Getting Engaged can lead to Identity Theft

republished from ID Experts blog.

A few news stories have been circulating about the looming identity theft threat to couples who have decided to tie the knot. Thieves prey on our deepest and strongest emotions, and two people madly in love and about to take the plunge are certainly full of emotions and stress. Stress makes us more apt to decide quickly, without thinking the situation through. The sense of relief we feel may encourage us to accept an offer that seems “too good to be true” when we might otherwise hesitate. Our families and friends may also be targeted, for much the same reasons. Think like a thief- on average weddings cost over $20,000 and guest gifts range between $50-150 each. That places a rather large bulls-eye on anyone involved. Here is just a small list of the kinds of scams that are lurking out there:

• Fake vendors- these are identity thieves or card frauders. They are online, at bridal shows, and call individuals out of the blue. You may be even approaching them for a genuine service advertised in the classifieds or a bridal magazine, or it may be a “sweepstakes”. As part of the “contract” or “application” you answer personal questions in great detail or provide a credit card number that is later used to defraud you.

• Fraud vendors- this category is not technically identity theft, but still leaves you stung. Often you are promised a “free” sample and hand over your credit card for shipping and handling, and then find yourself with outrageous charges. Vendors take a deposit for renting you an item as pictured on their site, and when the big day comes, nothing arrives or what arrives bears little resemblance to the model. Sweepstakes and Giveaways should be especially scrutinized if you get a call and you “won” – there may be strings attached.

• Crooks- these people take advantage of the fact you share so much about your event. They may rob your house while you’re exchanging rings, or wait until you’re away on honeymoon. While everyone at the reception is distracted, they snatch purses or sneak into hotel rooms. Honeymooners are easily targeted by pickpockets, camera snatchers, and hustlers.

• Disappearing act- this can be anything from a deposit you paid disappearing from the books to a company suddenly going bankrupt. Bankruptcies are up 47% from last year, so this is a big concern. While insurance can help protect you, it is important to purchase coverage carefully.

• Malware - There are tons of “free” applications out there to help out couples. Cost calculators, dress design software, websites, countdown clocks, reminders, calendars, the list goes on… Then there are the flash animations and videos of weddings, decorations, crafts, flowers and more. However, some of these may contain harmful code that could harvest your information and place you at risk for identity theft and fraud.

• Robocalls and junk mail – While shopping around online or in person, you’re often asked to leave your contact information. This can result in an increase in junk mail offers and robocalls. Some of these are likely phishing attempts, and are cleverly disguised. Another risk with increased junk mail is the possibility of mail theft going unnoticed for a longer period of time. Pre-approved credit card offers may inflate your mailbox, also increasing your risk of fraud.

• “In distress” scam- this is commonly used while a couple is on honeymoon, but can strike at any time. Fraudsters may call, email, or take over your email or social networking accounts to contact your friends and family claiming to need emergency money. Excuses range from medical emergencies, to being kidnapped. Often they have “been robbed” and need the money to get home. The rest is ALWAYS to wire money or send Western Union.

• YOU – of all the threats, YOU might be your own worst enemy. Many couples have wedding announcements; send emails, e-vites, wedding websites, social networking pages, online gift registries with their personal information, personal details, family details, and wedding, reception and honeymoon specifics available to the public at large. Brides and grooms alike tend to become excited and may share greater detail about themselves, their partners and the event with coworkers and friends… and florists, photographers, DJs (or anyone else who will listen).

With a few minor changes and some awareness, you can still have all the bells and whistles to your big day while keeping your friends, family and your identity safe.

• Assume the numbers and addresses you are using to contact vendors, get quotes, order catalogs are going to be stolen, traded and sold over and over. Set up a PO Box and a separate number to use for your contact information.

• Contact the Better Business Bureau in your area about any vendor, sweepstakes, or service you are going to fork over a large amount of money to, or that you are unfamiliar with. Do this before you provide them any personal or contact information.

• Always assume that calls you receive are compromised and never reveal any personal information. You may trust calls you initiate to a trusted business more, but still exercise caution.

• Read ALL fine print carefully. TWICE.

• Keep all receipts; require everything in writing and document, document, document. Go over all your credit card and bank statements monthly and notify your financial institution right away if you notice any unusual activity.

• Quarantine. Don’t use the same passwords or email account for your social networking sites, registry, and wedding webpage. You should never attach your “trusted” email account you have been using to communicate with your friends and family to another site. A compromise of a social networking site can easily lead to an email compromise, and makes it easier for fraudsters to contact your entire address book for money. If your quarantined email is hacked and messages sent to all your friends, they should be more cautious since it is a different email than they are used to communicating with you. This will buy you enough time that you can then use your “trusted” email account to notify them all of the fraud (or better yet- call them!).

• Never send money Western Union- this is one of the few ways you can send money and never get it back. Provide contact information to their nearest consulate if you are met with this scam online.

• Limit access to personal information- If you are going to list the details of your big day and honeymoon, look for websites that allow you to create a wedding website for friends only, or that is password protected so you can control who has access.

• Be careful of accidentally revealing personal information like your mother’s maiden name (which may be derived from guest lists or online friend list on social networking sites) and your date or place of birth. Also, you will be asked a lot of questions so people can “get to know you” before your big day- make sure none of these questions and answers correspond to the security questions of any account you have. Go through each online account and determine what questions are asked if you click “I forgot my password”. You may wish to change those answers.

• Find gift registries that allow you to control privacy, and insist on revealing as little about yourself as possible. Gift registries often offer a disturbing amount of detail about you, and often are generally open to the public.

Check your credit reports regularly with www.annualcreditreport.com or by calling 1-877-322-8228. If you do experiance fraud or a scam, report it to your Better Business Bureau and the FTC and place fraud alerts with the major credit bureaus.

Recession: A Survival Guide

Republished from my contributions to the ID Experts blog.

During this difficult economic time, the problem with scams and fraud is threefold. First, people who are desperate are more willing than ever to “bite” on the lure of convincing scams because of they are under increasing financial stress and pressure. Second, the number of scams and people perpetrating those scams increases during difficult financial times. Third, according to a recent survey by Nationwide Insurance, over half of respondents don’t know if they have enough money to weather fraud. Additionally, “A 2005 Nationwide survey showed the average amount of total charges made using a victim’s identity was $3,968. While most victims were not held responsible for fraudulent charges, 16 percent reported paying an average of $6,440 to cover some or all of the thief’s purchases.”

You may be surprised to find out that spotting a scam it is not as easy as you think. The FTC points out, “[scam] claims are just good enough to be believable; their services and products just practical enough to seem legitimate. Some even try to look like a government agency to enhance their credibility.” Here is a quick rundown of the four most critical issues: Debt, housing, employment and government assistance.

1. Credit repair / Debit Negotiation companies

The dirty scam: These companies advertise anything from outlandish claims (“We can remove ANY debt from your credit report!”) to carefully veiled suggestions (“We know the tricks that your credit card company doesn’t want you to know”). Almost all of them require an upfront fee, and almost none of them deliver on their promises. The IRS highlighted concerns in this report, stating, “Many credit counseling organizations provide valuable advice, education and assistance to those seeking to better manage their debt. But an increasing number of complaints to federal and state agencies indicate that some organizations are engaging in questionable activities.” The report includes some handy tips for detecting deceptive companies. The FTC also has some great advice for those “Knee Deep in Debt” or considering one of these companies, as well as the Better Business Bureau. These reports cover dirty scams and provide detailed information about the process, general advice on debt practices, and resources for assistance.

The clean scene: The U.S. Department of Justice’s U.S. Trustee Program provides a list of government-approved credit counseling agencies. The National Foundation for Consumer Counseling provides a list of member agencies online at www.nfcc.org or call 1-800-388-2227 for 24-hour automated office listings. Look over this Fiscal Fitness: Choosing a Credit Counselor document from the FTC, and this new site discussing debt and scams including vehicle repossession, advance fee loans, ‘anyone can get credit’ card offers, debt negotiation and other scams that are increasing with the economic difficulty.

2. Home refinance or foreclosure scams, loan modification programs

The dirty scam: Taking advantage of the panic in the market, thieves and scammers are contacting victims for loan negotiation, refinance or foreclosure scams. Using complete lies and half-lies, they never deliver what they promise. They could be pretending to offer assistance for your current situation, or offering you a remarkable deal on a foreclosed property. It could be a rent-to-buy or bait-and-switch scam. Victims find they lose money, turn over personal information and/or complete documents that result in damages and financial loss. They can represent legitimate companies with bad business practices, or complete frauds pretending to be from the government ready to inform you how you can benefit from the economic stimulus package. For more information on these types of scams and the red flags to look for, read the highlight by the FTC here.

The clean scene: Be very suspicious of these offers. Check with the attorney general in your state before dealing with any company or person offering assistance. Details on the Federal assistance available to homeowners can be found at http://www.makinghomeaffordable.gov/ . Or, you can contact the Homeownership Preservation Foundation's national hotline at 1-888-995-HOPE. They provide free bilingual assistance to help homeowners avoid foreclosure. HPF is a member of the HOPE NOW Alliance of mortgage servicers, mortgage market participants and counselors. Read more about HOPE NOW at www.hopenow.com. You can also check with the US Department of Housing and Urban Development, and the Federal Reserve’s Foreclosure Resources for Customers. The FTC and Freddie Mac both offer helpful sites for those who are feeling the pressure of mortgage payment or trying to avoiding foreclosure. The Federal Reserve also recommends checking out NeighborWorks. You can also listen to a recent NPR broadcast about these scams.

3. Employment fraud, classifieds fraud

The dirty scam: Unfortunately, finding a job poses many risks. First, you must be careful about the amount of personal information you place on a resume or online application. Remember that disclosing your social security number and birth date should only be necessary when they are ready to hire you and complete tax information. Even seemingly harmless details, such as the exact dates and companies you worked for, the colleges you attended, and your address, can result in identity theft or professional impersonation (when a thief takes the details of your professional life and presents them as his or her own to land a job). Additionally, you must exercise caution about the ads you respond to and the contacts you receive offering a job. A rule of thumb to remember: if it sounds too good to be true, it probably is. Avoid any job that asks you to cash checks, wire money, or use Western Union on the job. Let’s start with a short list of job scams (and the links to resources regarding them)… ‘Placement service’ for government jobs, head hunters, temporary employment, work-at-home or online jobs, and classifieds fraud.

The clean scene: Resources for government jobs are USAJOBS, US Postal Service Employment, FirstGov, and the Department of Labor. According to the FTC, “Some ads may direct you to call a toll-free 800-number. Once you're connected, you may be switched to a pay-per-call 900-number without your knowledge, or you may be asked to call a 900-number without a proper fee disclosure. Both practices are against the law… Many terms, such as employment agency, personnel placement service, executive search firm, or executive counseling service are used interchangeably. Find out what services a firm offers, how much the services cost, and who pays. If you're required to pay the fee, find out what you'll owe if the employment service fails to find you a job or any leads.” Check suspicious opportunities with the Better Business Bureau, your state Attorney General’s Office, or consumer protection agency. Read these tips from ScamBusters. Find online job hunting privacy tips and a background check fact sheet at Privacy Rights Clearinghouse. As many people are trying to find extra income, we would like to caution people about responses to their classified or craigslist ads. If someone is offering to pay you more than you asked for a service or item don’t do it! Usually they create an elaborate reason that they need you to cash a check and then wire the extra funds to them, or they get you to provide your account number so they can empty your account.

3. Financial assistance from the government

The dirty scam: Letters, phone calls, emails, text messages- there is nothing that they won’t try! Websites and representatives claim to be able to access “secret” government money and help you apply for it. Usually they want an upfront “processing fee” or sometimes just your personal information. The FTC describes it as, “An email, online ad, or website says you’re eligible to get an economic stimulus payment. You just have to send back a form or submit one online to get it. The message might appear to come from a rebate company or look like it’s straight from the Internal Revenue Service (IRS).

There’s more than one way to perpetuate a stimulus scam. Some scam artists ask you to send a small processing fee, supposedly to get a much larger check in return. That’s money you’ll never see again. Others skip the fee, and instead, ask for your bank account number so they can ‘deposit’ your check. Then, they use the information to clean out your account or open new ones using your identifying information.Some stimulus scams encourage you to click on links, open attached forms, or call phony toll-free numbers. But simply clicking the link or opening the document can install harmful software, like spyware, on your computer. The result could be your personal information ending up in the hands of an identity thief. If you get a message offering you money from the stimulus program in exchange for your personal information, ignore it, delete it, or throw it out. The IRS doesn’t send emails asking for personal information, and rebate companies claiming to have stimulus payments for you should not be trusted, regardless of how plausible the script sounds or how official the forms look.”

The clean scene: Legitimate information about government grants and assistance can be found at www.recovery.wa.gov, www.grants.gov, www.studentaid.ed.gov, www.govbenefits.gov and www.sba.gov. Information for stimulus payments and refunds can be obtained directly from IRS.gov. Do NOT click on any hyperlink contained in an email, type the address directly into your browser. You can check up on your stimulus checks here.

If you are prepared, think critically, and proceed with caution, you should be able to determine the scams from the real deal. There are good habits you can form during this time as well. Using cash as a way to limit spending, and limit the number of places you use your card can help your wallet and prevent identity theft. As the economy starts to improve and the panic resides remember that identity thieves don’t just go away. Accounts can be opened now that will not appear on your report for years. Protection now, and in the future, is vital to keeping your identity safe

A special thank you to Washington's Attorney General's office and many other AG offices for providing much of this material.

Teaching a Nation to be Scammed

Why we open ourselves up to identity theft

Why do people give out their social security number to phishers who call them? Why do they email mortgage applications to fraudulent companies? A few decades ago, we might have been able to explain the problem by lack of education. They just don’t know the dangers or the risks. Today, that is a weaker and weaker argument. Clients contact me all the time reporting that they knew something was strange, or they knew that they should never give information over the phone, but they ignored their inner voice and exposed information anyway. Why?

In part, it is because all of our lives we have been taught how to be scammed. The very agencies that we trust to protect us have instilled habits and patterns that make it easier for criminals to manipulate us. From school to work, from local to federal government, we have unwittingly prepared ourselves psychologically to expose the deepest private details about ourselves. Before privacy and security in this country can really make a revolution, these practices must be changed.
I am not advocating mistrust of the government’s intentions in regards to any certain practice- this is not a conspiracy theory. I am advocating a healthy distrust of the humans who must handle that information. According to a recent article by Robert Siciliano, “As much as 70% of all identity theft is committed by someone with inside access to organizations such as corporations, banks or government agencies, or simply someone who has an existing relationship with the victim.” The point to this article is not the intention of the legislation behind these practices, but rather the citizen training that occurs when procedures become habits.

First, we have been taught to trust authority figures from a very young age. We have not been taught how to verify them. This skill is absent from many people who panic when they receive a message from someone claiming to be their bank. Using the internet, the Better Business Bureau, or referring to the number on their statement or the back of their card often escapes these victims. Why isn’t their first reaction to verify any form of contact? They were never taught to do so. Did you ever verify your teachers? Even in college? Did you check what degree they held, or even if they had a criminal past? Has a police officer ever encouraged you to take their badge information and verify with the local precinct? Unlikely. Children are taught “don’t talk to strangers” but at the same time we instruct children how to identify a police officer in case they need help. This is similar to when credit card company telling consumers never to give their personal information out over the phone, but then calling a consumer to request that same information to verify transactions. Have you ever gotten a list of questions that call center representatives should be asking you to verify your identity? Do you know if it is or isn’t against company policy for them to ask for your full social security number or the last four digits? If you don’t, then you may be exposing your information to an insider threat at that organization, and you may never know.

In addition to trusting authority figures, we are often asked to repeat our social security numbers or use them as identifiers. Each time we say the number in a response to the request, we have made it just a little easier to say again the next time. The more we reveal the number, the less private we feel it is and we tend to treat it as such. One of the biggest points of contention for this point is the military’s use of SSNs as identifiers. Not only does it pose greater risk to those who are protecting our country, but these individuals maybe at a higher risk while deployed or on active duty. Often military personnel do not have the time, access to resources, or ability to communicate with the credit bureaus. It isn’t just the military, although I expect more protection for the troops from them, it is also employers and professionals. All sorts of companies from dental offices to video rental shops have been using SSNs as account numbers or identifiers for decades. Not only does this expose your information to many more potential insider threats, but it also psychologically devalues the information for us. If I use my social security number at the rental store to pick up the newest DVD, it becomes far easier to hand it out to a solicitor offering to place my information in a prize drawing. The same goes for date of birth. I cringe every time I see a promotional offer come in the mail. Usually a post card that says “Happy Birthday! Good for One Free Meal on January 1st.” Nothing like a flyer announcing my birthday to leave a pit of worry in my stomach- there is no such thing as a free meal, right?

Usernames and passwords are also often overlooked. People seem to be aware of how important it is to keep these secure- yet most people (over 50%) use the same user names and passwords for everything. Remember what I said about insider threat? How easy would it be to compromise every bank account and email address you have if just one insider decided to? If your email address and a password are all you use, even better. Once they have access to your email account, all the accounts you have registered with that email become exposed. Some of us may even be exposing our work email, and our companies, with this practice. Some may even be conversing with their doctor through websites using the same information. Although public backlash forced the city to rescind the request, Bozeman recently required that job applicants provide the usernames and passwords for their internet sites. The news spread quickly, I am sure catching the eye of many a potential hacker and insider threats alike. Many professionals use social networking sites such as Twitter or Facebook. Unfortunately, many of the applications for these sites are run by third parties who are not reviewed by the social networking site for privacy or security compliance. Almost universally, your username and password are requested. Again- these sites may do what they repute… but what else is happening with your information? Who else may be looking at it, unbeknownst to you or the third party application?

Finally, biometric data and DNA- while these are being touted as the crowning achievement in security and crime fighting, the dangers associated with its abuse are staggering. The Washington Post reported last year on the expansion of the US DNA database program. With this extension, “The U.S. government will soon begin collecting DNA samples from all citizens arrested in connection with any federal crime and from many immigrants detained by federal authorities, adding genetic identifiers from more than 1 million individuals a year to the swiftly growing federal law enforcement DNA database.” This includes those arrested and not convicted. I understand that when you commit a criminal charge that you lose some rights, including some rights to privacy. However, including this information from people that are not convicted is a dangerous precedent to set. Not only are you denying them the right to privacy, but you are denying them the rights to control their DNA without any criminal charge. This implies that no one has the right to withhold their DNA. Although fingerprint databases are used as a comparison- it isn’t an accurate one. Fingerprints are just a recording of the lines in your fingers. Your DNA contains much more information about yourself and your family. If that DNA is “misplaced”, it is the equivalent of “misplacing” a whole finger- not your print records.

Just as your SSN can be used to verify your identity, and it can also be used to fraudulently use your identity- your biometric data and DNA is the same. Think about the last time you submitted a urine analysis for a job application. Did you hand the cup directly to your manager? No- of course not. You- and the company that hired you- relied on the nurses, lab technicians, truck drivers and others to safely handle the sample and the information corresponding to it. An insider threat here can result in medical history becoming exposed or misrepresented. Still not convinced? Well, while the FBI tries to block attempts at searching for false matches, youth on social networking sites are posting their STD test results. This is the best evidence available to demonstrate the lack of understanding of privacy and security at all levels of society, which is a direct result of the prevading lack of education. I encourage privacy professionals to at least mention to their employer that they think UAs are an invasion of privacy, especially if you “have nothing to hide” from them. If we, in the industry, don’t set the example- there will be no one left to teach others. This is why the attitude of any administration occupying the White House is critical to the whole privacy structure. The only way to teach privacy and security is by example.

Although not the intention, these practices create a “habit” amongst citizens that your blood, salvia and urine are unimportant and should not be protected. For those who claim that only those with “something to hide” should be concerned, let’s look at the lessons we can learn from other DNA databases. Last year, the Daily Telegraph reported that “Millions of profiles on the national DNA database have been handed over secretly to private companies without the consent of those involved”. If biometric information can be bought and sold as a commodity- the world becomes a dangerous place. Losing control over any information that is used to definitively identify is dangerous- be it a social security number, or a sample of blood. Information for background checks are also a category of information we are trained to give without much thought. As an article published just today pointed out, most applicants are unaware of the "likelihood that much of the PII collected during a background check will travel far beyond the security of U.S. privacy laws to a foreign call center or data warehouse with little to no standards for privacy protection... rightful owner of the Personally Identifiable Information does not even have to be notified when it is sent outside of the country... providers continue 'offshoring' personal data to low-cost labor markets by using companies internationally to increase profits..." Further, "Employee personal data can also be 'repurposed' by background check companies and ATS/JBS providers to be used in another format or product, and also resold to skip tracers, lawyers, data aggregators, and marketing lists to be bought and sold again and again. The growing popularity of offshoring, repurposing, and reselling of PII data has led to identity theft and lost privacy." (Pre-employ.com)

Every time you have a person walk through a process of providing private information, you are creating a habit. It makes it easier for them to provide it again. Regardless of the intended purpose, insider threat for misuse is too great to be balanced by the benefit these practices report to have. Simple principles, taught early, can change the face of identity theft, fraud and scams from the ground up. While politicians and corporate executives fight round after round to hammer out better privacy and security policies that continue to fail attempts to catch up with technology, as consumers we can conduct our own privacy revolution by simply promoting privacy and security awareness in our communities and children. None of these practices provide an impenetratable shield- nor am I advocating outright refusing all requests for information. I am simply advocating that we make it harder to invade our privacy, that we understand exactly where and how our information is used and the potential for misuse.

*Ask current financial institutions, companies and associates how they handle and protect your information. Ask them how they might notify you of a potential breach, and what additional precautions they may have available. What are their record retention and disposal policies? How do they ensure proper disposal of e-waste?

*Ask your financial institutions and other companies what is required to access your information and account. Ask what is necessary to make changes. Some companies use the telephone number you are calling from as part of the identification process. Phone numbers can be easily spoofed, and old phone numbers never get corrected. You may wish to change the information they use to verify you.

*When dealing with a company that asks personal information to identify you, inquire about other methods of verification. Can you place a password instead? What happens if you claim to have forgotten the password, or your social security number? What is their security procedure? Be concerned if the customer service representative doesn’t seem to know. These are the people who handle your information, and if they don’t understand the verification system they can’t use it correctly.

*When you have the opportunity to raise concern about the use of private information- do. Companies respond to complaints- just look at Bozeman. In another state, a temp agency recently changed the appearance of their applications after receiving complaints regarding the use of the full SSN. Now they only ask for the last four until they place an individual in a job.
Teach youth- who are at a higher risk for fraud and identity theft- the right habits to protect their privacy and the right questions to ask.

*Insist on authority verification- there are many consumer protection agencies at the local, state and federal level that can verify the legitimacy of a company. Always insist on initiating a phone call if private information is to be discussed, even if it means calling the same person right back.

*Insist on privacy where possible- especially if you have nothing to hide. Perhaps you have nothing to hide from your potential employer or government, but how can you trust the dozens- sometimes hundreds- of other people who have access?

*Never assume that information will be used only as intended. Assume insider threats and data compromises, and monitor your credit report and financial statements for fraud. You may use http://www.annualcreditreport.com/ or call 877-322-8228 to obtain free copies of your report.

*Treat your information like currency. When I fill out a survey form in a department store to obtain a discount, I know that I’m exchanging my personal information for their use in marketing or advertising in exchange for the 10% off. Is it worth it? Is saving $3.50 on that blouse worth the risk of that information being exposed? If you’re not willing to have the information posted on a billboard for $3.50, chances are it is not worth the risk. Recently, when I voice this concern, I have found retailers accepting just my name and zip code in exchange for the discount. I turn in a mostly blank form, and they get a happy shopper.