arsed to properly check[1] should be liable for the loss themselves.

Before anyone claims that giving his bank account number out was irresponsible - it's printed on the bottom of your cheques.

[1] Even if more than one person can have the same name, it should be easier than normal in this case.

He had it coming...

[Red Samurai]

That was a pretty arrogant move, even for his standards, and I'm sure he's be humbled (somewhat) after being taken down a peg. I guess that's the price you pay for overconfidence.

Re:He had it coming...

[Laurence0]

Oh, very much so. I think it's /because/ he's an arsehole that he's so funny.

Clarkson...

[Anonymous Coward]

Clarkson is the famous tv presenter on Top Gear. He is known for being a pisstaker and joke artist. Calling him a identity theft skeptic is making this sound far too serious. The joke is on slashdot.

News?

[ynososiduts]

I understand how this is funny, but if someone publicly gives out there information in a way to draw attention from the press of course someone is going to do something. It's funny, it's non-news for nerds, and it doesn't matter.

Re:News?

[syousef]

Okay this article mentions:
1) Identity theft
2) A celebrity who holds extreme views on a wide range of topics of interest to nerds, from the environment to computers and identiity theft.
3) The celebrity has changed his mind on the topic after being proven wrong by a very cheeky identity thief.
4) That celebrity presents a show that does interest nerds. (Not just the cars either. One episode showed a car being blown off the tarmac by a 747's engine thrust).

How is this not news? How is this not interesting?

Yet a comment like yours gets modded as insightful instead of -1:troll. More proof that /. comment moderation is badly broken. Burn Karma! Burn!

Privacy Amendment

[Doc Ruby]

The US Constitution needs a Privacy Amendment specifying that people's right to privacy in our personal data shall be protected, that no one has the right to copy any such data except as necessary to complete the immediate transaction for which it was transmitted by that person, except under explicit permission from that person.

The 4th Amendment already makes explicit the right to such privacy, but it clearly isn't enough anymore - not for a long time. But since the 4th Amendment itself was merely an emphasis of a right already implicit in the Constitution, but worth repeating explicitly to ensure government protection of it (like the rest of the Bill of Rights), it's perfectly appropriate to reiterate it in terms easily enforceable in the current era, like copyright terms.

Re:Privacy Amendment

[Doc Ruby]

I hear this all the time, usually from Anonymous Cowards too scared to say something so anti-American in public. So I always rebut it, because I understand America, rights and government.

America is built on the simple, but radical (for the 1780s, anyway) realization that people have rights, create governments to protect those rights, so when we create them, we must create them with powers to protect them, but not to abuse them. We have a right to privacy, as the 4th Amendment says. The government exists to protect it,

Or are you going to tell me that, say, the 13th Amendment banning slavery limits only the government from owning slaves? No, freedom is a right. Rights are inalienable, not just "inalienable by the government".

Re:Privacy Amendment

[Doc Ruby]

No, it explicitly mentions the right to be secure in their persons, papers and effects. Those rights aren't "established" except insofar as they're identified, which they are here. Then the government that we created to protect our rights is instructed to protect that right. That's how rights, and the government, actually works.

How??

[jackjeff]

How in hell is this possible?

Isn't your bank the only institution able to transfer money out of your account? Don't you have to show your ID? Don't you have to sign some documents???

My opinion is ID theft is only possible because the clerks in the banks are too lazy to check for an ID or a signature. Whenever you go to a bar in the US, they will look at your ID before they serve booze, but if you set up a $xxxx account/load no one will ever check it. This is just how ridiculous the system is. Account number without proof of identity should be as useless as a car without gas.

Re:How??

[gstoddart]

Isn't your bank the only institution able to transfer money out of your account? Don't you have to show your ID? Don't you have to sign some documents???

No, you can sign a form with a company allowing them access to your account.

I've done this with my insurance company for years. However, I won't let anyone else do it because I've heard too many stories of the company messing up and taking too much money too often or what have you. I don't remember the particulars, but I don't think I had to involve my bank in setting it up.

I get asked to do it fairly often because companies like to sell it as a "convenient" method of billing -- directly taking money from my account isn't what I call convenient. It's convenient for them, but it's not happening.

My opinion is ID theft is only possible because the clerks in the banks are too lazy to check for an ID or a signature.

Well, the guy in the article had a similar opinion. I would say unless you really know every possible way this can happen, your blanket statement is probably no more valid than his was.

I have no idea if the bank was the way this happened, or another mechanism was at play. Either way, I'm not gonna stop shredding my bank statements and otherwise keeping this stuff private. Because, quite frankly, I don't know enough about how to commit fraud other than to do what I can to make sure nobody ever sees it in the first place.

I'm certainly not willing to bet that mis-handling at the bank is the only way this can happen.

Cheers

Hoist on his own petard

[whitehatlurker]

Clarkson now says of the case: "Contrary to what I said at the time, we must go after the idiots who lost the discs and stick cocktail sticks in their eyes until they beg for mercy."

I wonder if he poked sticks into his own eyes ... after all, he did exactly the same thing, the only exception being that he did it to himself, rather than to others.

I can only hope he continues to contribute to the charity so he can stay humble.

Strangely

[Billosaur]

I still hear the LifeLock commercials on the radio as I drive to work all the time. I don't see how they can prevent someone from stealing your identity, especially if you're dumb enough to give out the information to people who will use it for nefarious purposes. If all there offering is a service to undo the damage, that might be useful given how time-consuming it is, but then can they necessarily represent you to organizations where you need the information changed or charges nullified?

available information vs. foot in mouth

[MyNymWasTaken]

The information he gave out was the same information a person gives out when they hand over a check. It's analogous to a pundit loudly proclaiming that it is perfectly safe to walk around outside. This is then demonstrated by walking through a large crowd of people. Somebody decides to prove otherwise & stabs them in a non-lethal manner solely to illustrate the point.

Sheesh

[Anonymous Coward]

It's funny, it's non-news for nerds, and it doesn't matter.

Every SINGLE article has some troll saying that the article doesn't belong on slashdot, and subtly insulting the readers for being interested in it.

Identity theft is a HUGE problem, and it also happens to be one in which many geeks are keenly interested. This particular story is interesting not only because it is identity theft related, but because it indicates that the public eye is being more drawn to the issue, and being forced to realize the seriousness of it.

The story matters. The story is definitely news for nerds. Just because YOU find it boring doesn't mean that it doesn't qualify as a significant slashdot story.

Yes, I realize that I just fed a very self-absorbed troll. All apologies.

How Many Different Ways....

[mpapet]

Can this topic come up and not a single person asks ANY of the following questions:

1. I get someone elses ssn, and I'm off to the bank. (or whatever) Why is the process that associates a unique identifier (U.S. = SSN) with financial activity so simple?

2. Why does "sucks to be you" suffice every single time this issue comes up?

3. While individual financial data is available to the financial institutions, it's totally opaque to the consumer. Ex. how is my credit score calculated? How come consumers have practically no control over it?

4. The risks of an easy credit system far outweigh the benefits and yet no one seems to acknowledge this. An indirect example of this is the bad packaged loans that are driving the current "credit crunch."

Transparency is the keystone to a healthy economy and yet there's less and less with each passing year.

Wrong Focus

[Anonymous Coward]

The report here should not be that some person had their identity stolen.
The report should be that some dumb bank transferred funds without checking identity.

The sooner we put the right focus on this problem, the better. It shouldn't be called identity theft. It should be called bank malfeasance.

When somebody walks into Citi bank and tells the teller my name, the teller shouldn't hand all my cash over to that person. That isn't identity theft; it is complete incompitence, or worse, collusion.

Don't report the name of the person whose account was abused. Report the name of the bank, and the name of the employee that allowed it. Put the focus where it belongs on these crimes. And in the case of this high profile personality, at least report that he has decided that Bank XYZ is completely incompetent and has moved his account to Bank ABC (complete with new bank account #).

Banks and businesses should take the heat

[amadeus733]

If someone steals money from my account it is totally up to bank to deal with it, I usually don't care and in only one occasion when something happened I got my money back in hours. Law should put all responsibility in these cases on thieves and companies who failed to verify identity. If companies and financial institutions would be held responsible for not validating customer's identities properly I guess identity fraud cases will drop dramatically. If they afraid to make few extra checks in fear of losing few customers why would others suffer? My grandmother used to say "Trusting people is just a romantic stupidity".

Re:Banks and businesses should take the heat

[amadeus733]

No it is not my responsibility to keep my financial or any other details private. I don't think this details are _private_ or _secret_ in first place, and in fact they are not. You give SSN to your employer, checks to your landlord address to a website when you order books. All of that information was NEVER MEANT TO BE SECRET. It is clearly in corporate interests to convince people that keeping this data secret is their (customer's) responsibility - they can do more business faster this way. Only reason it works is that many corporations rely on data provided by agencies like Equifax. Credit agencies do not require company to provide solid proof of identity in case of non-payment, where for example for criminal cases identity of the offender taken very seriously. Take an example - someone used your when buying a gun and kills someone with it. Perhaps you will be questioned, but you won't spend time in jail in this case right, you wouldn't even care because it is police responsibility to prove your guilt in this case, right? Now if I am your bank and I send a report to credit agency - everyone suddenly believe that that was you who did not pay those $5000 from credit card. No one will bother to clear your name if that was not you. You see where problem is? Problem is that corporations built a world wide SYSTEM of financial institutions and corporations where interests and right of consumer like you are me simply IGNORED as soon as they can profit on us.

Re:I thought security through obscurity was baaaaa

[multisync]

Most of you have scoffed for years at anyone using security-through-obscurity in any security model at any level, yet by making fun of people who have been exploited for revealing account information in public you are clearly upholding the principle

Not revealing your social security number isn't "security through obscurity" any more than not leaving the combination of the safe on a post-it note stuck to the safe door is.

An example of "security through obscurity" would be "nobody knows about this money I have hidden in my sock drawer, so it must be safe."

Gee, did I just fall for a troll?

Information != ID

[davburns]

I think this is possible only because people confuse information about an identity with that identity, and therefore believe that knowledge of that information proves that the person is who they say they are.

I think there's way too many people and organizations with legitimate access to all kinds of information about me for me to consider that my SSN (or an account number that's printed on every statement that goes through the mail, or 16+4+3 digits on a credit card) is a good shared secret between me and my bank (or employer, or anyone.) Then, there's all the people who have illegitimate access.

We still use this because... it works "well enough." Banks make enough that they can cover the loss from a few fraudulent loans. And a person having to clean up a credit record is a PITA, but it's doable. And it's an externality from the bank's perspective.

Thinking about this, I don't have a real solution. It's advisable to guard your psudo-secrets, when you can. A law or two to help this might help, but not get rid of the problem. Until someone comes up with a good identifier[1], we're stuck with it.

[1] For values of "good identifier" that include a way that one person can prove they are the same person who established the good credit / made the bank deposit / whatever, including letting someone act as a limited agent of another (so the power company can take my electricity bill out of my account, but not let a rogue employee take all my money and buy Enron stock) and also doesn't let someone establish multiple identities with which to keep ripping off banks and others.

Re:They didn't have a lot of choices...

[AigariusDebian]

Well, doh!

It is absurd that a bank allows anyone access to you money without a piece of paper with your authorized signature verified in a presence of a bank official and cross-checked with you passport. Either that or the same level of security on the internet bank - use you standard two-factor authentication to log in, enter a code from you service provider, verify that the code matches up with the company that you want to pay to, set a monthly limit, confirm that with a one-time password and off you go: secure direct debit.

It is absurd that such basic information as your name, bank account number, social security number and such can actually be used to harm you in any way shape or form. It simply shows the fatal immaturity of the banking system.

i think you miss the point...

[Anonymous Coward]

let's imagine grandma is actually 'sister,' and is 34 instead of 94. and she wants to buy a house. she applies for pre-approval loan when she is getting serious, and it is denied because of her extremely scary credit. "What!!" She says.. she thought she had perfect credit.. she pays her bills on time, etc.

But in the last six months, someone who obtained her vital info took out several credit cards in her name and ran them to the limit, took out a few paycheck cash advance loans, etc. Maybe they even sold her info to some other people, who brokered it to illegal aliens to use as a proxy identity so they could work in a factory somewhere as "legals." So now she has a dozen credit cards in her name, all maxed out. A couple cash advance places who've sent her to collections. A letter from the IRS asking her to please mail a check for the $2900 in taxes she owes them.. etc. If sister EVER wants to purchase a house, or do anything that at all involves her credit, this has BECOME her problem, not just the problem of some "dumb entity" that lent the wrong person money. In some extreme instance, she might even be sued, have to get a lawyer, etc. LOTS of time (literally.. years) wasted to clear all this up, and lots of money spent, so she can eventually.. maybe.. get back to the life that went on hold once her credit was ruined by spurious info.

This is made up, but it's close to several real life instances I've read about.. instances that are quite typical.

He's a twat but...

[Fuzzypig]

I hate Clarkson. I think he's a complete twat, but having a said that he does have the guts to admit he made a complete prick of himself in public. Some other public figures might do well to follow that lead if nothing else.