|
By
Ken M. Shaurette,
CISA, CISSP
Omni Tech Corporation
My father-in-law recently returned from his Arizona winter
home only to lose his wallet. Within 45 minutes whoever
found the wallet had cleaned out his bank account. It was
the account he had set up for his trip that was associated
with his checking account card. I haven't heard any more,
but would be surprised if this were only the beginning;
he carried his Social Security card in his wallet as well.
If the finder really wants I suspect the initial money lost
will be minor compared to the problems that will be encounter
recovering his identity.
How can someone steal your identity? By using your name,
Social Security number, credit card number, or some other
piece of your personal information for their own use. They
obtain just enough information to fill out the forms that
can make themselves appear as you. Essentially at least,
in cyberspace they become you..
How might someone get our personal information? What do
you throw away that might have information on it that could
be used to give a criminal a start? An insurance bill, or
one of those "already" qualified credit card statements.
It was recently reported that the criminal element was using
the Web site www.anybirthday.com to obtain additional information
that along with a few other basics begins to get the kind
of data they need to steal an identity. On anybirthday.com,
armed with simply a first and last name, you can obtain
peoples' birth date and the zip code where they live. Using
just a name, you can obtain a lot of information on a site
like www.infospace.com or at www2.1800ussearch.com, for
less than $10 get a complete address. For less than $60
you can get current address and an up to 10-year history
with available listed phone numbers, relatives, roommates
and neighbors, bankruptcies, tax liens, small claims civil
judgments, even real property ownership and value. These
are only a few of the many places that will search the numerous
databases where your personal information is stored.
We've all heard horror stories about fraud that's committed
using someone's name, address, credit, etc. Unfortunately
receiving first-hand knowledge is not the kind of experience
you want just because your wallet was stolen. Within a week
after it is taken. the thieves could order an expensive
cell phone package, apply for a credit card, have a credit
line approved to buy a computer or expensive electronics
equipment, receive a PIN number from DMV to change your
driving record information online, and more.
Here is some critical information to help limit the damage
in case this happens to you or someone you know. As everyone
always advises, cancel your credit cards immediately, but
the key is having the toll free numbers and your card numbers
handy so you know whom to call. Keep those where you can
find them easily (having to hunt for them is additional
stress you won't need at that point). On a personal note,
I remember leaving my MasterCard at an airport bar once
and until I got the toll free number from information, etc.
I was a wreck. File a police report immediately in the jurisdiction
where the information was stolen. This proves to credit
providers you were diligent, and is a first step toward
an investigation (if there ever is one). It might be the
information you need to fall back on as proof that you did
not create that $3,000 phone bill.
But here's what is perhaps most important: Call each of
the three national credit reporting organizations immediately
to place a fraud alert on your name and Social Security
number. Do the same with the Social Security Fraud Center.
I had never heard of doing that until my credit card company
called to tell me that my spending habits had suddenly changed
and an application for credit was made over the Internet
in my name. The alert means any company that checks your
credit knows your information was stolen and they have to
contact you by phone to authorize new credit.
By the time I was advised to do this - almost 2 weeks after
the theft - all the damage had been done (there are records
of all the credit checks initiated by the thieves, purchases,
none of which I knew about before placing the alert). Since
then, no additional damage has been done, and the thieves
threw my wallet away this weekend (someone turned it in).
It seems to have stopped them in their tracks.
Another simple trick that I've learned is not to sign any
of my credit cards. Oh I put information on the signature
line, but it is not my name. I put the following: SEE PICTURE
ID. What does this do? If one of my credit cards is used
in a store, hopefully the diligent clerk checks my signature.
It will not be there and the thief would have to show a
picture ID of me in order to complete the transaction. Your
driver's license has your signature so the store can verify
the signature from that information.
I'll keep you posted if my father-in-law ever bothers to
check further into his credit or determine whether anything
more came of his lost wallet. He's over 80 and stubborn,
so telling him he should do something may not be that easy.
I'm am sure he figures that as long as he doesn't hear anything,
everything will be OK. His daughter argued that you have
to carry your Social Security card with you. I guess she's
just a chalk line too, another crime scene waiting to happen.
Interestingly enough, the cards do say carry this copy with
you, not a good practice in my book.
Ken M. Shaurette, (CISSP, CISA) is a Senior
Information Security Analyst Omni Tech Corporation (www.omnitechcorp.com)
in Waukesha, Wisconsin. Ken is also the Chief Knowledge
Officer for Axiom Security, LLC (www.axiomsecurity.com)
in Lincolnshire, IL, with over 20 years IT experience. He
has provided information security and audit advice and vision
for companies building information security programs for
over 16 years. Ken has written numerous articles and is
published in the 2001, 2002 and 2003 editions of Auerbach's
Handbook of Information Security Management. Ken is the
President of the Western Wisconsin Chapter of InfraGard
and Vice President of ISSA-Milwaukee. For questions or comments
contact Ken at: [email protected].
|
