Insecure Realities

Business Identity Theft - A Comparison of State Law and Guide for Reform

2010-04-18T15:40:00.000-07:00

Business Identity Theft: Exploration of Laws and Punishment

Generally speaking, when most people discuss identity theft, they are referring to an individual using the personal identifying information of another individual, without their consent, to obtain some profit or advantage. Identity theft is largely viewed as a “people” problem, and for good reason- Most state and federal laws, websites, non-profit organizations and consumer advocacy groups tasked with the job of helping identity theft victims address the American consumer at large.

Working in this industry, I saw a gap in the services provided by these organizations. Although comprehensive when it came to personal identity solutions there was still a vulnerable segment: small and medium business owners. There are just not the same regulations and rules to protect these people and entities as there are the average individual. For instance, your credit report is considered private information. However, you can obtain any business’s credit report and typically for free. There is not even a legal requirement that you have a “need to know”. This report typically contains everything a motivated thief would need to open a store line of credit at a merchant such as Costco. And all they need is the company name and address to start with.

Let’s start with some historical and legal background. Small and medium sized businesses (SMBs) are an attractive target for identity thieves. According to the Institute of Consumer Financial Education (ICFE), SMBs usually qualify for larger lines of credit, “enjoy extended payment terms and less transactional scrutiny for large purchases or high value ticket items than individual customers.” They often have physical property such as computer equipment of value, or perhaps inexperienced employees that may be susceptible to phishing attempts or bribes. Many SMBs are located in shared business buildings, making it even easier to obtain credit cards and loans. All a criminal has to do is rent a small space or mailbox in your building- the address will verify as correct, and he’ll get the credit cards, loan documents, and bills instead of the business owner. Before the business even knows something is wrong, the criminal has skipped town without a trace- except for the damage to the business.

Additionally, many loan contracts and credit agreements may have fine print that could leave you high and dry. According to ICFE, “liability provisions in many cardholder agreements specifically exclude: unauthorized transactions involving business cards and cards used for business purposes…and instances where a transaction by an individual, who at some point was given permission to use the card by the cardholder, ‘exceeds authority’ given by the account owner.” Since insider threats are still the biggest concern when it comes to loss prevention, this particular fine print can mean a lot to a business owner. Perhaps most devastating: “Most loan documents contain a provision which states that if the lending bank ‘deems itself insecure’, repayment of the loan may be accelerated. If numerous fraudulent accounts have caused the bank to no longer be confident of the business’ long term viability, a business’ loans or credit lines may suddenly be called and most businesses would simply not have sufficient cash or liquid assets available to fully service the debt.”

In addition to being lucrative, small and medium size businesses are often careless with privacy and security because they are preoccupied with- well, running their business. According to the ICFE, “Many businesses do not regularly review their business credit report.. [or] ..always carefully scrutinize employee charge card billing statements before they are paid, particularly those accounts for which multiple cards are issued.” Additionally, a recent survey from security firm Panda Security shows SMBs in the United States are increasingly the victims of cybercrime, yet many do not take simple precautions to protect themselves. By the numbers:

* (44 percent) were hit by some form of cybercrime

* (10 percent) surveyed were hit so bad that they had to stop production -- worldwide, the average was 30 percent.

* (50 percent) of companies in the survey lost time or productivity as a result of being infected.

* (97 percent) of U.S. SMBs have installed anti-virus and (95 percent) claim their security systems are up to date. YET (29 percent) said they have no anti-spam in place, (22 percent) are without anti-spyware technology and (16 percent) do not have firewalls. (52 percent) said they have no web filtering solution in place. (39 percent) of respondents said that they have yet to be trained about IT threats.

Business information is easily obtained from a variety of offline and online sources. Business stationary and business cards are easy to obtain and duplicate, and since “most businesses are eager to open new accounts for other businesses, and the process can be quite simple- such as submitting a request on company letterhead along with the business license number and Tax ID.” (ICFE) Since most businesses display their business license on their wall (as many are required to by law), this theft is dangerously easy. Additionally, businesses may engage in high-risk sharing of their business information. Because many companies such as Costco require an EIN to give users status as a business, the EIN is tossed around a lot on documents and over the phone. Small business owners may even be using their own social security number in place of an EIN, increasing their risk and potential for damage

Further, state laws are ill equipped to deal with the problem. As pointed out in a recent article by Business Week, “While business identity theft can often be prosecuted under other statutes, like mail fraud or wire fraud, businesses victimized lose many of the protections afforded to consumers under identity theft laws, like access to information about their credit. Before California last year amended its 1997 identity theft law explicitly to include crimes targeting business entities, a business whose identity had been co-opted could not even get a police report. ‘We were having businesses being taken over and their names being used and I could not prosecute them, at least under ID theft statutes,’ California Deputy Attorney General Robert Morgester says.” (The state legislature amended the “person” in identity theft cases to encompass associations, organizations, partnerships, businesses, trusts, companies and corporations, in addition to logos and “photographic representation” as legally recognized personal ID data.) Yet, there are many other states that still do not recognize business identity theft as a separate crime at all. While there has been a little progress in this area, there are a lot of gaps. Visa, MasterCard, and American Express no longer distinguish between small business and individual credit card fraud, which helps companies to clear the purchases made by thieves. However, I wanted to look deeper into the complex laws in each state and really examine the landscape of business identity theft.

In conducting this research, I noted the ranking of each state by the number of identity theft complaints, the level of punishment that each state hand for the offenses, whether businesses were specified in the law, if the law was written to be able to include businesses or if the law seemed to exclude businesses. I also noted if there were separate laws that would cover a business, but not under normal identity theft laws. My theory was that the states that had the worst identity theft complaints would have the stiffest penalties and be more likely to cover businesses. I know that California ranks pretty high in identity theft, and they typically are the innovators of laws related to consumer protection.

I was actually quite shocked by the results. After reviewing legislation carefully, I split the states out into five groups. Group A, the largest group made of 20 states, are those states that have legally defined “person” or “identification information” in such a way to include businesses, tax id numbers or business license numbers.

Group B, made up of 7 states, are those states that do not cover business identity theft in their traditional identity theft laws, but have covered the offenses in other legislation such as criminal impersonation, falsifying business records or access device fraud.

Group C, second largest group with 11 states, are those governments which appear to specifically exclude business identity theft in all forms of legislation, and are the “worst offenders” in terms of leaving business owners vulnerable.

Group D, made up of 9 states, would be classified by states that seemed to have specifically addressed business identity theft in their legislation.

Finally, the last group, Group E, are four states whose laws are incredibly unclear and could be interpreted either way.

To really understand how this breaks down in terms of the ranking of these states in identity theft complaints, and where they fall on this continuum of business identity theft law, we can examine each group’s members based on ranking and focus on how some approaches are specifically addressed in legislative language.

First, we examine group A. I was surprised how many states defined person as a individual or entity, including corporations, partnerships and other businesses. A few states simple defined identity theft as the use of identification information, and when defining identification information used terms such as “tax identification number or social security number” or phrases like “information or numbers used to access financial resources or credit”. These states and their identity theft complaint rankings: Alabama (17); Alaska (38); Arkansas (33); Kentucky (42); Louisiana (28); Michigan (15); Minnesota (35); Missouri (21); Montana (44); Nebraska (40); Nevada (3); New Jersey (12); New Mexico (9); North Carolina (22); North Dakota (50); Ohio (27); South Dakota (49); Texas (4); West Virginia (46); Washington (13).

Group B requires a little more explanation. I actually expected this to be the largest group from my limited casual reading. Here, I feel it is important to show the state, ranking and then compare the identity theft law and the law which business identity theft would fall under to demonstrate the difference in language and punishment. I found it fascinating that overall, if there was a separate law regarding business identity theft it was a much more minor offense (misdemeanors versus felonies). These more minor offenses include criminal impersonation, access device fraud, and falsifying business records.

Connecticut (19)

Sec. 53a-129a. Identity theft: Class D felony. (a) A person is guilty of identity theft when such person intentionally obtains personal identifying information of another person without the authorization of such other person and uses that information for any unlawful purpose including, but not limited to, obtaining, or attempting to obtain, credit, goods, services or medical information in the name of such other person without the consent of such other person. As used in this section, "personal identifying information" means a motor vehicle operator's license number, Social Security number, employee identification number, mother's maiden name, demand deposit number, savings account number or credit card number.

Sec. 53a-130. Criminal impersonation: Class B misdemeanor. (a) A person is guilty of criminal impersonation when he: (1) Impersonates another and does an act in such assumed character with intent to obtain a benefit or to injure or defraud another; or (2) pretends to be a representative of some person or organization and does an act in such pretended capacity with intent to obtain a benefit or to injure or defraud another; or (3) pretends to be a public servant other than a sworn member of an organized local police department or the Division of State Police within the Department of Public Safety, or wears or displays without authority any uniform, badge or shield by which such public servant is lawfully distinguished, with intent to induce another to submit to such pretended official authority or otherwise to act in reliance upon that pretense.

Delaware (16)

§ 854. Identity theft; class D felony. (a) A person commits identity theft when the person knowingly or recklessly obtains, produces, possesses, uses, sells, gives or transfers personal identifying information belonging or pertaining to another person without the consent of the other person and with intent to use the information to commit or facilitate any crime set forth in this title.

§ 828. Possession of burglar's tools or instruments facilitating theft; class F felony. (4) The offense of identity theft, such as a credit card, driver license or other document issued in a name other than the name of the person who possesses the document.

…

(c) For the purposes of this section, "personal identifying information" includes name, address, birth date, Social Security number, driver's license number, telephone number, financial services account number, savings account number, checking account number, credit card number, debit card number, identification document or false identification document, electronic identification number, educational record, health care record, financial record, credit record, employment record, e-mail address, computer system password, mother's maiden name or similar personal number, record or information.

§ 907. Criminal impersonation; class A misdemeanor. A person is guilty of criminal impersonation when the person:

(1) Impersonates another person and does an act in an assumed character intending to obtain a benefit or to injure or defraud another person; or (2) Pretends to be a representative of some person or organization and does an act in a pretended capacity with intent to obtain a benefit or to injure or defraud another person; or (3) Pretends to be a public servant, or wears or displays without authority any identification, uniform or badge by which a public servant is lawfully distinguished or identified. Criminal impersonation is a class A misdemeanor. § 871. Falsifying business records; class A misdemeanor. A person is guilty of falsifying business records when, with intent to defraud, the person: (1) Makes or causes a false entry in the business records of an enterprise; or (2) Alters, erases, obliterates, deletes, removes or destroys a true entry in the business records of an enterprise; or (3) Omits to make a true entry in the business records of an enterprise in violation of a duty to do so which the person knows to be imposed by law or by the nature of the person's position; or (4) Prevents the making of a true entry or causes the omission thereof in the business records of an enterprise. Falsifying business records is a class A misdemeanor.

Illinois (11)

(720 ILCS 5/16G‑15) Sec. 16G‑15. Identity theft. (a) A person commits the offense of identity theft when he or she knowingly:

(1) uses any personal identifying information or personal identification document of another person to fraudulently obtain credit, money, goods, services, or other property, or

(2) uses any personal identification information or

personal identification document of another with intent to commit any felony theft or other felony violation of State law…

Statute: §720 ILCS 250/13 A person who receives money, goods, property, services or anything else of value obtained fraudulently, knowing that it was so obtained, is guilty of a Class A misdemeanor if the valuedoes not exceed $150 in any six-month period, and a Class 4 felony if it exceeds that amount.

Massachutes (23)

Mass. Gen. Laws ch. 266, § 37E False Impersonation and Identity Fraud (b) Whoever, with intent to defraud, poses as another person without the express authorization of that person and uses such person's personal identifying information to obtain or to attempt to obtain money, credit, goods, services, anything of value, any identification card or other evidence of such person's identity, or to harass another shall be guilty of identity fraud and shall be punished by a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or by both such fine and imprisonment.

Chapt 397: "Personal identifying information", any name or number that may be used, alone or in conjunction with any other information, to assume the identity of an individual, including any name, address, telephone number, driver's license number, social security number, place of employment, employee identification number, mother's maiden name, demand deposit account number, savings account number, credit card number or computer password identification.

Chapter 266: Section 37B. Whoever, with intent to defraud, (a) makes or causes to be made, either directly or indirectly, any false statement as to a material fact in writing, knowing it to be false and with intent that it be relied on, respecting his identity or that of any other person, or his financial condition or that of any other person, for the purpose of procuring the issuance of a credit card, or (b) takes a credit card from the person, possession, custody or control of another without the cardholder’s consent by any conduct which would constitute larceny, or who, with knowledge that it has been so taken, receives the credit card with intent to use it or to sell it, or to transfer it to a person other than the issuer....

Mississippi (32)

SEC. 97-19-85. Fraudulent use of identity, social security number or other identifying information to obtain thing of value.

(1) Any person who shall make or cause to be made any false statement or representation as to his or another person's identity, social security account number or other identifying information for the purpose of fraudulently obtaining or with the intent to obtain goods, services or any thing of value, shall be guilty of a misdemeanor and upon conviction thereof shall be fined not more than Five Thousand Dollars ($5,000.00) or imprisoned for a term not to exceed one (1) year, or both.

(2) A person is guilty of fraud under subsection (1) who:

(a) Shall furnish false information wilfully, knowingly and with intent to deceive anyone as to his true identity or the true identity of another person;

(b) Wilfully, knowingly, and with intent to deceive, uses a social security account number to establish and maintain business or other records; or

(c) With intent to deceive, falsely represents a number to be the social security account number assigned to him or another person, when in fact the number is not the social security account number assigned to him or such other person; or

(d) Knowingly alters a social security card, buys or sells a social security card or counterfeit or altered social security card, counterfeits a social security card, or possesses a social security card or counterfeit social security card with intent to sell or alter it.

SEC. 97-19-83. Fraud by mail or other means of communication.

(1) Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money, property or services, or for unlawfully avoiding the payment or loss of money, property or services, or for securing business or personal advantage by means of false or fraudulent pretenses, representations or promises, or to sell, dispose of, loan, exchange, alter, give away, distribute, supply, or furnish or procure for unlawful use any counterfeit or spurious coin, obligation, security or other article, or anything represented to be or intimated or held out to be such counterfeit or spurious article, for the purpose of executing such scheme or artifice or attempting so to do, transmits or causes to be transmitted by mail, telephone, newspaper, radio, television, wire, electromagnetic waves, microwaves, or other means of communication or by person, any writings, signs, signals, pictures, sounds, data, or other matter across county or state jurisdictional lines, shall, upon conviction, be punished by a fine of not more than Ten Thousand Dollars ($10,000.00) or by imprisonment for not more than five (5) years, or by both such fine and imprisonment.

SOURCES: Laws, 1988, ch. 511, Sec. 3, eff from and after July 1, 1988. SEC. 97-19-11. Credit cards; procuring issuance by false statements.

Any person who makes or causes to be made either directly or indirectly any false statement in writing with intent that it be relied upon with respect to his identity or that of any other person, firm or corporation, for the purpose of procuring the issuance of a credit card is guilty of a misdemeanor.

New York (6)

§ 190.77 Offenses involving theft of identity; definitions.

For the purposes of sections 190.78, 190.79, 190.80 and 190.80-a and 190.85 of this article "personal identifying information" means a person's name, address, telephone number, date of birth, driver's license number, social security number, place of employment, mother's maiden name, financial services account number or code, savings account number or code, checking account number or code, brokerage account number or code, credit card account number or code, debit card number or code, automated teller machine number or code, taxpayer identification number, computer system password, signature or copy of a signature, electronic signature, unique biometric data that is a fingerprint, voice print, retinal image or iris image of another person, telephone calling card number, mobile identification number or code, electronic serial number or personal identification number, or any other name, number, code or information that may be used alone or in conjunction with other such information to assume the identity of another person.

§ 175.00 Definitions of terms.

The following definitions are applicable to this article:

"Enterprise" means any entity of one or more persons, corporate or otherwise, public or private, engaged in business, commercial, professional, industrial, eleemosynary, social, political or governmental activity.

"Business record" means any writing or article, including computer data or a computer program, kept or maintained by an enterprise for the purpose of evidencing or reflecting its condition or activity.

"Written instrument" means any instrument or article, including computer data or a computer program, containing written or printed matter or the equivalent thereof, used for the purpose of reciting, embodying, conveying or recording information, or constituting a symbol or evidence of value, right, privilege or identification, which is capable of being used to the advantage or disadvantage of some person.

§ 190.25 Criminal impersonation in the second degree.

A person is guilty of criminal impersonation in the second degree when he: Impersonates another and does an act in such assumed character with intent to obtain a benefit or to injure or defraud another; or Pretends to be a representative of some person or organization and does an act in such pretended capacity with intent to obtain a benefit or to injure or defraud another…

Criminal impersonation in the second degree is a class A misdemeanor.

§ 175.05 Falsifying business records in the second degree.

A person is guilty of falsifying business records in the second degree when, with intent to defraud, he:

1. Makes or causes a false entry in the business records of an enterprise; or

2. Alters, erases, obliterates, deletes, removes or destroys a true entry in the business records of an enterprise; or

3. Omits to make a true entry in the business records of an enterprise in violation of a duty to do so which he knows to be imposed upon him by law or by the nature of his position; or

4. Prevents the making of a true entry or causes the omission thereof in the business records of an enterprise.

Falsifying business records in the second degree is a class A misdemeanor.

Oregon (20)

165.800 Identity theft. (1) A person commits the crime of identity theft if the person, with the intent to deceive or to defraud, obtains, possesses, transfers, creates, utters or converts to the person’s own use the personal identification of another person.

165.072 Definitions for ORS 165.072 and 165.074. (8) “Person” does not include a financial institution or its authorized employee, representative or agent.

165.800 Identity theft. (4) As used in this section:

(a) “Another person” means a real person, whether living or deceased, or an imaginary person.

(b) “Personal identification” includes, but is not limited to, any written document or electronic data that does, or purports to, provide information concerning:

(A) A person’s name, address or telephone number;

(B) A person’s driving privileges;

(D) A person’s citizenship status or alien identification number;

(E) A person’s employment status, employer or place of employment;

(F) The identification number assigned to a person by a person’s employer;

(G) The maiden name of a person or a person’s mother;

(H) The identifying number of a person’s depository account at a “financial institution” or “trust company,” as those terms are defined in ORS 706.008, or a credit card account;

(I) A person’s signature or a copy of a person’s signature;

(J) A person’s electronic mail name, electronic mail signature, electronic mail address or electronic mail account;

(K) A person’s photograph;

(L) A person’s date of birth; and

(M) A person’s personal identification number. [1999 c.1022 §1; 2001 c.870 §3; 2007 c.583 §1]

165.080 Falsifying business records. (1) A person commits the crime of falsifying business records if, with intent to defraud, the person:

(a) Makes or causes a false entry in the business records of an enterprise; or

(b) Alters, erases, obliterates, deletes, removes or destroys a true entry in the business records of an enterprise; or

(c) Fails to make a true entry in the business records of an enterprise in violation of a known duty imposed upon the person by law or by the nature of the position of the person; or

(d) Prevents the making of a true entry or causes the omission thereof in the business records of an enterprise.

(2) Falsifying business records is a Class A misdemeanor. [1971 c.743 §163]

165.055 Fraudulent use of a credit card. (1) A person commits the crime of fraudulent use of a credit card if, with intent to injure or defraud, the person uses a credit card for the purpose of obtaining property or services with knowledge that:

(a) The card is stolen or forged;

(b) The card has been revoked or canceled; or

(c) For any other reason the use of the card is unauthorized by either the issuer or the person to whom the credit card is issued.

(2) “Credit card” means a card, booklet, credit card number or other identifying symbol or instrument evidencing an undertaking to pay for property or services delivered or rendered to or upon the order of a designated person or bearer.

(3) The value of single credit card transactions may be added together if the transactions were committed:

(a) Against multiple victims within a 30-day period; or

(b) Against the same victim within a 180-day period.

(4) Fraudulent use of a credit card is:

(a) A Class A misdemeanor if the aggregate total amount of property or services the person obtains or attempts to obtain is less than $1,000.

(b) A Class C felony if the aggregate total amount of property or services the person obtains or attempts to obtain is $1,000 or more. [1971 c.743 §160; 1973 c.133 §7; 1987 c.907 §11; 1993 c.680 §26; 2009 c.16 §7]

As you can see, the various ways that business could be excluded from rights that are designated for victims of identity theft are quite extensive. Sometimes they can be excluded because the information needed to open business lines of credit with merchants such as Costco does not require any private information, or personal information about the business owner. Other times it would not be included because the account isn’t held at a financial intuition, or because the crime could have been committed by an insider.

Group C those governments which appear to specifically exclude business identity theft in all forms of legislation, are worth carefully examining as well. For this purpose, I actually included the District of Columbia as part of the “worst offenders” in terms of leaving business owners vulnerable. Some of the rankings in this area actually shocked me, and some of the specific wording to exclude business were surprising as well- just take Florida as an example. It ranks fifth in identity theft complaints, but it specifically excludes businesses as a “person” under their identity theft laws.

A breakdown of Group C:

DC (n/a)

D.C. Code § 22-3227.01 (2004) § 22-3227.02. Identity theft.

A person commits the offense of identity theft if that person knowingly:

(1) Uses personal identifying information belonging to or pertaining to another person to obtain, or attempt to obtain, property fraudulently and without that person's consent; or

(2) Obtains, creates, or possesses personal identifying information belonging to or pertaining to another person with the intent to:

(A) Use the information to obtain, or attempt to obtain, property fraudulently and without that person's consent; or

(B) Give, sell, transmit, or transfer the information to a third person to facilitate the use of the information by that third person to obtain, or attempt to obtain, property fraudulently and without that person's consent.

(2) "Person" means an individual, whether living or dead.

(3) "Personal identifying information" includes, but is not limited to, the following:

(A) Name, address, telephone number, date of birth, or mother's maiden name;

(B) Driver's license or driver's license number, or non-driver's license or non-driver's license number;

(D) Social security number or tax identification number;

(E) Passport or passport number;

(F) Citizenship status, visa, or alien registration card or number;

(G) Birth certificate or a facsimile of a birth certificate;

(H) Credit or debit card, or credit or debit card number;

(I) Credit history or credit rating;

(J) Signature;

(K) Personal identification number, electronic identification number, password, access code or device, electronic address, electronic identification number, routing information or code, digital signature, or telecommunication identifying information;

(L) Biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

(M) Place of employment, employment history, or employee identification number; and

(N) Any other numbers or information that can be used to access a person's financial resources, access medical information, obtain identification, act as identification, or obtain property.

(4) "Property" shall have the same meaning as provided in § 22-3201(3) and shall include credit.

Florida (5)

817.568 Criminal use of personal identification information.

(d) "Individual" means a single human being and does not mean a firm, association of individuals, corporation, partnership, joint venture, sole proprietorship, or any other entity.

Title XLVI Chapter 817 FRAUDULENT PRACTICES (2)(a) Any person who willfully and without authorization fraudulently uses, or possesses with intent to fraudulently use, personal identification information concerning an individual without first obtaining that individual's consent, commits the offense of fraudulent use of personal identification information, which is a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

817.03 Making false statement to obtain property or credit.--Any person who shall make or cause to be made any false statement, in writing, relating to his or her financial condition, assets or liabilities, or relating to the financial condition, assets or liabilities of any firm or corporation in which such person has a financial interest, or for whom he or she is acting, with a fraudulent intent of obtaining credit, goods, money or other property, and shall by such false statement obtain credit, goods, money or other property, shall be guilty of a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083.

Idaho (36)

18-3124.Fraudulent use of a financial transaction card or number. It is a violation of the provisions of this section for any person with the intent to defraud:

(1) To use an FTC or FTC number to knowingly and willfully exceed the actual balance of the demand deposit account or time deposit account;

(2) To use an FTC or FTC number to willfully exceed an authorized credit line in the amount of one thousand dollars ($1,000) or more, or fifty percent (50%) of such authorized credit line, whichever is greater;

(3) To willfully deposit into his account or any other account by means of an automatic banking device, any false, forged, fictitious, altered or counterfeit check draft, money order, or any other such document;

(4) To knowingly sell or attempt to sell credit card sales drafts to an authorized credit card merchant or any other person or organization, for any consideration whether at a discount or otherwise, or present or cause to be presented to the issuer or an authorized credit card merchant, for payment or collection, any credit card sales draft, or purchase or attempt to purchase any credit card sales draft for presentation to the issuer or an authorized credit card merchant for payment or collection if:

(a) Such draft is counterfeit or fictitious;

(b) The purported sale evidenced by such credit card sales draft did not take place;

(d) The items or services purported to be sold as evidenced by such credit card sales draft are not delivered or rendered to the card holder or person intended to receive them; or

(e) If purportedly delivered or rendered, such goods or services are of materially lesser value or quality from that intended by the purchaser, or are materially different from goods or services represented by the seller or his agent to the purchaser, or have substantial discrepancies from goods or services impliedly represented by the purchase price when compared with the actual goods or services purportedly delivered or rendered.

(5) To knowingly keep or maintain in any manner carbon or other impressions or copies of credit card sales drafts, and to use such impressions or copies for the purpose of creating any fictitious or counterfeit credit sales draft, or to engage in any other activity prohibited in this section.

§ 18-3125

Criminal possession of financial transaction card, financial transaction number and FTC forgery devices. It is a felony punishable as provided in subsection (3) of section 18-3128, Idaho Code, for any person:

(1) To acquire an FTC or FTC number from another without the consent of the card holder or the issuer, or to, with the knowledge that it has been so acquired, receive an FTC or FTC number with the intent to use to defraud, or to sell, or to transfer the FTC or FTC number to another person with the knowledge that it is to be used to defraud;

(2) To acquire an FTC or FTC number that he knows to have been lost, mislaid, or delivered under a mistake as to the identity or address of the card holder, and to retain possession with the intent to use to defraud or to sell or transfer to another person with the knowledge that it is to be used to defraud;

(3) To, with the intent to defraud, knowingly possess a false, fictitious, counterfeit, revoked, expired or fraudulently obtained FTC or any FTC account number;

(4) To, with the intent to defraud, knowingly obtain or attempt to obtain credit or purchase or attempt to purchase any goods, property or service, by use of any false, fictitious, counterfeit, revoked, expired or fraudulently obtained FTC or FTC account number;

(5) To, with the intent to defraud, knowingly produce to another person or procure, a false, fictitious, counterfeit, revoked, expired or fraudulently obtained FTC or any FTC account number;

(6) To, with the intent to defraud and while making an application for an FTC to an issuer, knowingly make or cause to be made, a false written or oral statement or representation respecting his name, personal identifying information, occupation, financial condition, assets, or to materially undervalue any indebtedness for the purpose of influencing the issuer to issue an FTC.

§ 18-3125A

Unauthorized factoring of credit card sales drafts. It is unlawful for any person to knowingly and with intent to defraud, employ, solicit or otherwise cause an authorized credit card merchant, or for the authorized credit card merchant itself, to present to the issuer for payment any credit card sales draft pertaining to any sale or purported sale of goods or services which was not made by such authorized credit card merchant in the ordinary course of business, except with the express authorization of the issuer.

§ 18-3126

Misappropriation of personal identifying information. It is unlawful for any person to obtain or record personal identifying information of another person without the authorization of that person, with the intent that the information be used to obtain, or attempt to obtain, credit, money, goods or services without the consent of that person.

§ 18-3126A

Acquisition of personal identifying information by false authority. It is unlawful for any person to falsely assume or pretend to be a member of the armed forces of the United States or an officer or employee acting under authority of the United States or any department, agency or office thereof or of the state of Idaho or any department, agency or office thereof, and in such pretended character, seek, demand, obtain or attempt to obtain personal identifying information of another person.

§ 18-3127

Receiving or possessing fraudulently obtained goods or services. It is unlawful for any person to receive, retain, conceal, possess or dispose of personal property, cash or other representative of value, who knows or has reason to believe the property, cash or other representative of value has been obtained by fraud as set forth in sections 18-3123, 18-3124, 18-3125A and 18-3126, Idaho Code.

§ 18-3128

Penalty for violation. (1) Any person found guilty of a violation of section 18-3124, 18-3125A or 18-3127, Idaho Code, is guilty of a misdemeanor. In the event that the retail value of the goods obtained or attempted to be obtained through any violation of the provisions of section 18-3124, 18-3125A or 18-3127, Idaho Code, exceeds three hundred dollars ($300), any such violation will constitute a felony, and will be punished as provided in this section. Any person found guilty of a violation of section 18-3125, 18-3126 or 18-3126A, Idaho Code, is guilty of a felony.

(2) For purposes of this section, the punishment for a misdemeanor shall be a fine of up to one thousand dollars ($1,000) or up to one (1) year in the county jail, or both such fine and imprisonment.

(3) For purposes of this section, the punishment for a felony shall be a fine of up to fifty thousand dollars ($50,000) or imprisonment in the state prison not exceeding five (5) years, or both such fine and imprisonment.

(3) "Card holder" means any person or organization named on the face of a financial transaction card to whom, or for whose benefit, a financial transaction card is issued by an issuer.

(4) "Credit card sales draft" means:

(a) Any sales slip, draft, voucher or other written or electronic record of a sale of goods, services or anything else of value made or purported to be made to or at the request of a card holder with a financial transaction card, financial transaction card account number or personal identification code; or

(b) Any evidence, however manifested, of any right or purported right to collect from a card holder funds due or purported to be due with respect to any sale or purported sale. (10) "Personal identifying information" means the name, address, telephone number, driver’s license number, social security number, place of employment, employee identification number, mother’s maiden name, checking account number, savings account number, financial transaction card number, or personal identification code of an individual person, or any other numbers or information which can be used to access a person’s financial resources.

Indiana (26)

Sec. 8. (a) A person who knowingly executes, or attempts to execute, a scheme or artifice:

(1) to defraud a state or federally chartered or federally insured financial institution; or

(2) to obtain any of the money, funds, credits, assets, securities, or other property owned by or under the custody or control of a state or federally chartered or federally insured financial institution by means of false or fraudulent pretenses, representations, or promises; commits a Class C felony.

Iowa (48)

Sec. 8. (a) A person who knowingly executes, or attempts to execute, a scheme or artifice:

(1) to defraud a state or federally chartered or federally insured financial institution; or

For purposes of this section, "identification information" means the name, address, date of birth, telephone number, driver's license number, nonoperator's identification number, social security number, place of employment, employee identification number, parent's legal surname prior to marriage, demand deposit account number, savings or checking account number, or credit card number of a person.

Kansas (29)

21-3830. Dealing in false identification documents; vital records identity fraud related to birth, death, marriage, and divorce certificates.

(a) Dealing in false identification documents is reproducing, manufacturing, selling or offering for sale any identification document which:

(1) Simulates, purports to be or is designed so as to cause others reasonably to believe it to be an identification document; and

(2) bears a fictitious name or other false information.

(b) As used in this section, "identification document" means any card, certificate or document or banking instrument including, but not limited to, credit or debit card, which identifies or purports to identify the bearer of such document, whether or not intended for use as identification, and includes, but is not limited to, documents purporting to be drivers' licenses, nondrivers' identification cards, certified copies of birth, death, marriage and divorce certificates, social security cards and employee identification cards.

(d) Vital records identity fraud related to birth, death, marriage and divorce certificates is:

(1) Willfully and knowingly supplying false information intending that the information be used to obtain a certified copy of a vital record;

(2) making, counterfeiting, altering, amending or mutilating any certified copy of a vital record:

(A) Without lawful authority; and

(B) with the intent to deceive; or

(3) willfully and knowingly obtaining, possessing, using, selling or furnishing or attempting to obtain, possess or furnish to another for any purpose of deception a certified copy of a vital record.

(e) Vital records identity fraud is a severity level 8, nonperson felony.

(f) The prohibitions in subsections (a) and (b) do not apply to:

(1) A person less than 21 years of age who uses the identification document of another person to acquire an alcoholic beverage, as defined in K.S.A. 8-1599, and amendments thereto;

(2) a person less than 18 years of age who uses the identification documents of another person to acquire:

(A) Cigarettes or tobacco products, as defined in K.S.A. 79-3301, and amendments thereto;

(B) a periodical, videotape or other communication medium that contains or depicts nudity;

(D) an item that is prohibited by law for use or consumption by such person.

(g) This section shall be part of and supplemental to the Kansas criminal code.

21-4018. Identity theft; identity fraud. (a) Identity theft is knowingly and with intent to defraud for any benefit, obtaining, possessing, transferring, using or attempting to obtain, possess, transfer or use, one or more identification documents or personal identification number of another person other than that issued lawfully for the use of the possessor.

(b) "Identification documents" has the meaning provided in K.S.A. 21-3830, and amendments thereto.

(c) Except as provided further, identity theft is a severity level 8, nonperson felony. If the monetary loss to the victim or victims is more than $100,000, identity theft is a severity level 5, nonperson felony.

(d) Identity fraud is:

(1) Willfully and knowingly supplying false information intending that the information be used to obtain an identification document;

(2) making, counterfeiting, altering, amending or mutilating any identification document:

(A) Without lawful authority; and

(B) with the intent to deceive; or

(3) willfully and knowingly obtaining, possessing, using, selling or furnishing or attempting to obtain, possess or furnish to another for any purpose of deception an identification document.

(e) Identity fraud is a severity level 8, nonperson felony.

(f) This section shall be part of and supplemental to the Kansas criminal code.

Maryland (10)

A person may not knowingly, willfully, and with fraudulent intent possess, obtain, or help another to possess or obtain any personal identifying information of an individual, without the consent of the individual, in order to use, sell, or transfer the information to get a benefit, credit, good, service, or other thing of value in the name of the individual.

(1) to avoid identification, apprehension, or prosecution for a crime; or

(2) with fraudulent intent to:

(i) get a benefit, credit, good, service, or other thing of value; or

(ii) avoid the payment of debt or other legal obligation.

§8–303.

“Personal identifying information” includes a name, address, telephone number, driver’s license number, Social Security number, place of employment, employee identification number, mother’s maiden name, bank or other financial institution account number, date of birth, personal identification number, credit card number, or other payment device number.

(a) In this section, “government identification document” means one of the following documents issued by the United States government or any state or local government:

(1) a passport;

(2) an immigration visa;

(3) an alien registration card;

(4) an employment authorization card;

(5) a birth certificate;

(6) a Social Security card;

(7) a military identification;

(8) an adoption decree;

(9) a marriage license;

(10) a driver’s license; or

(11) a photo identification card. http://mlis.state.md.us/asp/web_statutes.asp?gcr&8-303

New Hampshire (37)

638:26 Identity Fraud.

I. A person is guilty of identity fraud when the person:

(a) Poses as another person with the purpose to defraud in order to obtain money, credit, goods, services, or anything else of value;

(b) Obtains or records personal identifying information about another person without the express authorization of such person, with the intent to pose as such person;

(c) Obtains or records personal identifying information about a person without the express authorization of such person in order to assist another to pose as such person; or

(d) Poses as another person, without the express authorization of such person, with the purpose of obtaining confidential information about such person that is not available to the general public.

II. Identity fraud is a class A felony.

III. A person found guilty of violating any provisions of this section shall, in addition to the penalty under paragraph II, be ordered to make restitution for economic loss sustained by a victim as a result of such violation.

638:25 Definitions. – In this subdivision:

I. ""Personal identifying information'' means any name, number, or information that may be used, alone or in conjunction with any other information, to assume the identity of an individual, including any name, address, telephone number, driver's license number, social security number, employer or place of employment, employee identification number, mother's maiden name, demand deposit account number, savings account number, credit card number, debit card number, personal identification number, account number, or computer password identification.

II. ""Pose'' means to falsely represent oneself, directly or indirectly, as another person or persons.

III. ""Victim'' means any person whose personal identifying information has been unlawfully obtained or recorded or any person or entity that provided money, credit, goods, services, or anything of value and has suffered financial loss as a direct result of the commission or attempted commission of a violation of this subdivision.

Pennsylvannia (14)

18 § 4120

Offense defined.--A person commits the offense of identity theft of another person if he possesses or uses, through any means, identifying information of another person without the consent of that other person to further any unlawful purpose.

Identifying information is defined as “any document, photographic, pictorial or computer image of another person, or any fact used to establish identity, including, but not limited to, a name, birth date, Social Security number, driver's license number, nondriver governmental identification number, telephone number, checking account number, savings account number, student identification number, employee or payroll number or electronic signature.”

South Carolina (30)

§16-13-510. "Financial identity fraud" and "identifying information" defined; penalty and restitution.

(A) It is unlawful for a person to commit the offense of financial identity fraud or identity fraud.

(B) A person is guilty of financial identity fraud when he, without the authorization or permission of another person and with the intent of unlawfully appropriating the financial resources of that person to his own use or the use of a third party knowingly and wilfully:

(1) obtains or records identifying information which would assist in accessing the financial records of the other person; or

(2) accesses or attempts to access the financial resources of the other person through the use of identifying information as defined in subsection (D).

(C) A person is guilty of identity fraud when he uses identifying information, as defined in subsection (D), of another person for the purpose of obtaining employment or avoiding identification by a law enforcement officer, criminal justice agency, or another governmental agency including, but not limited to, law enforcement, detention, and correctional agencies or facilities.

(D) "Personal identifying information" means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of this State, when the data elements are neither encrypted nor redacted:

(1) social security number;

(2) driver's license number or state identification card number issued instead of a driver's license;

(3) financial account number, or credit card or debit card number in combination with any required security code, access code, or password that would permit access to a resident's financial account; or

(4) other numbers or information which may be used to access a person's financial accounts or numbers or information issued by a governmental or regulatory entity that uniquely will identify an individual.

The term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.

(E) A person who violates the provisions of this section is guilty of a felony and, upon conviction, must be fined in the discretion of the court or imprisoned not more than ten years, or both. The court may order restitution to the victim pursuant to the provisions of Section 17-25-322.

Tennessee (24)

§ 39-14-150. Identity theft victims' rights. — a) This section shall be known and may be cited as the “Identity Theft Victims' Rights Act of 2004.” b) A person commits the offense of identity theft who knowingly obtains, possesses, buys, or uses, the personal identifying information of another: (1) With the intent to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of such other person; and (2) (A) Without the consent of such other person; or (B) Without the lawful authority to obtain, possess, buy or use that identifying information.

(3) For purposes of the offense of identity theft, an activity involving a possession, use or transfer that is permitted by the Tennessee Financial Records Privacy Act, codified in title 45, chapter 10; Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102; or the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactional Act, (15 U.S.C. § 1681 et seq.) shall not be considered an “unlawful act”. (c) (1) A person commits the offense of identity theft trafficking who knowingly sells, transfers, gives, trades, loans or delivers, or possesses with the intent to sell, transfer, give, trade, loan or deliver, the personal identifying information of another: (A) With the intent that the information be used by someone else to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of the other person; or (B) Under circumstances such that the person should have known that the identifying information would be used by someone else to commit any unlawful act including, but not limited to, obtaining or attempting to obtain credit, goods, services or medical information in the name of the other person; and (C) The person does not have the consent of the person who is identified by the information to sell, transfer, give, trade, loan or deliver, or possess with the intent to sell, transfer, give, trade, loan or deliver, that information; and (D) The person does not have lawful authority to sell, transfer, give, trade, loan or deliver, or possess with the intent to sell, transfer, give, loan or deliver, the personal identifying information.

(e) As used in this section, “personal identifying information” means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including:

(1) Name, social security number, date of birth, official state or government issued driver license or identification number, alien registration number, passport number, employer or taxpayer identification number;

(2) Unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

(3) Unique electronic identification number, address, routing code or other personal identifying data which enables an individual to obtain merchandise or service or to otherwise financially encumber the legitimate possessor of the identifying data; or

(4) Telecommunication identifying information or access device.

§39-16-301

A person commits the offense of criminal impersonation when he, with intent to injure or defraud another person, assumes a false identity; pretends to be a representative of some person or organization; pretends to be an officer or employee of the government; or pretends to have a handicap or disability. This is a class B misdemeanor, punishable by six months in jail and/or a $500 fine.

Indiana fraud law only covers credit cards and the identity theft law only covers banks. Business accounts such as those that would be opened at Costco are completely ignored. Idaho has some of the longest and most numerous identity theft laws, but they are totally ill-equipped to address business identity theft. Others, like Maryland, are just too brief to be useful while some are too long and specific about the information that must be used (social security number, driver’s license) that they both result in the same problem- they are not flexible enough to include business identity theft.

Our next group is the set I’m most excited about. In Group D, these states show exceptional legislative talent and appear specifically designed to address business identity theft. We already addressed California, whose ranking is number two in the nation for identity theft complaints. They made specific changes to their law to protect businesses and allow them the same rights (such as a police report) in regards to identity theft. Here is a closer examination of similar states, important elements are highlighted in yellow:

Arizona (1)

§13-105. Definitions 29. "Person" means a human being and, as the context requires, an enterprise, a public or private corporation, an unincorporated association, a partnership, a firm, a society, a government, a governmental authority or an individual or entity capable of holding a legal or beneficial interest in property.

§13-2008. Taking identity of another person or entity; knowingly accepting identity of another person; classification

A person commits taking the identity of another person or entity if the person knowingly takes, purchases, manufactures, records, possesses or uses any personal identifying information or entity identifying information of another person or entity, including a real or fictitious person or entity, without the consent of that other person or entity, with the intent to obtain or use the other person's or entity's identity for any unlawful purpose or to cause loss to a person or entity whether or not the person or entity actually suffers any economic loss as a result of the offense, or with the intent to obtain or continue employment.

Colorado (8)

§18-5-902. Identity theft. (1) A person commits identity theft if he or she: (a) Knowingly uses the personal identifying information, financial identifying information, or financial device of another without permission or lawful authority to obtain cash, credit, property, services, or any other thing of value or to make a financial payment; (b) Knowingly possesses the personal identifying information, financial identifying information, or financial device of another without permission or lawful authority, with the intent to use or to aid or permit some other person to use such information or device to obtain cash, credit, property, services, or any other thing of value or to make a financial payment; (c) With the intent to defraud, falsely makes, completes, alters, or utters a written instrument or financial device containing any personal identifying information or financial identifying information of another; (d) Knowingly possesses the personal identifying information or financial identifying information of another without permission or lawful authority to use in applying for or completing an application for a financial device or other extension of credit; (e) Knowingly uses or possesses the personal identifying information of another without permission or lawful authority with the intent to obtain a government-issued document; or (f) Attempts, conspires with another, or solicits another to commit any of the acts set forth in paragraphs (a) to (e) of this subsection (1). (2) Identity theft is a class 4 felony.

Georgia (7)

§16-9-125.

The General Assembly finds that identity fraud involves the use of identifying information which is uniquely personal to the consumer or business victim of that identity fraud and which information is considered to be in the lawful possession of the consumer or business victim wherever the consumer or business victim currently resides or is found. Accordingly, the fraudulent use of that information involves the fraudulent use of information that is, for the purposes of this article, found within the county where the consumer or business victim of the identity fraud resides or is found. Accordingly, in a proceeding under this article, the crime will be considered to have been committed in any county where the person whose means of identification or financial information was appropriated resides or is found, or in any county in which any other part of the offense took place, regardless of whether the defendant was ever actually in such county.

§16-9-121

A person commits the offense of identity fraud when without the authorization or permission of a person with the intent unlawfully to appropriate resources of or cause physical harm to that person, or of any other person, to his or her own use or to the use of a third party he or she:

(1) Obtains or records identifying information of a person which would assist in accessing the resources of that person or any other person; or

(2) Accesses or attempts to access the resources of a person through the use of identifying information.

Article 8: (2) 'Business victim' means any individual or entity that provided money, credit, goods, services, or anything of value to someone other than the intended recipient where the intended recipient has not given permission for the actual recipient to receive it and the individual or entity that provided money, credit, goods, services, or anything of value has suffered financial loss as a direct result of the commission or attempted commission of a violation of this article.

Hawaii (39)

§ 708-839.6-8

(1) A person commits the offense of identity theft in the first degree if that person makes or causes to be made, either directly or indirectly, a transmission of any personal information [of another] by any oral statement, any written statement, or any statement conveyed by any electronic means, with the intent to:

(a) Facilitate the commission of a murder in any degree, a class A felony, kidnapping, unlawful imprisonment in any degree, extortion in any degree, any offense under chapter 134, criminal property damage in the first or second degree, escape in any degree, any offense under part VI of chapter 710, any offense under section 711-1103, or any offense under chapter 842; or

(b) Commit the offense of theft in the first degree [from the person whose personal information is used, or] from any [other] person or entity."

§708-800 ""Personal information" means information associated with [an actual] a real person, alive or dead, other than the person transmitting the information, or a fictitious person that is a name, an address, a telephone number, an electronic mail address, a driver's license number, a social security number, an employer, a place of employment, information related to employment, an employee identification number, a mother's maiden name, an identifying number of a depository account, a bank account number, a password used for accessing information, or any other name, number, or code that is used, alone or in conjunction with other information, to confirm the identity of an actual or a fictitious person."

Main (45)

§905-A. Misuse of identification 1. A person is guilty of misuse of identification if, in order to obtain confidential information, property or services, the person intentionally or knowingly:

A. Presents or uses a credit or debit card that is stolen, forged, canceled or obtained as a result of fraud or deception; [1999, c. 190, §3 (NEW).]

B. Presents or uses an account, credit or billing number that that person is not authorized to use or that was obtained as a result of fraud or deception; or [1999, c. 190, §3 (NEW).]

C. Presents or uses a form of legal identification that that person is not authorized to use. [1999, c. 190, §3 (NEW).][ 1999, c. 190, §3 (NEW) .]

Oklahoma (25)

§21-1515.

Any individual, corporation, or other person, who, with intent to defraud or to aid and abet another to defraud any individual, corporation, or other person, of the lawful charge, in whole or in part, for any telecommunications service, shall avoid or attempt to avoid or shall cause or assist another to avoid or attempt to avoid any such charge for such service:

(a) by charging such service to an existing account, or using such

services from an existing account, telephone number or credit card number without the authority of the subscriber thereto or the legitimate holder thereof; or

(b) by charging such service to a nonexistent, false, fictitious, orcounterfeit account, telephone number or credit card number or to a suspended, terminated, expired, cancelled or revoked telephone number or credit card number; or

(c) by use of a code, prearranged scheme, or other similar strategem or device whereby said person in effect sends or receives information; or

(d) by rearranging, tampering with or making connection with any facilities or equipment of a telephone or other communications company, whether physically, inductively, acoustically, or electrically, or by utilizing such service, having reason to believe that such rearrangement, connection, or tampering existed or occurred;

shall be guilty of a misdemeanor, and shall, upon conviction thereof, be imprisoned not exceeding one (1) year or fined not exceeding One Thousand Dollars ($1,000.00), or both, in the discretion of the court.

Rhode Island (34)

§11-49.1-3. Identity fraud. -- Any person who shall:

(1) Knowingly and without lawful authority produce an identification document or a false identification document; or

(2) Knowingly transfer an identification document or a false identification document knowing that such document was stolen or produced without lawful atuhority; or

(3) Knowingly possess with intent to use unlawfully or transfer unlawfully five (5) or more identification documents (other than those issued lawfully for the use of the possessor) or false identification documents; or

(4) Knowingly possess an identification document (other than one issued lawfully for the use of the possessor) or a false identification document, with the intent such document be used to defraud the United States, the State of Rhode Island , any political subdivision thereof or any public or private entity; or

(5) Knowingly produce, transfer, or possess a document-making implement with the intent such document-making implement will be used in the production of a false identification document or another document-making implement which will be so used; or

(6) Knowingly possess an identification document that is or appears to be an identification document of the United States, the State of Rhode Island or any political subdivision thereof or any public or private entity which is stolen or produced without lawful authority knowing that such document was stolen or produced without such authority; or

(7) Knowingly transfer or use, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitues a violation of federal, state or local law; shall be guilty of a felony and shall be subject to the penalties set forth in section 11-49.1-4.

(2) "Identification document" means a document made or card issued by or under the authority of the United States Government, a state, political subdivision of a state, a foreign government, political subdivision of a foreign government, an international governmental or an international quasi-governmental organization which, when completed with information concerning a particular individual, is of a type intended or commonly accepted for the purpose of identification of individuals;

(3) "Means of identification" means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any:

(a) name, social security number, date of birth, official state or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number;

(b) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

(d) telecommunication identifying information or access device as defined in 18 U.S.C. 1029(e).

Wisconsin (15)

§ 943.203

Unauthorized use of a business’s identifying information.

It is unlawful to use identifying information of a person that is not an individual, such as a business, charity, labor union, or any other organization, without that person’s consent to:

* Obtain credit, money, goods, services, employment, or any other thing of value or benefit.

* Harm the reputation, property, person or estate of the individual.

This law prohibits the unauthorized use of information that can be associated with a person through one or more identifiers and any document, card or plate containing this information, such as:

* Name, address or telephone number.

* Employer identification number.

* Depository account number, credit card number, ATM card password, telephone service identifier, or any other account number, password or electronic identifier that can be used to obtain money, goods, services, an account transfer, or anything else of value or benefit.

Violation of this law is a class H felony including up to 6 years in jail and a $10,000 fine.

If a person reports to its local law enforcement agency that the person’s identity has been stolen in violation of this law, the agency shall prepare a report. If the agency concludes it does not have jurisdiction to prosecute the crime, it shall inform the person which law enforcement agency has jurisdiction.

As you can see, the laws in this area are actually quite impressive. I was amazed to find that the identity theft ranking really didn’t seem to have any correlation in this specific area. Some of the states mentioned here, with exceptionally clear laws addressing business identity theft, rank pretty low in identity theft complaints. Yet- Arizona and California, ranking first and second respectively, certainly fall into this category.

Finally, the last group were four states which I felt the laws were very vague and unclear. I was unable to find court rulings or definitions that clarified if businesses were included in the laws. Two are from the bottom half of the rankings, two from the top half. Much to my surprise, rank here does not seem to make a difference in the even the clarity of these laws.

Utah (31)

§ 76-6-1105. Unlawful possession of another's identification documents.

(1) For purposes of this section "identifying document" means:

(a) a government issued identifying document;

(b) a vehicle registration certificate; or

(c) any other document containing personal identifying information as defined in Subsections § 76-6-1102(1)(d) through (k).

(2) (a) Notwithstanding the provisions of Subsection 76-6-1102(3), a person is guilty of a class A misdemeanor if he:

(i) obtains or possesses an identifying document with knowledge that he is not entitled to obtain or possess the identifying document; or

(ii) assists another person in obtaining or possessing an identifying document with knowledge that the person is not entitled to obtain or possess the identifying document.

(b) A person is guilty of a third degree felony if he:

(i) obtains or possesses multiple identifying documents with knowledge that he is not entitled to obtain or possess the multiple identifying documents; or

(ii) assists another person in obtaining or possessing multiple identifying documents with knowledge that the person is not entitled to obtain or possess the multiple identifying documents.

(c) For purposes of Subsection (2)(b), "multiple identifying documents" means identifying documents of two or more people.

§ 76-6-1102. Identity fraud crime.

(1) As used in this part, "personal identifying information" may include:

(a) name;

(b) birth date;

(d) telephone number;

(e) drivers license number;

(f) Social Security number;

(g) place of employment;

(h) employee identification numbers or other personal identification numbers;

(i) mother's maiden name;

(j) electronic identification numbers;

(k) electronic signatures under Title 46, Chapter 4, Uniform Electronic Transactions Act; or

(l) any other numbers or information that can be used to access a person's financial resources or medical information, except for numbers or information that can be prosecuted as financial transaction card offenses under Sections 76-6-506 through 76-6-506.4.

(2) (a) A person is guilty of identity fraud when that person:

(i) obtains personal identifying information of another person whether that person is alive or deceased; and

(ii) knowingly or intentionally uses, or attempts to use, that information with fraudulent intent, including to obtain, or attempt to obtain, credit, goods, services, employment, any other thing of value, or medical information.

§ 76-6-506. Financial transaction card offenses -- Definitions.

As used in this part:

(1) "Authorized credit card merchant" means a person as defined in Section 68-3-12 who is authorized by an issuer to furnish money, goods, services, or anything else of value upon presentation of a financial transaction card by a card holder and to present valid credit card sales drafts to the issuer for payment.

(2) "Automated banking device" means any machine which, when properly activated by a financial transaction card or a personal identification code, may be used for any of the purposes for which a financial transaction card may be used.

(3) "Card holder" means any person or organization named on the face of a financial transaction card to whom or for whose benefit a financial transaction card is issued.

Vermont (47)

§ 2030. Identity theft

(a) No person shall obtain, produce, possess, use, sell, give, or transfer personal identifying information belonging or pertaining to another person with intent to use the information to commit a misdemeanor or a felony.

(b) No person shall knowingly or recklessly obtain, produce, possess, use, sell, give, or transfer personal identifying information belonging or pertaining to another person without the consent of the other person and knowingly or recklessly facilitating the use of the information by a third person to commit a misdemeanor or a felony.

(c) For the purposes of this section, "personal identifying information" includes name, address, birth date, Social Security number, motor vehicle personal identification number, telephone number, financial services account number, savings account number, checking account number, credit card number, debit card number, picture, identification document or false identification document, electronic identification number, educational record, health care record, financial record, credit record, employment record, e-mail address, computer system password, or mother's maiden name, or similar personal number, record, or information.

(d) This section shall not apply when a person obtains the personal identifying information belonging or pertaining to another person to misrepresent the person's age for the sole purpose of obtaining alcoholic beverages, tobacco, or another privilege denied based on age.

(e) It shall be an affirmative defense to an action brought pursuant to this section, to be proven by a preponderance of the evidence, that the person had the consent of the person to whom the personal identifying information relates or pertains.

(f) A person who violates this section shall be imprisoned for not more than three years or fined not more $5,000.00, or both. A person who is convicted of a second or subsequent violation of this section involving a separate scheme shall be imprisoned for not more than 10 years or fined not more than $10,000.00, or both. (Added 2003, No. 155 (Adj. Sess.), § 4, eff. June 8, 2004.)

Virgina (18)

§ 18.2-186.3. Identity theft; penalty; restitution; victim assistance.

A. It shall be unlawful for any person, without the authorization or permission of the person or persons who are the subjects of the identifying information, with the intent to defraud, for his own use or the use of a third person, to:

1. Obtain, record or access identifying information which is not available to the general public that would assist in accessing financial resources, obtaining identification documents, or obtaining benefits of such other person;

2. Obtain money, credit, loans, goods or services through the use of identifying information of such other person;

3. Obtain identification documents in such other person's name; or

4. Obtain, record or access identifying information while impersonating a law-enforcement officer or an official of the government of the Commonwealth.

B. It shall be unlawful for any person without the authorization or permission of the person who is the subject of the identifying information, with the intent to sell or distribute the information to another to:

1. Fraudulently obtain, record or access identifying information that is not available to the general public that would assist in accessing financial resources, obtaining identification documents, or obtaining benefits of such other person;

2. Obtain money, credit, loans, goods or services through the use of identifying information of such other person;

3. Obtain identification documents in such other person's name; or

4. Obtain, record or access identifying information while impersonating a law-enforcement officer or an official of the Commonwealth.

C. As used in this section, "identifying information" shall include but not be limited to: (i) name; (ii) date of birth; (iii) social security number; (iv) driver's license number; (v) bank account numbers; (vi) credit or debit card numbers; (vii) personal identification numbers (PIN); (viii) electronic identification codes; (ix) automated or electronic signatures; (x) biometric data; (xi) fingerprints; (xii) passwords; or (xiii) any other numbers or information that can be used to access a person's financial resources, obtain identification, act as identification, or obtain money, credit, loans, goods or services.

Wyoming (17)

§ 6-3-901. Unauthorized use of personal identifying information; penalties; restitution.

(a) Every person who willfully obtains personal identifying information of another person, and uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services or medical information in the name of the other person without the consent of that person is guilty of theft of identity.

(b) As used in this section "personal identifying information," means the name, address, telephone number, driver's license number, social security number, place of employment, employee identification number, tribal identification card number, mother's maiden name, demand deposit account number, savings account number, or credit card number of an individual person.

(i) A misdemeanor punishable by imprisonment for not more than six (6) months, a fine of not more than seven hundred fifty dollars ($750.00), or both, if no economic benefit was gained or was attempted to be gained, or if an economic benefit of less than one thousand dollars ($1,000.00) was gained or was attempted to be gained by the defendant; or

(ii) A felony punishable by imprisonment for not more than ten (10) years, a fine of not more than ten thousand dollars ($10,000.00), or both, if an economic benefit of one thousand dollars ($1,000.00) or more was gained or was attempted to be gained by the defendant.

As you can see, this final group was difficult to categorize. Even after consulting a former attorney and current legal process specialist for a major bank, I was unable to appropriately place them in the other groups. Finally, I created a group just for these four states and attempted to provide all the relevant legislation I could find so that other identity theft risk management specialists may refer to them in hopes of navigating this murky landscape.

Although my theory regarding the number of identity theft complaints and the likelihood of a state to have a specific identity theft law was not spot on; I was pleasantly surprised by the number of states that seemed able to address identity theft because of existing definitions of the word “person”. I also have great hope that by grouping the information together in this format will provide a reference tool for those who are interested in this legislation and reforming it.

The results of the analysis of these groups is incredibly helpful: I composed an excel file containing the applicable links, law summaries, definitions and rankings for reference. As far as I have been able to determine this is the first comprehensive study of its kind, and will hopefully be a resource to allow advocates and investigators better anticipate each state’s legislative challenges and resources when handling this emerging crime.

Online Safety - KATU

2010-03-02T20:36:00.001-08:00

Medical Identity Theft

2009-11-24T08:49:00.001-08:00

Quarantine

2009-08-04T10:17:00.000-07:00

Joe has an email account he has had for over 10 years. He emails coworkers, friends, and family from the account regularly. His mother still sends him e-birthday cards every year. It is used for Turbo Tax, his online banking, and he often emails projects from his work email to his personal email so he can work on the finishing touches from home. His order confirmation emails for Ebay, Amazon, and Travelocity all go to the same email. His doctor’s office and insurance send him appointment reminders and paperless statements to that address. Recently, when he requested an address change online with his bank, the DMV and the Post Office and he was pleased to find he could do it all paperless. He’s very environmentally conscious, and keeps meticulous records. Joe, in fact, is pretty average.

This email address for Joe is about as firmly established as his identity as a credit report- it contains details of his finances, his address history, and his birthday just as a credit report would. His address book reveals his mother’s maiden name, and a compromise of the account could easily result in his tax information and social security number being revealed. A compromise or lockout of this account could be devastating. He doesn’t have a paper copy or other access to those email addresses. In some cases, the only contact information he has for people is email. If someone were to gain access, he would not be the only target. All those individuals in his address book would be contacted and extorted for money. It will take Joe a long time to try to track them all down and warn them, and by that time it is probably already too late. His company might be blackmailed based on intellectual property gained from the compromise. His accounts could be taken over and emptied, his identity stolen and used for credit cards, utilities and medical services. A routine traffic stop might result in jail time while law enforcement figures out that there was a fake ID provided during a DUI stop. With the information available in that email, Joe’s life can be stolen lock, stock and barrel.

If your email is this tied up with your identity, it is important to protect it. When you use your email address to sign up for services or profiles, you are adding another avenue to attack your account. How do you quarantine an email?

Security experts actually recommend that, “A good rule of thumb for the average email user is to keep a minimum of three email accounts. Your work account should be used exclusively for work-related conversations. Your second email account should be used for personal conversations and contacts, and your third email account should be used as a general catch-all for all hazardous behavior.”

Take inventory. Make a list of all the websites you have attached to your email, all the contacts in your address book and anyone you regularly contact via that account. The average user has about 12 online accounts registered with their main email. Then, go through your folders and archived emails and scan them so you have a good idea exactly what is in your account.

Make sure you have a disaster plan. After you have taken inventory, think about what you would do if you were to suddenly loose all access to that email. Are your documents backed up? Do you have phone numbers for your contacts so you can warn them? Do the websites attached to your email account have a 24/7 toll free line for assistance? Do you have any of this contact information for the companies or persons in a non-technical format in case your entire computer is compromised?

Never use the trusted email or part of the email address as a username. Never use the same usernames and passwords for all accounts. Also, many services are now offering an option to force your password to expire periodically (live.com has an option for 72 day expiration, for example). Find your security settings and use them.

Many websites now offer the ability to register two email accounts with your profile. If the option is available, use it. Create an isolated, secure email and keep it safe. This way, if your email is compromised or the profile hacked you still have a second account you can communicate the issues with the company or retrieve a password.

When signing up for social networking sites, use an email account just for that site or your “catch all” email. This prevents hackers from gaining access to your trusted email through the site or from scammers spoofing your email to try to extort money from your list of contacts. People will be more suspicious of an email coming from FacebookJoe@domain.net than from youtrustedemail@sinceforever.com and it will give you time to contact them to tell them of the fraud.

Never use your trusted email for comments, blogging, chatting, or any online forms. Your trusted email should be for communicating with real people only. There are plenty of services out there that will set up dummy email addresses for free. This allows you to keep your email address secure but still give contact information out and receive communication at the same inbox. If the dummy email address becomes tainted, you can easily amputate by shutting down the address entirely. Just Google “disposable email address” or “temporary email address” and you will find plenty of services to choose from.

Don’t unsubscribe from mailing lists you suddenly find yourself on. Clicking on the “unsubscribe” link or hitting reply could verify your account as “live” to a scammer. Instead, block the email address you are receiving the subscription from.

Determine if mobile banking risk is worth the convenience. Does your phone have antivirus? Can you get an antivirus? Contact your service provider and determine if there are additional security settings you can select. For more information on cell phone and smart phone security from the US government, click here.

Be cautious of wi-fi. There are plenty of cyber criminals out there who set up unsecured wireless connections in common hot spots to try to catch someone doing a little online banking or email while sipping their coffee. Check your wireless connection at home and in the office- is it secure? Encrypted?

When sending highly sensitive information, consider using encryption or stenography for the message and data.

Be discriminating about sending forwards. If the email were to fall into the wrong hands, a crook can use the contacts in the email to try to scam everyone included on the communications.

Don't let embarrassment keep you from doing your part in reporting the incident to authorities. Remember that cybercrime is serious, and should be reported to the FBI's Internet Crime Complaint Center at ic3.gov and to your email provider, typically at abuse@[yourdomain.com].

Business Identity Theft - Dangers, Gaps, Solutions

2009-07-29T19:52:00.000-07:00

I stress that these views are mine and influenced by the works cited here, they are not necessarily the views of ID Experts.

UPDATE 08/06: Panda Security reports 44% of SMBs admit falling victim to cybercrime.

Yet, small and medium sized businesses (SMBs) are an attractive target for identity thieves. According to the Institute of Consumer Financial Education (ICFE), SMBs usually qualify for larger lines of credit, “enjoy extended payment terms and less transactional scrutiny for large purchases or high value ticket items than individual customers.” They often have physical property such as computer equipment of value, or perhaps inexperienced employees that may be susceptible to phishing attempts or bribes. Many SMBs are located in shared business buildings, making it even easier to obtain credit cards and loans. All a criminal has to do is rent a small space or mailbox in your building- the address will verify as correct, and he’ll get the credit cards, loan documents, and bills instead of you. Before you even know something is wrong, he has skipped town without a trace- except for the damage to your business.

* (44 percent) were hit by some form of cybercrime

* (10 percent) surveyed were hit so bad that they had to stop production -- worldwide, the average was 30 percent.

* (50 percent) of companies in the survey lost time or productivity as a result of being infected.

When you combine large cash /credit flow and little scrutiny or security, it is easy to see what a gold mine this is to thieves. I’m not done yet- There is another factor that makes these threats an increasing danger in an age of government transparency and online communications. Not only are you an attractive target, but obtaining the documentation necessary to impersonate a business or pose as a representative of the business is often easier than for an individual.

Your business information is easily obtained from a variety of offline and online sources. Business stationary and business cards are easy to obtain and duplicate, and since “most businesses are eager to open new accounts for other businesses, and the process can be quite simple- such as submitting a request on company letterhead along with the business license number and Tax ID.” (ICFE) Since most businesses display their business license on their wall (as many are required to by law), this theft is dangerously easy. Additionally, businesses may engage in high-risk sharing of their business information. Because many companies such as Costco require an EIN to give users status as a business, the EIN is tossed around a lot on documents and over the phone. Small business owners may even be using their own social security number in place of an EIN, increasing their risk and potential for damage. SMBs aren’t just a gold mine; they’re a gold mine filled with diamonds.

There are unfortunate gaps in our system. There are hundreds of companies, pre-paid legal services, private investigators, non-profits and consumer advocacy groups that are trained and versed in handling personal identity theft- but find themselves either unprepared or unable to assist businesses when they become victims. Their hands are often tied by either state laws, procedural technicalities, binding contracts and user agreements or just plain ignorance.

As pointed out in a recent article by Business Week, “While business identity theft can often be prosecuted under other statutes, like mail fraud or wire fraud, businesses victimized lose many of the protections afforded to consumers under identity theft laws, like access to information about their credit. Before California last year amended its 1997 identity theft law explicitly to include crimes targeting business entities, a business whose identity had been co-opted could not even get a police report. ‘We were having businesses being taken over and their names being used and I could not prosecute them, at least under ID theft statutes,’ California Deputy Attorney General Robert Morgester says.” (The state legislature amended the “person” in identity theft cases to encompass associations, organizations, partnerships, businesses, trusts, companies and corporations, in addition to logos and “photographic representation” as legally recognized personal ID data.) Yet, there are many other states that still do not recognize business identity theft as a separate crime at all.

A thief with access to EIN, address, key names, and letterhead or company logos can easily apply for credit or obtain loans and merchandise as a “representative” of your company. There are painful gaps in consumer law and business practices that make the extensive, time-consuming, complex and potentially expensive process of recovering from identity theft even harder. Dealing with the theft can take months or years. Don’t take chances, and protect yourself:

Shred. Shred. Shred. Dumpster diving is still a common source of information.

Don’t hold onto documents any longer than absolutely necessary.

Obtain an EIN and use it instead of your SSN. Be cautious with your EIN and give it out sparingly.

Obtain regular credit reports for yourself and your business. Review them carefully.

Review your Better Business Bureau report regularly. In addition to identity theft, business can also become the victim of professional impersonation. In many cases, evidence of both types of crimes will show up on the BBB report.

Owners should review transactions statements and account for all items. If you give review power to another individual, be aware they are now a target for bribes and extortion. The best solution is to take matters into your own hands and report any unusual activity immediately.

Improve your business physical, technical, and personal security. Alarms, firewalls, encryption and anti-virus are all important components, but more important is the education of you and your staff. How to detect and deter phishing attacks, how to report suspicious behavior anonymously, and what to do if you believe you may have compromised information are all topics every employee should know by heart.

Be an informed consumer- ask what precautions businesses take with your applications and other business identifying documents and data. Explain your concerns. Enough business owners bring up these concerns, they will listen.

Other advice includes;

“Consider using electronic payment options. Since the networks are password-protected and the messages are encrypted, wire transfers and ACH payments are much safer than using paper checks…

And lastly, consider a post office box or a lockbox for your mail. This ensures that business mail is retrieved by appropriate personnel and is not left in a box at the reach of any passerby.”

Practical advice for changing the outlook for SMBs: Put your money where your mouth is, and the squeaky voting wheel gets the grease. Do business with companies with good security practices- even if it means it makes it more difficult to do business with them. Write to your representatives and voice your concerns. Bring awareness to the dangerous of identity theft for small and medium businesses to your associates, your lawmakers and your financial institutions. If legislation regarding personal identity theft rights is any indication, it is going to require a concerted grass roots effort to bring awareness to the issue and create change. It is time.

UPDATE 07/30/2009: Another threat to businesses highlighted by the Better Business Bureau, "Scam artists send an invoice for a product commonly purchased by the business. For example, paper or other office supplies, in hopes that the busy staff will pay the funds without question."

Video- Facebook Hacking, Don't Fall Victim

2009-07-28T12:51:00.000-07:00

My 15 minutes of fame. Hope you enjoy.

Getting Engaged can lead to Identity Theft

2009-07-23T14:34:00.000-07:00

republished from ID Experts blog.

A few news stories have been circulating about the looming identity theft threat to couples who have decided to tie the knot. Thieves prey on our deepest and strongest emotions, and two people madly in love and about to take the plunge are certainly full of emotions and stress. Stress makes us more apt to decide quickly, without thinking the situation through. The sense of relief we feel may encourage us to accept an offer that seems “too good to be true” when we might otherwise hesitate. Our families and friends may also be targeted, for much the same reasons. Think like a thief- on average weddings cost over $20,000 and guest gifts range between $50-150 each. That places a rather large bulls-eye on anyone involved. Here is just a small list of the kinds of scams that are lurking out there:

Fake vendors- these are identity thieves or card frauders. They are online, at bridal shows, and call individuals out of the blue. You may be even approaching them for a genuine service advertised in the classifieds or a bridal magazine, or it may be a “sweepstakes”. As part of the “contract” or “application” you answer personal questions in great detail or provide a credit card number that is later used to defraud you.

Fraud vendors- this category is not technically identity theft, but still leaves you stung. Often you are promised a “free” sample and hand over your credit card for shipping and handling, and then find yourself with outrageous charges. Vendors take a deposit for renting you an item as pictured on their site, and when the big day comes, nothing arrives or what arrives bears little resemblance to the model. Sweepstakes and Giveaways should be especially scrutinized if you get a call and you “won” – there may be strings attached.

Crooks- these people take advantage of the fact you share so much about your event. They may rob your house while you’re exchanging rings, or wait until you’re away on honeymoon. While everyone at the reception is distracted, they snatch purses or sneak into hotel rooms. Honeymooners are easily targeted by pickpockets, camera snatchers, and hustlers.

Disappearing act- this can be anything from a deposit you paid disappearing from the books to a company suddenly going bankrupt. Bankruptcies are up 47% from last year, so this is a big concern. While insurance can help protect you, it is important to purchase coverage carefully.

Malware - There are tons of “free” applications out there to help out couples. Cost calculators, dress design software, websites, countdown clocks, reminders, calendars, the list goes on… Then there are the flash animations and videos of weddings, decorations, crafts, flowers and more. However, some of these may contain harmful code that could harvest your information and place you at risk for identity theft and fraud.

Robocalls and junk mail – While shopping around online or in person, you’re often asked to leave your contact information. This can result in an increase in junk mail offers and robocalls. Some of these are likely phishing attempts, and are cleverly disguised. Another risk with increased junk mail is the possibility of mail theft going unnoticed for a longer period of time. Pre-approved credit card offers may inflate your mailbox, also increasing your risk of fraud.

“In distress” scam- this is commonly used while a couple is on honeymoon, but can strike at any time. Fraudsters may call, email, or take over your email or social networking accounts to contact your friends and family claiming to need emergency money. Excuses range from medical emergencies, to being kidnapped. Often they have “been robbed” and need the money to get home. The rest is ALWAYS to wire money or send Western Union.

YOU – of all the threats, YOU might be your own worst enemy. Many couples have wedding announcements; send emails, e-vites, wedding websites, social networking pages, online gift registries with their personal information, personal details, family details, and wedding, reception and honeymoon specifics available to the public at large. Brides and grooms alike tend to become excited and may share greater detail about themselves, their partners and the event with coworkers and friends… and florists, photographers, DJs (or anyone else who will listen).

With a few minor changes and some awareness, you can still have all the bells and whistles to your big day while keeping your friends, family and your identity safe.

Assume the numbers and addresses you are using to contact vendors, get quotes, order catalogs are going to be stolen, traded and sold over and over. Set up a PO Box and a separate number to use for your contact information.

Contact the Better Business Bureau in your area about any vendor, sweepstakes, or service you are going to fork over a large amount of money to, or that you are unfamiliar with. Do this before you provide them any personal or contact information.

Always assume that calls you receive are compromised and never reveal any personal information. You may trust calls you initiate to a trusted business more, but still exercise caution.

Read ALL fine print carefully. TWICE.

Keep all receipts; require everything in writing and document, document, document. Go over all your credit card and bank statements monthly and notify your financial institution right away if you notice any unusual activity.

Quarantine. Don’t use the same passwords or email account for your social networking sites, registry, and wedding webpage. You should never attach your “trusted” email account you have been using to communicate with your friends and family to another site. A compromise of a social networking site can easily lead to an email compromise, and makes it easier for fraudsters to contact your entire address book for money. If your quarantined email is hacked and messages sent to all your friends, they should be more cautious since it is a different email than they are used to communicating with you. This will buy you enough time that you can then use your “trusted” email account to notify them all of the fraud (or better yet- call them!).

Never send money Western Union- this is one of the few ways you can send money and never get it back. Provide contact information to their nearest consulate if you are met with this scam online.

Limit access to personal information- If you are going to list the details of your big day and honeymoon, look for websites that allow you to create a wedding website for friends only, or that is password protected so you can control who has access.

Be careful of accidentally revealing personal information like your mother’s maiden name (which may be derived from guest lists or online friend list on social networking sites) and your date or place of birth. Also, you will be asked a lot of questions so people can “get to know you” before your big day- make sure none of these questions and answers correspond to the security questions of any account you have. Go through each online account and determine what questions are asked if you click “I forgot my password”. You may wish to change those answers.

Find gift registries that allow you to control privacy, and insist on revealing as little about yourself as possible. Gift registries often offer a disturbing amount of detail about you, and often are generally open to the public.

Check your credit reports regularly with www.annualcreditreport.com or by calling 1-877-322-8228. If you do experiance fraud or a scam, report it to your Better Business Bureau and the FTC and place fraud alerts with the major credit bureaus.

Recession: A Survival Guide

2009-07-07T19:17:00.000-07:00

Republished from my contributions to the ID Experts blog.

During this difficult economic time, the problem with scams and fraud is threefold. First, people who are desperate are more willing than ever to “bite” on the lure of convincing scams because of they are under increasing financial stress and pressure. Second, the number of scams and people perpetrating those scams increases during difficult financial times. Third, according to a recent survey by Nationwide Insurance, over half of respondents don’t know if they have enough money to weather fraud. Additionally, “A 2005 Nationwide survey showed the average amount of total charges made using a victim’s identity was $3,968. While most victims were not held responsible for fraudulent charges, 16 percent reported paying an average of $6,440 to cover some or all of the thief’s purchases.”

You may be surprised to find out that spotting a scam it is not as easy as you think. The FTC points out, “[scam] claims are just good enough to be believable; their services and products just practical enough to seem legitimate. Some even try to look like a government agency to enhance their credibility.” Here is a quick rundown of the four most critical issues: Debt, housing, employment and government assistance.

Credit repair / Debit Negotiation companies

The dirty scam: These companies advertise anything from outlandish claims (“We can remove ANY debt from your credit report!”) to carefully veiled suggestions (“We know the tricks that your credit card company doesn’t want you to know”). Almost all of them require an upfront fee, and almost none of them deliver on their promises. The IRS highlighted concerns in this report, stating, “Many credit counseling organizations provide valuable advice, education and assistance to those seeking to better manage their debt. But an increasing number of complaints to federal and state agencies indicate that some organizations are engaging in questionable activities.” The report includes some handy tips for detecting deceptive companies. The FTC also has some great advice for those “Knee Deep in Debt” or considering one of these companies, as well as the Better Business Bureau. These reports cover dirty scams and provide detailed information about the process, general advice on debt practices, and resources for assistance.

The clean scene: The U.S. Department of Justice’s U.S. Trustee Program provides a list of government-approved credit counseling agencies. The National Foundation for Consumer Counseling provides a list of member agencies online at www.nfcc.org or call 1-800-388-2227 for 24-hour automated office listings. Look over this Fiscal Fitness: Choosing a Credit Counselor document from the FTC, and this new site discussing debt and scams including vehicle repossession, advance fee loans, ‘anyone can get credit’ card offers, debt negotiation and other scams that are increasing with the economic difficulty.

Home refinance or foreclosure scams, loan modification programs

The dirty scam: Taking advantage of the panic in the market, thieves and scammers are contacting victims for loan negotiation, refinance or foreclosure scams. Using complete lies and half-lies, they never deliver what they promise. They could be pretending to offer assistance for your current situation, or offering you a remarkable deal on a foreclosed property. It could be a rent-to-buy or bait-and-switch scam. Victims find they lose money, turn over personal information and/or complete documents that result in damages and financial loss. They can represent legitimate companies with bad business practices, or complete frauds pretending to be from the government ready to inform you how you can benefit from the economic stimulus package. For more information on these types of scams and the red flags to look for, read the highlight by the FTC here.

The clean scene: Be very suspicious of these offers. Check with the attorney general in your state before dealing with any company or person offering assistance. Details on the Federal assistance available to homeowners can be found at http://www.makinghomeaffordable.gov/ . Or, you can contact the Homeownership Preservation Foundation's national hotline at 1-888-995-HOPE. They provide free bilingual assistance to help homeowners avoid foreclosure. HPF is a member of the HOPE NOW Alliance of mortgage servicers, mortgage market participants and counselors. Read more about HOPE NOW at www.hopenow.com. You can also check with the US Department of Housing and Urban Development, and the Federal Reserve’s Foreclosure Resources for Customers. The FTC and Freddie Mac both offer helpful sites for those who are feeling the pressure of mortgage payment or trying to avoiding foreclosure. The Federal Reserve also recommends checking out NeighborWorks. You can also listen to a recent NPR broadcast about these scams.

Employment fraud, classifieds fraud

The dirty scam: Unfortunately, finding a job poses many risks. First, you must be careful about the amount of personal information you place on a resume or online application. Remember that disclosing your social security number and birth date should only be necessary when they are ready to hire you and complete tax information. Even seemingly harmless details, such as the exact dates and companies you worked for, the colleges you attended, and your address, can result in identity theft or professional impersonation (when a thief takes the details of your professional life and presents them as his or her own to land a job). Additionally, you must exercise caution about the ads you respond to and the contacts you receive offering a job. A rule of thumb to remember: if it sounds too good to be true, it probably is. Avoid any job that asks you to cash checks, wire money, or use Western Union on the job. Let’s start with a short list of job scams (and the links to resources regarding them)… ‘Placement service’ for government jobs, head hunters, temporary employment, work-at-home or online jobs, and classifieds fraud.

The clean scene: Resources for government jobs are USAJOBS, US Postal Service Employment, FirstGov, and the Department of Labor. According to the FTC, “Some ads may direct you to call a toll-free 800-number. Once you're connected, you may be switched to a pay-per-call 900-number without your knowledge, or you may be asked to call a 900-number without a proper fee disclosure. Both practices are against the law… Many terms, such as employment agency, personnel placement service, executive search firm, or executive counseling service are used interchangeably. Find out what services a firm offers, how much the services cost, and who pays. If you're required to pay the fee, find out what you'll owe if the employment service fails to find you a job or any leads.” Check suspicious opportunities with the Better Business Bureau, your state Attorney General’s Office, or consumer protection agency. Read these tips from ScamBusters. Find online job hunting privacy tips and a background check fact sheet at Privacy Rights Clearinghouse. As many people are trying to find extra income, we would like to caution people about responses to their classified or craigslist ads. If someone is offering to pay you more than you asked for a service or item don’t do it! Usually they create an elaborate reason that they need you to cash a check and then wire the extra funds to them, or they get you to provide your account number so they can empty your account.

Financial assistance from the government

The dirty scam: Letters, phone calls, emails, text messages- there is nothing that they won’t try! Websites and representatives claim to be able to access “secret” government money and help you apply for it. Usually they want an upfront “processing fee” or sometimes just your personal information. The FTC describes it as, “An email, online ad, or website says you’re eligible to get an economic stimulus payment. You just have to send back a form or submit one online to get it. The message might appear to come from a rebate company or look like it’s straight from the Internal Revenue Service (IRS).

There’s more than one way to perpetuate a stimulus scam. Some scam artists ask you to send a small processing fee, supposedly to get a much larger check in return. That’s money you’ll never see again. Others skip the fee, and instead, ask for your bank account number so they can ‘deposit’ your check. Then, they use the information to clean out your account or open new ones using your identifying information.Some stimulus scams encourage you to click on links, open attached forms, or call phony toll-free numbers. But simply clicking the link or opening the document can install harmful software, like spyware, on your computer. The result could be your personal information ending up in the hands of an identity thief. If you get a message offering you money from the stimulus program in exchange for your personal information, ignore it, delete it, or throw it out. The IRS doesn’t send emails asking for personal information, and rebate companies claiming to have stimulus payments for you should not be trusted, regardless of how plausible the script sounds or how official the forms look.”

The clean scene: Legitimate information about government grants and assistance can be found at www.recovery.wa.gov, www.grants.gov, www.studentaid.ed.gov, www.govbenefits.gov and www.sba.gov. Information for stimulus payments and refunds can be obtained directly from IRS.gov. Do NOT click on any hyperlink contained in an email, type the address directly into your browser. You can check up on your stimulus checks here.

If you are prepared, think critically, and proceed with caution, you should be able to determine the scams from the real deal. There are good habits you can form during this time as well. Using cash as a way to limit spending, and limit the number of places you use your card can help your wallet and prevent identity theft. As the economy starts to improve and the panic resides remember that identity thieves don’t just go away. Accounts can be opened now that will not appear on your report for years. Protection now, and in the future, is vital to keeping your identity safe

A special thank you to Washington's Attorney General's office and many other AG offices for providing much of this material.

So Called Identity Theft "Protection" - A Soapbox

2009-07-06T20:40:00.000-07:00

Almost daily someone asks me about identity theft protection or identity theft insurance. Usually, they are just interested in what I personally think is the “best” product out there for protecting yourself from identity theft. Remember- It is not “if” your information will be exposed, but when- and with how much damage.This is my personal rant-my soapbox about the types of "identity theft protection" products out there.

Spoiler alert: There isn’t an effective identity theft protection product.

Typically, a company claiming to be an identity theft protection company will provide one or all of these services; access to credit reports, credit monitoring, and database monitoring. Unfortunately, these services cause security problems themselves. First, you are often required to provide all your personal information to a company so they can provide your credit report. Insider threat aside, they are charging you for a service you can obtain for free by visiting www.annualcreditreport.com or calling 1-877-322-8228. You can obtain your own credit report and review it regularly by spreading out the requests made to each credit bureau by four months. Did you know you can also get a free credit report if you dispute an inaccuracy, are currently unemployed or looking for work, or recently had a negative decision made based on your credit? Sure, access to your credit reports is a great tool. However, it is simply a tool. Many who sign up for these services feel that as long as they have “identity theft protection” they don’t really need to watch their credit reports closely. The idea that someone else is monitoring it provides a false sense of security. You are the only one who knows what should be in your credit report, and the only one who can accurately identify early signs of identity theft.

If you have been a victim of identity theft, or have reason to believe so- you can place a fraud alert. A fraud alert also gives you free access to all three credit reports whenever it is placed. The initial fraud alert lasts for 90 days, but can be extended with a police report to seven years. A seven year fraud alert entitles you to TWO free credit reports from each of the credit reporting agencies annually, so as long as the alert lasts. That is 6 reports a year- equating to a different credit report every other month. All for free. The fraud alert is a “flag” on your credit that says you were a victim of identity theft and that companies should take extra steps to verify your identity before extending credit. (This typically involves sending a letter or calling you at home if an application is received). Sound familiar? This is often the advertised “protection” these companies are offering… only it is free. You just need to call (or go online) one of three credit reporting bureaus, and identify yourself as a victim of identity theft who wishes to place a fraud alert. That bureau will then notify the other two. You must respond to the confirmation letters for your fraud alert to obtain your free credit reports, they are not sent automatically.

Security freezes are another question I get quite commonly. Some of the protection companies out there simply place a security freeze on your credit report. This is also a service that is typically free if you have a police report, or live in certain states. With a Security Freeze, lenders will not be able to gain access to your credit file unless you give permission by "thawing" the frozen file using a secret code, similar to a PIN number. However, the process for placing a freeze involves sending a lot of personal information to the credit bureaus- and even more when you forget the pin number. Notice I said “when” and not “if”. In my experience, most people lose the pin number to their security freeze and neglect checking their credit because of the hassle. This, again, lures consumers into a false sense of security. There is plenty of identity theft that can occur if you have a freeze, and in many instances a freeze just makes it more difficult for you to legitimately check your credit reports to discover the suspicious activity. Payday loans, utility accounts, medical identity theft and criminal identity theft can (and do) still occur with a freeze. It is more common for clients with credit freezes to have identity theft that has been occurring for years than clients who find discrepancies when they request their report quarterly, for just this reason. Security freezes should really be utilized by individuals who are experiencing repeated identity theft, and are comfortable corresponding directly with the credit bureaus. Otherwise, some of the most dangerous kinds of identity theft- including medical identity theft- can occur without detection.

Fraud alerts are not perfect- it is up to the company to take precautions in opening an account. Some occasionally ignore the fraud alert and open the account without further verification. Some go to the other extreme and request you physically appear and provide two forms of photo identification before opening an account. Security freezes cannot be ignored, but consumers who use them tend to ignore the types of identity theft that don’t need a credit report to occur yet still appear on the credit report as a symptom of the fraud. Fraud alerts and security freezes don’t apply to your current accounts, so it is important to monitor your statements closely for fraud and notify your financial institution right away. It is a common misconception that identity theft protection services help protect you against fraud on your current accounts- that is not true. It is not safe to provide a third party with enough financial information in order to monitor your transactions, and they would not be able to distinguish most fraud anyway. Clearly fraudulent charges- such as a sudden $3,000 charge from China when your spending habits are always in Michigan- are typically detected by your financial institution (a service they provide for free) and resolved internally.

Most of these companies claim to monitor thousands of databases looking for signs of misuse. Fantastic- except that it doesn’t help you at all. Suppose that one of these programs does notify you that your social security number is being traded like a stock on some black market internet site. Now what? They’re not in the business of tracking down and apprehending these criminals. Often the alert you receive from these services doesn’t even tell you where the information came from, and instead alerts are generic such as “We are alerting you that your address has been changed in public record”. You must go back to the credit reports to find and correct the information. It’s a great reminder to check up on your information- review your SSA earnings statement, EOBs and so forth… but these are all reports and protective steps you can take anyway. For free.

Many of the companies provide a kind of “insurance” component to their services. Read the fine print. Typically insurance only covers actual expenses you incurred such as fax or mailing fees, and occasionally lost wages if you can prove that there was no other way to resolve the identity theft. Strictly identity theft insurance companies don’t fix your credit report for you, they just help with the expense you incur as you embark on the frustrating task yourself. If you cannot afford to take unpaid time off from work (who can in this economy?) this is nearly useless. Even the “guarantees” that are out there are useless since they require that you prove it was a fault in the system that resulted in your identity theft. In the case of many types of fraud, as LifeLock’s Todd Davis found out, their system is not designed to catch it… and therefore, no million dollars.

Identity theft is a scary proposition. Victims spend an average of 330 hours repairing their credit after having their identities stolen, and 70% report making repeated attempts to have inaccurate information removed from their credit reports. Navigating the confusing maze of legislation and paperwork can be daunting, added with the fact that it is nearly impossible to reach a live human at the credit bureaus. Many people are disappointed when they receive no assistance from law enforcement and are frustrated by the complex process of disputing the account. I understand why people want assistance- It is important that you have an expert or group of experts to turn to during this time. I do not intend to specifically promote the company I work for, but I do honestly believe in the work we do for people at ID Experts. You can see from our resources page and blog that we believe in educating consumers and advocating for victims rights. The following is a general recommendation based on my own experience as an identity theft victim, as a consumer, and a security professional.

Consumers should look for is a company that specializes in identity theft restoration. A good company will be willing to spend the time necessary to educate you about free services available to you as a consumer, but will “take over” if you become a victim. From my conversations with clients, I have not heard of another company that takes the time to educate consumers they way we do. The company should also allow you to speak with the same person twice, or allow their representatives to provide their names so you can get consistent answers. Often, just having my direct extension makes all the difference to a client. No identity theft protection service or product is theft-proof, so it is important to have someone to turn to when it fails. Credit monitoring is a great tool- but it is just a tool. It is not an impenetrable shield, but rather a method available to you to assist you in accessing the information you need to protect yourself. Don’t believe me? The FTC and other consumer advocate groups do not recommend these services either.

Teaching a Nation to be Scammed

2009-06-24T18:54:00.000-07:00

Why we open ourselves up to identity theft

Why do people give out their social security number to phishers who call them? Why do they email mortgage applications to fraudulent companies? A few decades ago, we might have been able to explain the problem by lack of education. They just don’t know the dangers or the risks. Today, that is a weaker and weaker argument. Clients contact me all the time reporting that they knew something was strange, or they knew that they should never give information over the phone, but they ignored their inner voice and exposed information anyway. Why?

In part, it is because all of our lives we have been taught how to be scammed. The very agencies that we trust to protect us have instilled habits and patterns that make it easier for criminals to manipulate us. From school to work, from local to federal government, we have unwittingly prepared ourselves psychologically to expose the deepest private details about ourselves. Before privacy and security in this country can really make a revolution, these practices must be changed.
I am not advocating mistrust of the government’s intentions in regards to any certain practice- this is not a conspiracy theory. I am advocating a healthy distrust of the humans who must handle that information. According to a recent article by Robert Siciliano, “As much as 70% of all identity theft is committed by someone with inside access to organizations such as corporations, banks or government agencies, or simply someone who has an existing relationship with the victim.” The point to this article is not the intention of the legislation behind these practices, but rather the citizen training that occurs when procedures become habits.

First, we have been taught to trust authority figures from a very young age. We have not been taught how to verify them. This skill is absent from many people who panic when they receive a message from someone claiming to be their bank. Using the internet, the Better Business Bureau, or referring to the number on their statement or the back of their card often escapes these victims. Why isn’t their first reaction to verify any form of contact? They were never taught to do so. Did you ever verify your teachers? Even in college? Did you check what degree they held, or even if they had a criminal past? Has a police officer ever encouraged you to take their badge information and verify with the local precinct? Unlikely. Children are taught “don’t talk to strangers” but at the same time we instruct children how to identify a police officer in case they need help. This is similar to when credit card company telling consumers never to give their personal information out over the phone, but then calling a consumer to request that same information to verify transactions. Have you ever gotten a list of questions that call center representatives should be asking you to verify your identity? Do you know if it is or isn’t against company policy for them to ask for your full social security number or the last four digits? If you don’t, then you may be exposing your information to an insider threat at that organization, and you may never know.

In addition to trusting authority figures, we are often asked to repeat our social security numbers or use them as identifiers. Each time we say the number in a response to the request, we have made it just a little easier to say again the next time. The more we reveal the number, the less private we feel it is and we tend to treat it as such. One of the biggest points of contention for this point is the military’s use of SSNs as identifiers. Not only does it pose greater risk to those who are protecting our country, but these individuals maybe at a higher risk while deployed or on active duty. Often military personnel do not have the time, access to resources, or ability to communicate with the credit bureaus. It isn’t just the military, although I expect more protection for the troops from them, it is also employers and professionals. All sorts of companies from dental offices to video rental shops have been using SSNs as account numbers or identifiers for decades. Not only does this expose your information to many more potential insider threats, but it also psychologically devalues the information for us. If I use my social security number at the rental store to pick up the newest DVD, it becomes far easier to hand it out to a solicitor offering to place my information in a prize drawing. The same goes for date of birth. I cringe every time I see a promotional offer come in the mail. Usually a post card that says “Happy Birthday! Good for One Free Meal on January 1st.” Nothing like a flyer announcing my birthday to leave a pit of worry in my stomach- there is no such thing as a free meal, right?

Usernames and passwords are also often overlooked. People seem to be aware of how important it is to keep these secure- yet most people (over 50%) use the same user names and passwords for everything. Remember what I said about insider threat? How easy would it be to compromise every bank account and email address you have if just one insider decided to? If your email address and a password are all you use, even better. Once they have access to your email account, all the accounts you have registered with that email become exposed. Some of us may even be exposing our work email, and our companies, with this practice. Some may even be conversing with their doctor through websites using the same information. Although public backlash forced the city to rescind the request, Bozeman recently required that job applicants provide the usernames and passwords for their internet sites. The news spread quickly, I am sure catching the eye of many a potential hacker and insider threats alike. Many professionals use social networking sites such as Twitter or Facebook. Unfortunately, many of the applications for these sites are run by third parties who are not reviewed by the social networking site for privacy or security compliance. Almost universally, your username and password are requested. Again- these sites may do what they repute… but what else is happening with your information? Who else may be looking at it, unbeknownst to you or the third party application?

Finally, biometric data and DNA- while these are being touted as the crowning achievement in security and crime fighting, the dangers associated with its abuse are staggering. The Washington Post reported last year on the expansion of the US DNA database program. With this extension, “The U.S. government will soon begin collecting DNA samples from all citizens arrested in connection with any federal crime and from many immigrants detained by federal authorities, adding genetic identifiers from more than 1 million individuals a year to the swiftly growing federal law enforcement DNA database.” This includes those arrested and not convicted. I understand that when you commit a criminal charge that you lose some rights, including some rights to privacy. However, including this information from people that are not convicted is a dangerous precedent to set. Not only are you denying them the right to privacy, but you are denying them the rights to control their DNA without any criminal charge. This implies that no one has the right to withhold their DNA. Although fingerprint databases are used as a comparison- it isn’t an accurate one. Fingerprints are just a recording of the lines in your fingers. Your DNA contains much more information about yourself and your family. If that DNA is “misplaced”, it is the equivalent of “misplacing” a whole finger- not your print records.

Just as your SSN can be used to verify your identity, and it can also be used to fraudulently use your identity- your biometric data and DNA is the same. Think about the last time you submitted a urine analysis for a job application. Did you hand the cup directly to your manager? No- of course not. You- and the company that hired you- relied on the nurses, lab technicians, truck drivers and others to safely handle the sample and the information corresponding to it. An insider threat here can result in medical history becoming exposed or misrepresented. Still not convinced? Well, while the FBI tries to block attempts at searching for false matches, youth on social networking sites are posting their STD test results. This is the best evidence available to demonstrate the lack of understanding of privacy and security at all levels of society, which is a direct result of the prevading lack of education. I encourage privacy professionals to at least mention to their employer that they think UAs are an invasion of privacy, especially if you “have nothing to hide” from them. If we, in the industry, don’t set the example- there will be no one left to teach others. This is why the attitude of any administration occupying the White House is critical to the whole privacy structure. The only way to teach privacy and security is by example.

Although not the intention, these practices create a “habit” amongst citizens that your blood, salvia and urine are unimportant and should not be protected. For those who claim that only those with “something to hide” should be concerned, let’s look at the lessons we can learn from other DNA databases. Last year, the Daily Telegraph reported that “Millions of profiles on the national DNA database have been handed over secretly to private companies without the consent of those involved”. If biometric information can be bought and sold as a commodity- the world becomes a dangerous place. Losing control over any information that is used to definitively identify is dangerous- be it a social security number, or a sample of blood. Information for background checks are also a category of information we are trained to give without much thought. As an article published just today pointed out, most applicants are unaware of the "likelihood that much of the PII collected during a background check will travel far beyond the security of U.S. privacy laws to a foreign call center or data warehouse with little to no standards for privacy protection... rightful owner of the Personally Identifiable Information does not even have to be notified when it is sent outside of the country... providers continue 'offshoring' personal data to low-cost labor markets by using companies internationally to increase profits..." Further, "Employee personal data can also be 'repurposed' by background check companies and ATS/JBS providers to be used in another format or product, and also resold to skip tracers, lawyers, data aggregators, and marketing lists to be bought and sold again and again. The growing popularity of offshoring, repurposing, and reselling of PII data has led to identity theft and lost privacy." (Pre-employ.com)

Every time you have a person walk through a process of providing private information, you are creating a habit. It makes it easier for them to provide it again. Regardless of the intended purpose, insider threat for misuse is too great to be balanced by the benefit these practices report to have. Simple principles, taught early, can change the face of identity theft, fraud and scams from the ground up. While politicians and corporate executives fight round after round to hammer out better privacy and security policies that continue to fail attempts to catch up with technology, as consumers we can conduct our own privacy revolution by simply promoting privacy and security awareness in our communities and children. None of these practices provide an impenetratable shield- nor am I advocating outright refusing all requests for information. I am simply advocating that we make it harder to invade our privacy, that we understand exactly where and how our information is used and the potential for misuse.

*Ask current financial institutions, companies and associates how they handle and protect your information. Ask them how they might notify you of a potential breach, and what additional precautions they may have available. What are their record retention and disposal policies? How do they ensure proper disposal of e-waste?

*Ask your financial institutions and other companies what is required to access your information and account. Ask what is necessary to make changes. Some companies use the telephone number you are calling from as part of the identification process. Phone numbers can be easily spoofed, and old phone numbers never get corrected. You may wish to change the information they use to verify you.

*When dealing with a company that asks personal information to identify you, inquire about other methods of verification. Can you place a password instead? What happens if you claim to have forgotten the password, or your social security number? What is their security procedure? Be concerned if the customer service representative doesn’t seem to know. These are the people who handle your information, and if they don’t understand the verification system they can’t use it correctly.

*When you have the opportunity to raise concern about the use of private information- do. Companies respond to complaints- just look at Bozeman. In another state, a temp agency recently changed the appearance of their applications after receiving complaints regarding the use of the full SSN. Now they only ask for the last four until they place an individual in a job.
Teach youth- who are at a higher risk for fraud and identity theft- the right habits to protect their privacy and the right questions to ask.

*Insist on authority verification- there are many consumer protection agencies at the local, state and federal level that can verify the legitimacy of a company. Always insist on initiating a phone call if private information is to be discussed, even if it means calling the same person right back.

*Insist on privacy where possible- especially if you have nothing to hide. Perhaps you have nothing to hide from your potential employer or government, but how can you trust the dozens- sometimes hundreds- of other people who have access?

*Never assume that information will be used only as intended. Assume insider threats and data compromises, and monitor your credit report and financial statements for fraud. You may use http://www.annualcreditreport.com/ or call 877-322-8228 to obtain free copies of your report.

*Treat your information like currency. When I fill out a survey form in a department store to obtain a discount, I know that I’m exchanging my personal information for their use in marketing or advertising in exchange for the 10% off. Is it worth it? Is saving $3.50 on that blouse worth the risk of that information being exposed? If you’re not willing to have the information posted on a billboard for $3.50, chances are it is not worth the risk. Recently, when I voice this concern, I have found retailers accepting just my name and zip code in exchange for the discount. I turn in a mostly blank form, and they get a happy shopper.