Monday, April 7, 2008

Stay on guard: Identity theft can happen to anyone

By By Kathy Aney
The East Oregonian

Erica Sandoval knows firsthand that just about anyone is vulnerable to identity theft. Sandoval of the Hermiston Police Department trains the public about how to thwart criminals as the department's crime prevention officer. But being an expert in crime prevention and criminal behavior didn't save her from becoming a victim.

One day, Sandoval noticed a couple of strange withdrawals on her bank statement. "The first was a $12 charge from a make-believe company," she said.A subsequent charge increased the damages to $210 before she noticed the withdrawals. "They were quick about it - both withdrawals happened within a week's time," she said. "I can only imagine, if I hadn't caught it, it would have continued."

Sandoval was savvy enough to monitor her statements closely and alert her financial institution. She caught the fraud quickly and her bank replaced the cash. But sometimes it doesn't work out that way. If a thief gets ahold of your personal information, they can rack up huge bills that can become your responsibility and threaten your credit rating.

Identity theft comes in many forms. Shoulder surfing, skimming, phishing and dumpster diving - they are some of the myriad ways identity thieves separate you from your hard-earned cash. Shoulder surfing happens when someone looks over your shoulder to see your personal identification number as you type it in at an ATM. Skimmers use electronic devices that record data from the magnetic strip when a person swipes their debit or credit card and transmit the information to another location where it is re-encoded onto fraudulently made credit cards. Dumpster divers rummage through trash looking for bank and credit card statements and pre-approved credit card offers. Phishing is posing as a bank or other business and requesting personal information such as one's date of birth or social security number. E-mails sometimes direct the person to a certain Web site that has no connection with the business but looks genuine.

Identity theft, however, isn't limited to the old favorites. The manager of a Subway restaurant in St. Helens recently was charged with 40 counts of identity theft when she allegedly stole employment applications from Subway and gave them to a man accused of stealing identities. Sandoval said the Hermiston Police Department sees plenty of identity theft, mostly in the form of check fraud. Thieves sometimes cruise mailboxes, stealing checks and altering them using a technique called check washing. "They're able to wash the written ink down to where they can write over it," she said. "They can write it out to whomever and for whatever amount they want. "The check thieves sometimes are fairly brazen. "They'll go to merchants who don't routinely ask for identification and write checks," said Rita Rosenberg, vice president of operations at Pendleton's Columbia River Bank. Sometimes they even make checks out to themselves and deposit them into their personal accounts.

Sandoval and Rosenberg both urged people with public mailboxes to use extra caution. "You can have checks mailed to your financial institution and pick them up there," she said. People can make it tougher for thieves by having only the minimum information printed on checks. There's no need, Rosenberg said, to have driver's license numbers or social security numbers on checks. "Make the merchant ask for your driver's license number," she said. Don Daggett, senior vice president at Banner Bank in Hermiston, admonished against keeping Personal Identification Numbers (PINs) in wallets or next to your computer at home. "Don't keep your PIN number on a sticky note on your computer or written on your blotter or tucked under your keyboard," he said.

All three experts recommended careful monitoring of checking accounts, keeping PINs to oneself and checking credit reports. Prevention, they agreed, is preferable to cleaning up the damage later. "It takes a person at least - at the minimum - 30 hours to clean up the smallest identity theft," Sandoval said. Large ones can take months of forms, telephone calls and hair pulling. HPD's Web site has a downloadable "Identity Theft Victim's Packet" with forms to fill out and advice about who to call and things to do, such as closing accounts. It also advises what documents to gather in order to start an investigation.

Sandoval's fraudulent debit card charge is a fairly common type of identity theft and usually involves a small electronic charge followed by a larger hit. Often, it happens fast, but not always. "Sometimes they'll wait four or five months before they make their next move," Rosenberg said. If you notice something amiss, Rosenberg said, do what Sandoval did. "When you see that first small charge go through, cancel your card and let your financial institution know. "If you do find yourself the victim of identity theft, you can take a certain amount of solace in knowing you aren't alone. Consumer Sentinel, which tracks identity theft for the Federal Trade Commission, received more than 800,000 fraud complaints in 2007 and 32 percent of those were identity theft complaints. The majority of the complaints involved credit cards and most involved electronic funds transfers. Metropolitan areas reported a higher rate of identity theft activity with Napa, Calif.; Madera, Calif.; and Greeley, Colo.; with the highest rates per capita.

Saturday, April 5, 2008

Identity Theft Leads to Child-Porn Arrest Nightmare

By Marc Sigsworth

With ID fraud on the rise, the assumption is you'll lose money which can be claimed back. But Simon Bunce lost his job, and his father cut off contact, when he was arrested after an ID fraudster used his credit card details on a child porn website.

Simon Bunce used to be a keen internet shopper, delighted to escape the hordes and have goods delivered to his door. Wary of fly-by-night operators, he bought only from big name retailers with secure websites. But then, four years ago, he was astonished to find himself embroiled in Operation Ore, the UK's largest ever police hunt against internet paedophiles. He was arrested on suspicion of possession of indecent images of children, downloading indecent images of children and incitement to distribute indecent images of children. Hampshire Police took away his computer and data storage devices including flash drives, CDs and floppy disks, as well as examining the computer and storage devices that he used at work.

The effect was devastating. When his employers became aware of the reason he had been arrested, he was abruptly dismissed from his £120,000 a year job, and close members of his family disowned him. "I made the mistake of telling my father, and he cut me off," Mr Bunce says. "He then told all my siblings and they also cut us off." Suddenly deprived of his income, Mr Bunce had to consider selling the family home. But his wife, Kim, stuck by him, and supported his mission to clear his name.

Mr Bunce knew he was innocent - he had never downloaded indecent images, and so he knew that the police would not find any evidence on the computers or storage devices they had taken away. But the police's computer technicians take several months to examine these, and Mr Bunce could not afford to wait to repair the damage done to his reputation. "I knew there'd been a fundamental mistake made and so I had to investigate it."

Identity fraud occurs when personal information is used by someone else to obtain credit, goods or other services fraudulently. Recent surveys suggest that as many as one in four Britons have been affected by it. In 2007 more than 185,000 cases of identity theft were identified by Cifas, the UK's fraud prevention service, an increase of almost 8% on 2006.

Operation Ore targeted suspected paedophiles believed to have been downloading indecent images of children, those whose credit card details had been used to buy pornography via an American portal called Landslide - the gateway site and central credit card handler for hundreds of websites.

Hundreds of successful prosecutions ensued, with extensive media coverage given to high profile suspects, including actor Chris Langham of The Thick of It. As Landslide was based in the United States and under investigation there, Mr Bunce was able to use the US Freedom of Information Act to obtain a complete copy of all of the relevant material, including databases, access logs and credit card information, together with detailed information of the webmasters, which allowed him to find out how his credit card details had been used.

Each computer has a unique internet protocol number, or IP address, which identifies the specific computer and its geographic whereabouts whenever it is used to access the internet.
Mr Bunce discovered that the computer used to enter his credit card details was in Jakarta, Indonesia, and the date and time that his credit card details were entered onto the Landslide website was at a time when he could prove that he was using the same card in a restaurant in south London.

"I can't be in two places at once, so somehow my data had got to the man in Indonesia."
He was also able to discover that his credit card details had been obtained from a popular online shopping site, but he doesn't know how these came to be in the hands of a criminal.
The man responsible for using his credit card details hid behind the online name "Miranda" - a webmaster who hosted and produced pornographic websites and received a commission from Landslide for subscriptions to his website which were paid by credit card. "Miranda" had used Mr Bunce's credit card details - without his knowledge - to take out a subscription to one of his websites.

In September 2004, the police told Mr Bunce they would not proceed with any action against him. They had not found indecent material, and accepted that it wasn't him who had entered his credit card details on the Landslide website. It took another six months before he got another job, earning a quarter of the salary he'd earned before his arrest. Mr Bunce has also reconciled with his family, having explained to them how he came to be implicated and then cleared. Are bygones bygones? "I've forgiven them [my family] - there's no point in bearing a grudge."

Four years on, he is bringing a High Court action against the shopping website for allowing his personal details to be compromised. So no more internet shopping? "No, no, no. Once bitten, twice shy," says Mr Bunce, who now sells encryption services. "I wouldn't say that I live in the cash economy now, but I'd rather go to the bank to withdraw money to buy petrol, as you hear of card details being harvested at garages. I'm paranoid about data security. I shred everything, I never use credit cards anymore.

"Being arrested and accused of what is probably one of the worst crimes known to man, losing my job, having my reputation run through the mud, it's a living nightmare."

Marc Sigsworth is the producer of BBC One's Identity Fraud: Outnumbered.