The Rise Of Corporate Identity Fraud

from the expect-to-see-more-and-more... dept

A few years ago, we wrote about the odd (and somewhat amusing) case of a group of fraudsters in China who didn't just build knockoff NEC products, but created an entirely fake version of NEC in China. Yes, they set themselves up as if they were a legitimate division of NEC, but had nothing to do with the company (other than producing knockoff NEC gear). That was corporate identity fraud taken to an extreme level, but it seems like others are starting to jump into corporate identify fraud in a way quite similar to personal identify fraud. Michael Scott points us to a story about some scammers in West Virginia who took on the identity of various vendors to the state, and were able to scam $2 million out of the state before the scam was exposed. While the article calls this a "rare" occurrence, I'd be willing to bet that it's going to become a lot more common. For scammers looking for a big score, taking on a corporate identity rather than an individual's seems likely to get you into higher dollar amounts much more quickly...

3 Comments | Leave a Comment..

Imitate Someone On Craigslist, Get Arrested For Identity Fraud

from the just-a-warning... dept

A bunch of folks have been sending in the news of a woman who, after a fight with her boyfriend, posted a note on Craigslist posing as him, asking men to call his office number and "talk dirty." She's now been charged with a felony for identity fraud. At least (unlike some) no one's blaming Craigslist for this one...

13 Comments | Leave a Comment..

Low-Tech Methods Get The Blame For Most Identity Fraud

from the methodology dept

A new research study says that identity fraud rose 22 percent in 2008 from the previous year, blaming lost or stolen wallets, not data breaches, for the majority of incidents. It's important to note the terminology here: the group that conducted the research considers identity fraud -- when stolen information is actually used for financial gain -- as distinct from identity theft, which is simply when identity information is stolen. It stands to reason, then, that the occurrence of identity theft is actually far higher. Also, the numbers on how criminals obtained the information may be slightly skewed. Respondents to the survey were asked if they knew how their information was stolen, and only 35% responded that they did. Of that 35%, only 22% said it was stolen online or via a data leak. Again, it stands to reason that people whose information was stolen because their wallet was lifted or lost, or via some other noticeable method, would be more aware of it than if, say, a retailer gave up their credit card number or other info. Also, is it helpful to consider a pickpocket using a stolen credit card to be analogous to a massive data breach? While the end result might be similar for affected consumers, the method of the crime, as well as the reasons why it was allowed to happen, are very, very different. To equate pickpocketing to data breaches runs the risk of underemphasizing the risk that slack corporate or governmental security poses to large numbers of people. Gee, that doesn't sound familiar, does it?

Carlo Longino is an expert at the Insight Community. To get insight and analysis from Carlo Longino and other experts on challenges your company faces, click here.

6 Comments | Leave a Comment..

Is Selling Counterfeit Software Worse Than Bank And Identity Fraud?

from the equivalencies dept

There's a story making the rounds about a guy who's apparently going to jail for selling unauthorized copies of software on eBay, and the software industry is trumpeting what a huge victory this is over "counterfeiting," by claiming: "The Mondello case demonstrates that these pirates won't simply get a slap on the wrist when caught. They very well may end up doing serious time in federal prison." Right, but if you read the details, the conviction wasn't just for copyright infringement, but for identity fraud and mail fraud. That is, as part of his operation, he illegally obtained peoples' bank account info. That would appear to be a lot worse than copyright infringement, but the press seems to focus only on the "counterfeiting" angle, because that's the story the software industry association seems to be feeding the press. They want people to think that they'll go to jail for piracy, when that's quite unlikely.

12 Comments | Leave a Comment..

US Gov't: Do Not Carry Your Social Security Number; US Gov't: You Must Carry Your Social Security Number

from the mixed-messages dept

The classic concept of how to force someone to think for themselves rather than mindlessly obey authority is to have two equally powerful authority figures demand that the individual do the completely opposite actions (an example: having two top generals on either side of a low ranking soldier, one demanding he sit down, and the other demanding he stand). Somehow, though, I doubt that's the reasoning behind conflicting messages coming from the US government concerning whether or not you should carry your social security number on you. Jim Harper points us to the fact that the Federal Trade Commission has suggested it's not wise for American citizens to carry their social security number with them in their wallet -- yet other government agencies seem to require it.

Medicare and the Defense Department each issue cards with the person's SSN included. Medicare seems particularly conflicted about the whole thing. It refuses to get rid of cards with SSNs, saying that "it would be too expensive." Instead, in order to deal with the risk of identity theft over this issue, it suggests that you only carry the card with you when you think you might need it: "don't carry it with you unless you know you're going to need it." In other words, always make sure to properly predict that heart attack or stroke ahead of time so you know to carry the card with you. Of course, Medicare also publishes a conflicting pamphlet that reminds people: "Carry your card with you when you are away from home." Mixed messages indeed.

Then, of course, the FTC also recommends that you not write your social security on any check, as that's an easy way for ID thefts to get a hold of it. Of course, on the other side, you have the IRS, who asks taxpayers to write their social security number on the checks you send in. So will the FTC now go after Medicare, the Defense Department and the IRS for helping to cause identity theft? Somehow I doubt it.

27 Comments | Leave a Comment..

Is A Fake Facebook Profile Illegal?

from the down-in-the-legal-weeds dept

Remember the guy who was arrested and sent to jail for creating a fake Facebook profile of a Moroccan prince? While it's unlikely that anyone will land in jail, more such disputes have been ending up in the courtroom. It seems to be most popular in high schools, where teachers and administrators are suing students for setting up fake profiles of them. It's not difficult to see why these adults are upset -- as the profiles are usually quite unflattering. But, it's an open question as to whether or not the profiles are illegal. Even more to the point, Facebook has a clear policy that it will delete fake profiles when it becomes aware of them, so it seems like quite a bit of overkill for teachers to sue students rather than just having Facebook take down the profiles.

61 Comments | Leave a Comment..

Forget Credit Cards, Scammers Now Want Your VoIP Accounts?

from the worth-more-money dept

Last month, we pointed out that the market for stolen credit card data was so saturated that prices were falling. Of course, that just inspired scammers to go looking for other types of data that was a bit harder to find: VoIP accounts. According to the BBC, scammers selling VoIP account info are now able to get higher prices than those selling credit card data. Of course, it's not at all clear how widespread this really is. The info seems to be coming from a company trying to sell a solution to deal with this -- which already makes it somewhat suspect. Also, you have to wonder how valuable VoIP account data really can be compared to credit card numbers which have much wider applicability. Either way, it will be interesting to see how the market deals with the "glut" of credit card data out there, and where else data scammers turn.

5 Comments | Leave a Comment..

Will Lifelock's CEO Get To Be A Part Of The Class Action Lawsuit Against Lifelock?

from the he-could-qualify dept

You may recall the story of Lifelock, the company that heavily advertises its service which charges you $10/month to get services that you can get on your own for free from credit agencies. This is the one where the CEO gives out his Social Security number in every advertisement to show how confident he is in the service. Of course, what he leaves out is that Lifelock failed to stop identity fraud carried out against him (oops). Oh yeah, also the stuff about how the company's founder was being investigated for fraud (and potential identity fraud) at a previous company.

So, it should come as little surprise that some customers of Lifelock aren't particularly pleased with the company and have filed a class action lawsuit against the company, claiming deceptive advertising, and noting that it doesn't really provide much security. One additional nugget of information: the identity fraud against the CEO that we mentioned earlier is just the tip of the iceberg. The CEO's social security number is apparently now widely in use among identity scammers. Well, maybe he'll get some money out of the class action lawsuit, since it appears that he was misled by his own advertising...

32 Comments | Leave a Comment..

Companies To Be Held Liable For Selling To Online Criminals

from the seems-a-bit-extreme dept

One of the reasons why various safe harbor rules exist is to protect parties who really have nothing to do with any kind of law breaking from being liable for the activities of others. Thus, we don't blame an ISP for the activities of one of its users, even if that user breaks the law. That's both reasonable and fair. Those who want to blame those providers often do so just because it's easier -- or, more commonly, because they somehow think it's better for that service provider to somehow act in the role of the police to make things easier. Something similar seems to be happening with the FTC placing the onus on small businesses to make sure they don't sell to online criminals. Slashdot points us to the news that, starting November 1st, all companies are supposed to compare customer info with a "red flag" list of online identity fraudsters and money launderers. Firms that fail to check may be liable if they end up doing business with "known" criminals. You can understand the reasoning here. It certainly makes it a lot easier for the FTC to try to crack down on these crimes. But it adds significant expense and liability to small businesses for potential crimes in which they were totally uninvolved.

14 Comments | Leave a Comment..

Stolen Data So Plentiful, The Market For It Has Collapsed

from the valid-credit-cards?-sorry,-don't-need-any-more dept

There are so many data leaks these days that it's hardly even newsworthy every time some company reveals your social security number and credit card. However, would you believe that it's also impacting the economics for fraudsters? Matt Bennett alerts us to the news that the price of fraudulently obtained data is falling through the floor thanks to the glut of it on the market. There are so many collections of credit cards or bank account numbers that the crooks who are buying them are buying them in bigger batches at greatly deflated prices. By the way, the falling dollar has impacted this as well: European identity data is worth a lot more than American identity data. So, I guess there's that to be thankful for.

25 Comments | Leave a Comment..

Moroccan Man Pardoned For Fake Facebook Profile

from the took-'em-long-enough dept

Last month, a Moroccan man was sentenced to three years in jail just because he set up a fake profile of a Moroccan prince in Facebook. These sorts of fake profiles are quite common, and it didn't appear that the profile did anything defamatory. However, the guy was still charged with identity fraud. That seems extreme. If the Moroccan royal family was upset about the profile, why not just ask Facebook to take it down? If the fake profile was defamatory, sue the guy for defamation. Charging him with identity fraud and giving him three years in jail was clearly overkill. The international response to this event apparently caught the attention of the royal family, and the king has pardoned the guy in question, releasing him from jail after just a few weeks. However, the fact that he had to go to jail at all still is worrisome.

14 Comments | Leave a Comment..

Stealing Credit From A Baby

from the growing-concerns dept

With more publicity talking about identity fraud, and more people checking to make sure they haven't been victims of identity fraud scams, apparently the type of identity fraud that's on the rise is taking social security numbers from kids. It's still a small part of the total identity fraud problem, and it's not so much an online phenomenon as most cases involve family members, but it's much more problematic, as it's often not identified until many years later when the kid actually applies for a credit card. For all the data that the big credit firms keep on people, you would think they'd have something about a person's age.

14 Comments | Leave a Comment..

Man Gets 3 Years In Jail For Fake Facebook Profile

from the fraud-or-fun? dept

Earlier this month, we pointed to the case of a Moroccan computer engineer who was arrested, supposedly for "stealing" the Moroccan prince's profile on Facebook. As we noted in the post, the original details weren't clear on whether the guy had somehow gained control over the prince's actual Facebook page (which seemed unlikely) or if he'd just set up a fake profile. Further details revealed, indeed, that the guy had merely set up a fake profile of the prince for fun. Given how common fake profiles of celebrities are on Facebook, it seems rather ridiculous to consider that being akin to identity fraud. Apparently, however, the judicial system in Morocco feels differently. The guy in question has now been sentenced to three years in jail. This seems ridiculously excessive, especially since it doesn't sound like the fake profile was negative in anyway. The guy, Fouad Mourtada, claims to be a fan of the prince who just saw the opportunity to have a bit of fun in setting up a profile for him. It's difficult to see how any court with any sense of reason could consider that to be the equivalent of identity fraud.

42 Comments | Leave a Comment..

Forget Identity Fraud, What About Facebook Identity Fraud?

from the the-next-problem? dept

There have been plenty of stories over the past few years concerning the problems associated with identity fraud -- but with more and more of an individual's "identity" moving online, it was only a matter of time until the problems of identity fraud moved online in a more complete way (beyond just accessing the data and buying things as someone else). For example, Moroccan authorities have arrested a guy for identity fraud in taking over a Morrocan prince's identity on Facebook. The details aren't clear (at all). It could be just that this guy set up an account pretending to be the prince, or he could have accessed the prince's actual site, somehow (though, the article does suggest that the prince doesn't have much of a real presence). This raises some interesting questions. If you're simply creating a profile of a real person and acting as that person -- is that identity fraud?

17 Comments | Leave a Comment..

Identity Fraud Victims May Soon Be Able To Sue For Time Spent Getting Their Identity Back

from the recognizing-the-pain dept

One of the biggest problems with scammers taking your ID is that the victims are the ones who have to spend all the time and money cleaning up their credit record and dealing with the fallout of the fraud with little recourse. A new bill that's going through the Senate aims to at least allow identity fraud victims to sue the scammers for the time and effort it takes to repair their lives. Of course, that depends on them figuring out who the scammer was, which isn't always easy. This certainly seems reasonable given the burden placed on the victims of such scams, but it won't lessen the pain in dealing with credit agencies who all to often don't seem particularly willing to help in the aftermath of identity fraud.

23 Comments | Leave a Comment..