Con artists and crooks of many sorts have found ample opportunity to cheat unsuspecting people in cyberspace. Some scams are almost unchanged from their pre-Web forms: pyramid schemes, chain letters, sales of counterfeit luxury goods, sales of food-stamp cards, phony business investment opportunities, and so forth. Each generation of people, whatever level of technology they use, needs a reminder that if an investment or bargain looks too good to be true, it probably is. Other scams are new or have evolved to take advantage of characteristics of the Web. In online dating scams, crooks use profiles and photos lifted from social media sites to develop online relationships and convince the unwary to send money for a family emergency or some other false reason. In a particularly offensive scam, people set up websites after disasters such as terrorist attacks and hurricanes 5.3 Identity Theft and Credit Card Fraud 251 to fraudulently collect credit card donations from people who think they are contributing to the Red Cross or funds for victims. In this section, we examine identity theft and credit card fraud at some length. We look at the thieves methods and some countermeasures that have emerged. The point is not the particular details but the patterns: insufficient security, big losses, then gradual improvement. People learn the risks. Businesses and individuals respond with new protection mechanisms, and law enforcement agencies acquire skills to catch and convict the crooks and discourage their activity. 5.3.1 Stealing Identities We buy products and services from strangers in stores and on the Web. We do our banking and investing online without seeing or knowing the physical location of the company we deal with. We can travel with only a passport and a credit or debit card. We can qualify for a mortgage or a car loan in minutes. As part of providing this convenience and efficiency, our identity has become a series of numbers (credit and debit card numbers, Social Security number, drivers license number, phone number, account numbers) and computer files (credit history, Web activity profile, work history, driving record). The convenience and efficiency engender risks. Remote transactions are fertile ground for many kinds of crime, especially identity theft and its most common result, credit and debit fraud. Identity theft describes various crimes in which a criminal (or large, well-organized criminal group) uses the identity of an unknowing innocent person. If the thieves get credit (or debit) card numbers, they buy expensive items or sell the numbers to others who use them. If they do not have card numbers, they use other personal information (Social Security number, for example) to open new accounts in the victims name. In one scam, thieves used names and Social Security numbers of almost 2000 people and applied for their tax refunds. Identity thieves take out loans, buy groceries, raid the victims bank account, pass bad checks, or use the victims identity in various other ways for financial gain. A security company executive says a complete identity sells for less than $20.31 The Federal Trade Commission receives hundreds of thousands of complaints of identity theft each year. Losses from identity theft amount to billions of dollars per year in the United States, with several million victims. A single incident can affect thousands of people. For example, two U.S. grocery chains reported that data thieves planted malware in the computer systems of their stores and gained access to more than four million credit and debit card numbers. The malware sent the data to a server outside the United States; almost 2000 cases of fraud resulted. Credit card companies and other businesses bear the direct cost of most credit card fraud, but the losses lead to higher charges to consumers. In addition, individual victims might lose a good credit rating, be prevented from borrowing money or cashing checks, be unable to get a job, or be unable to rent an apartment. Creditors might sue the victim for money the criminal borrowed. 252 Chapter 5 Crime The many tactics used for identity theft and credit and debit card fraud, and the many solutions developed in response, illustrate the continual leapfrogging between increased sophistication of security strategies and increased sophistication of criminal strategies. They also illustrate the value of the mix of technology, innovative business policies, consumer awareness, and law to solve the problems. We describe a variety of tactics for identity theft, then consider many approaches to reducing identity theft and reducing its impact on its victims. A few of the methods we describe are no longer used because the other side defeated them or consumers found them too cumbersome. Technology evolves and clever people on both sides of the law develop new ideas. For the general public and for anyone working with sensitive personal data, it is necessary to remain aware and flexible. Have you received email or a text message from PayPal, Amazon, or a bank asking you to confirm information about your account? Have you received email from the IRS telling you the agency has a tax refund for you? These are examples of fraudulent spam called phishing (in the case of email) and smishing (in the case of text messaging): sending millions of messages fishing for information to use to impersonate someone and steal money and goods. The message tells the victim to click on a link to what purports to be the website of a well-known bank or online company. The phony site asks for account numbers, passwords, and other identifying information. Identity thieves take advantage of our knowledge that there is a lot of online fraud: Several pretexts that appear frequently in phishing scams warn that there has been a breach in the security of your bank or PayPal account and you need to respond to determine whether someone else is misusing your account. Some messages tell the recipient they just made a very big purchase and if the purchase was not really theirs, they should click a link to cancel the order. In a panic, people doand enter their identifying information when asked for it. The first defense against phishing is to be extremely wary of clicking on a link in an unsolicited message, especially if the message is about account information. The standard antifraud advice is: If you are uncertain whether the message is authentic but you want to respond, ignore the link and check your account in the usual way. As more people learned to be wary of clicking on links in messages that appear to be from a legitimate company, thieves modified their phishing scams; the message provides a telephone number to call. Those who call hear a request for their account number and other identifying information. This variation is sometimes called vishing, for voice phishing. Of course, a phone number provided by phishers is as fake as the links they provide. Pharming is another technique to lure people to fake websites where thieves collect personal data. Normally when we indicate a website we want to visit, our browser looks up the IP address of the site on one of many Domain Name Servers (DNS), special computers on the Internet for this purpose. Pharming involves planting false Internet addresses in the tables on a DNS that lead the browser to a counterfeit site set up by identity thieves.

Attachments:

A-Gift-of-Fir....pdf