Slashdot Mirror
Glut In Stolen Identities Forces Price Cut
CowboyRobot writes "The price of a stolen identity has dropped as much as 37 percent in the cybercrime underground: to $25 for a U.S. identity, and $40 for an overseas identity. For $300 or less, you can acquire credentials for a bank account with a balance of $70,000 to $150,000, and $400 is all it takes to get a rival or targeted business knocked offline with a distributed denial-of-service (DDoS)-for-hire attack. Meanwhile, ID theft and bank account credentials are getting cheaper because there is just so much inventory (a.k.a. stolen personal information) out there. Bots are cheap, too: 1,000 bots go for $20, and 15,000, for $250."
Seriously! If you even suspect that the machine you're working from has ben compromised by malware, CHANGE YOUR PASSWORD to the accounts you've used via a known clean computer. Then proceed to nuke the drive from orbit and reload the OS and apps. Botnets are known sources of dropping key loggers and harvesting user data to a central database.
Life is not for the lazy.
Purchasing $150,000 for $400 (vary currency as necessary) would seem to be a loophole that would quickly undermine the world economy. Perhaps "price" of a stolen identity isn't a proper measure of "value".
So, if I'm to follow the reasoning of this article, if we all use weak passwords , the market gets flooded and they all go out of buisness?
SWEET
password:password, here I come!
I'd like to cut out the middle man and sell my Identity.
40 bucks buys a few cases of beer - just sayin...
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
'Identity theft' should be recognized for what it really is, bank fraud.
First the crooks defraud the banks by performing transactions in someone else's name. This is aided by the banks insistence on not implementing secure authentication.
Then the banks defraud you by insisting that you are responsible for the transactions in spite of not having a single shred of evidence that you made them.
The credit agencies compound it by repeating the bank's financial gossip with a wanton disregard for the truth.
The 'justice system' then aids and abets by not telling the banks to pound sand and by not convicting the credit agencies for libel./p.
Too late, I have had private insurance for years.
Learn to love Alaska
Here, take my identity, please!
You get to assume a recent bankruptcy, a child support obligation, a spotty employment record, a sub-500 credit score, three maxed-out credit cards, a beater car, and a psychotic ex-wife.
Clean arrest record and a good tech education, though. Maybe you could apply to a NSA contractor.
The 'victim' or 'identity theft' certainly isn't the culprit. The banks COULD take a photo of the person when they sign up and issue them a smart card with a unique key pair. They could check to see if you answer the home phone and give them an agreed upon code word to verify that you really live there. They could insist on mailing the smart card to your current address (but not activate it until you call them with the a code word and read off a unique serial number).
The point is that it's on them, to verify the identity of people they hand out money to. They are the only ones with any ability to control the process. I cannot even know if a fraudster talks to a bank I have never heard of, much less control the outcome. They have no right to make their problem into my problem. If they don't want to do any of those things, that's fine too as long as they are willing to eat the losses.
Unless there's a law requiring the banks to accept a gas bill or a poor quality photo ID, it's still on them because it's their policy that is causing them trouble.
Reminds me of the time my brother had his wallet stolen. When I asked him if he cancelled his credit card, he said "Hell no! The thieves are spending less than my wife usually does".
It's time to get the government out of the identity theft business, as it is clearly wildly distorting the market.
No kidding!!! What do you say at this point?
Don't you know private industry is the epitome of security and efficiency? That's why the private sector is never plagued by budget overruns or mismanagement.
Why do you hate America, you filthy communist?
There is no requirement to carry identity cards in the UK or the US. Ration cards were used as a national identity card during the second world war. My grandfather committed an act of civil disobedience when he was stopped for speeding after the war. He refused to show his ration card because the war was over. His act of civil disobedience was debated in parliament and is one of the reasons why there are no national identity cards in the UK. British Identity Cards: Arguments For and Against their Retention and Use 1945-1952 Doesn't mention my grandfather but does provide a good overview of the postwar debate about national identity cards.
Calling for something to be a capital crime should be a capital crime.
O shi-
It's interesting for what it implies:
Stealing personal data is easy and cheap. Cashing out certainly isn't, and is where banks' "defence in depth" security strategy pays off.
It should be easy enough for someone here to harvest phonebook or other records from 70 years ago, refresh and randomize birth dates, and begin to flood the identity theft market with fake personalities and random government identity records. That would greatly increase the amount of work for identity thieves, who actually benefit from passwords (which provide evidence it's bonafide identity they are stealing). For years I've promoted "camouflage" rather than invisibility. I now think the reason it has not taken off (disappearance of AntiPhorm?) is that it's equally a threat to Google, Bing, and advertising-based search engines. We can be less careful of our "identity needles" if we construct bigger "digital haystacks".
See article on digital haystacks and cookie camouflage http://retroworks.blogspot.com/2010/09/simpler-ideas-cookie-camouflage-digital.html
Oh, by the way, I'm not really Retroworks. I find I get higher mods if I steal a /. identity rather than to submit AC
Gently reply
"The price of a stolen identity has dropped [...] to $25 for a U.S identity [...]"
Seems pretty clear.
Ahhh but then, how many botnets could you get for 70k-150k?
"I opened my eyes, and everything went dark again"
Why would I, I never had any dealings with John Doe at all. I am not the one demanding money, why should the burden of proof fall to me?
It's the bank that had unfortunate dealings with Mr. Doe and rather carelessly handed him a wad of cash without knowing who he was.
If they want any money from me, it's up to them to prove I owe it to them. And I don't mean a piece of paper with an illegible scrawl anyone could have made, I mean actual proof. A picture of me (that actually looks like me) holding the paper and smiling might help, but given the reputation of banks (they have, after all, a history of foreclosing on homes they don't hold a loan on and many other acts of fraud) and the existence of photoshop, it wouldn't constitute absolute proof.
At one time, banks were quite careful to avoid even the tiniest hint of impropriety and deserved a reputation for honesty so strong that often enough their word was nearly proof in itself. That day is long gone and they have well and thoroughly squandered their reputation (along with a great deal of other people's money).
It's not a matter of race, it's a matter of demographic. That is, adding just a bit more hassle for some demographic or another that tends to vote against your party. For example, if the elderly tend to vote against you, you insist that a presented ID be current. Easy enough (practically automatic) until you reach an age where you don't drive anymore.