And, perhaps, in one of the most chilling incidents, given the events of 9/11, on August 9, 2006, a laptop containing names, addresses, social security numbers, and dates of birth was stolen from a U.S. Department of Transportation government-owned vehicle in Miami, Florida. Included was information on 42,800 people in Florida with FAA pilot certificates.

So what's the big deal? So your social security number has been hi-jacked. So what? Date of birth? Who cares?

A 2004 study by the Identity Theft Resource Center (http://www.idtheftcenter.org/aftermath2004.pdf), a non-profit based in San Diego, surveyed 197 victims of identity theft. Half of the victims spent under 100 hours repairing the damage, but the total reported hours ranged from 3 hours to 5,840 hours. The mean time spent was 330 hours. Out-of-pocket expenses averaged $1,400 per victim. The Federal Trade Commission received more than 255,000 reports of identity theft in 2005; multiply that times 330 hours to see the amount of time spent dealing with this crime.

So, who cares? Everyone with something to lose—whether financial information, credit rating, or simply his or her good name—must care.

What is Identity Theft?

The most concise definition of identity theft comes from the National Association of Insurance Commissioners: “Identity theft occurs when a person uses your personal information, such as Social Security number and date of birth, with the intent to commit fraud or to aid an unlawful activity. Once personal information is obtained, the person may open new credit card accounts in your name, open bank accounts in your name to write bad checks or take out a loan in your name.”

The story does not end there, however, although these are the most common instances. In the case of State of Wisconsin v. Peters, 665 N.W. 2d (Wis. 2003) the defendant was charged with armed robbery, retail theft, obstructing an officer, and identity theft. She moved to have the charge of identity theft dismissed, and the Circuit Court agreed. But the supreme court held that her misappropriation of another's identity to obtain a lower bail met the state's identity theft statute's requirement that the perpetrator must misuse another's identity to obtain either credit or money.

And in the case of the State of Washington v. Presba, 126 P.3d 1280 (Ct. App. Wash. 2005), during a traffic stop the defendant gave the officer the name, date of birth, and social security number of a former friend. She was charged with identity theft (a felony) rather than the lesser misdemeanor of criminal impersonation, because, said the court, in giving the information of another person she had assumed that person's identity. Had she made up a name, date of birth, and social security number she would have been charged with the lesser count.

So, although it is common to think of stealing an identity in order to steal money or goods, that is not necessarily the case.

Common Causes of identity Theft

Theft of laptops might make the news, but theft of a family member's credit card is a common cause of fraudulent use. Writing for MSN Money, Liz Pulliam Weston states that, according to a survey by Javelin Research, one in four victims knew who was responsible for theft of their information; of those, half pointed to friends, relatives, neighbors, or in-home employees.

Theft of a wallet or handbag often results in loss of more than money. People often unwittingly carry their social security cards with them as well as their drivers licenses. Now, the thief has cash, credit cards, and the means to open new accounts—social security number, date of birth, and a signature. Barring that, the information can be sold over the internet. (States no longer require social security numbers on drivers licenses, nor can the SSN be used as the license number. If your license has your social security number on it, request a new license.)

The internet has become a common source of identity theft. “Phishing” has become almost a household word. This is a scheme whereby someone receives an e-mail asking for personal information; social security numbers or credit information in particular. Not long ago it was common to receive an e-mail purportedly from a bank (Citibank and USBank were common names). The e-mail would state something to the effect that the bank's fraud team had noticed unusual activity in the intended victim's account, and, in order to continue the account the victim would have to go to the indicated site to input valid information. Of course, the site to which the victim was directed was not the bank's site.

A variation of this is to send an e-mail supposedly coming from PayPal (the on-line service commonly used with E-Bay) that says something like “you have a credit of $250.00 from your last sale, but to confirm your identity we need the following information….” Many persons think that they have forgotten a sale's amount, and follow the link. E-Bay and PayPal will always address any e-mail to its customers personally (as, Dear Susan Smith), not “Dear Customer”.

Not satisfied with offering great refinancing rates, current phishing attempts begin with “You have been approved for (usually a six-digit amount) and we just need a few more details to finalize your loan… just click on the link below.” And, of course, there are the widows/spouses/children/business partners of General/CEO/President/owner who will cut the responders in on 10 to 20 percent of the bazillions if only they will just e-mail their bank account number and routing information.

There are two common scams during tax season. The first is to send an e-mail claiming to be from the Internal Revenue Service (IRS), and advising the recipient that they are entitled to an additional refund. They must follow the link to a website and complete the requested information. Because many now file taxes electronically, an e-mail response from the IRS appears to be legitimate. The IRS, however, does not ever communicate via e-mail. The second scam involves an e-mail purportedly from the IRS, and goes something to the effect that “you have filed your tax return, and now you have just one question—when can I expect my refund?” When the unwary click on the link, they are directed to a site asking for personal information. A less common trap is an e-mail supposedly sent from H&R Block offering personal tax preparation services. The respondent is directed to a fraudulent site asking for personal information.

From “phishing” we go to “pharming.” This is a similar scam to phishing, except it can be more dangerous. Here, the internet user goes to a site he thinks is legitimate, but it is not. Thinking it is a trusted site, he or she enters personal information.

The explosion of laptop computer use can place the unwary in danger. The number of wi-fi spots is growing, and too many persons do not remember that a person using the same network can hack into their laptop and access personal files. (A variation of this involves corporate wireless networks. “Wardriving” is the term for taking a laptop near suspected buildings and accessing the company's wireless network from outside. The same can also be done to a home wireless network. A big danger for businesses is the employee who takes a laptop home, logs onto the corporate address using wi-fi, and leaves the door wide open for a local wardriver to access the corporate system.) Laptop users should be cautious about logging into unknown networks. Do you really want the person at the table near to you at Starbucks to see your desktop? Some laptops automatically attempt to connect to a network. It is a good idea to disable this feature unless the laptop is secured.

The hand-held of choice, the BlackBerry, is also susceptible to hack-attack. Many people think of it only as a convenient e-mailer or data-store, and forget that it has networking capabilities. If you have a BlackBerry, go to the site http://www.blackberry.com/products/enterprisesolution/security/ for information on preventing malware.

Although there have not been any reported instances of the following, it is included here so the reader can judge for him or herself about the degree of privacy waived simply for the convenience of automatic bill-paying. Setting up automatic bill payment by means of a credit card might be smarter than using a debit card or bank draft, simply because the credit card provides some protection against unauthorized charges. Using a debit or bank draft allows someone to directly dip into a checking account. If this method is chosen, then it should only be done with completely trustworthy companies. Even using a credit card to pay bills gives the merchant (and unknown employees) access to a credit card number. For example, the cable TV bill comes with a stub allowing the customer to pay with a credit card. The customer fills in credit card number, complete with expiration date and a signature.

The Techie Side, or What's a Rootkit?

The reality is that modern technology has made possible incredible leaps in information-gathering and business practices. We could no more do without computers than we could go back to the horse and buggy days. The cost of convenience, though, is that we are vulnerable. No sooner does Microsoft come out with a new secure version of Windows than the hackers are busy trying to crack the system.

It is becoming common knowledge that what an employee does at work is the property of the employer. Hence, e-mails are not personal. Many employers now have the ability to record keystrokes (called keylogging) from any particular desktop. Unless it does not matter that your employer knows your credit card number from your lunch-time shopping trip to an e-tailer, do your shopping from home. (And never shop from any site that does not display both a small lock at the bottom of the screen and an https:// in the address.)

A recent article entitled “Could Your Keyboard Spy on You?” by Ryan DeBeasi in Computerworld describes a way a device (called a JitterBug) can attach itself to network connections to send passwords and other sensitive data over the Internet. Although the researchers have not yet found specific evidence of this device, they note it can easily be built into keyboards, with the user none the wiser. They also note the U.S. Government uses computers built by Lenovo only for non-classified data. Lenovo, recall, used to be IBM and is now 28 percent owned by the Chinese government.

Rootkits have become more popular as more security measures to thwart hostile intrusion into computers become more prevalent. A rootkit is a collection of tools that gets control of a computer and is able to hide its presence. The hacker (or cracker—a criminal hacker) thus can gain control of a computer and, if the computer is one in a network, obtain access to other computers in the system. These might include ones in accounting or human resources, which contain employees' personal information.

One of the most self-serving, supposedly legitimate, uses of a rootkit was by Sony Corporation. The company distributed music CDs that secretly installed a rootkit on the computers used to play the CDs, ostensibly as copy-protection. But the rootkit was used by Sony to gather information about its customers, and could have just as easily been used by hackers to access customers' PCs. To add insult to injury, the company offered a fix that simply removed the cloaking portion of the rootkit, not the rootkit itself. Removing the rootkit would damage Windows. Additionally, anti-virus companies (including the most popular) did not catch the problem, and then were only able to offer up removal of the cloaking device (what hides the rootkit), not the rootkit itself. Don't forget Sony makes computers.

The Governments Step In

It should come as no surprise that identity theft is a crime. What are some of the steps being taken to protect the public, from the Federal government to the states?

It has lately been announced that new U.S. passports will carry an RFID (radio frequency identification) chip to prevent forged passports. The goal is good, the reality less than stellar for the passport holder. RFID chips can be read with a device called a skimmer, so a passport control officer can easily read several passports in the time it used to take to review just one. The problem is that if a passport control officer can read the tags, so can others. Some cell phones read them. The passport covers supposedly contain anti-skimming material, but that presents a fresh challenge to potential thieves, not security. According to Bruce Schneier, chief technology officer of Counterpane Internet Security, “someone in the government got it in their head to make it [the passport chip] RFID. Yes, it's cool technology, but don't do it because it's cool.” (For a great source of information on security issues, visit Bruce Schneier's website at http://www.schneier.com/. He is widely recognized as an authority in the field.)

The FBI has several initiatives in place, among them SLAM-Spam, which targets criminal spammers. Another is Operation Releaf (Retailers & Law Enforcement Against Fraud), which has gone after the scammers who use stolen credit card information to purchase goods, which are then shipped to West Africa and Russia. The unhappy merchant finds he or she is on the hook when the legitimate owner of the credit card disputes the charges.

The Federal government has laws on the books, as do the states. For the most, they mirror each other. The Federal statute pertains to crimes committed in violation of Federal law or that constitutes a felony under any applicable state or local law. Penalties can be a fine, imprisonment, or both.

States, of course, have statutes on the books regarding identity theft. Washington state statute (West's RCWA 9.35.020), for example, says that “no person may knowingly obtain, possess, use, or transfer a means of identification or financial information of another person, living or dead, with the intent to commit, or to aid or abet, any crime.” Penalties vary with financial value (including credit, money, goods, services, or anything else of value) obtained.

Kentucky (KRS § 514.160) goes to some lengths to tell exactly what the crime involves:

A person is guilty of the theft of the identity of another when he or she knowingly possesses or uses any current or former identifying information of the other person or family member or ancestor of the other person, such as that person's or family member's or ancestor's name, address, telephone number, electronic mail address, Social Security number, driver's license number, birth date, personal identification number or code, and any other information which could be used to identify the person, including unique biometric data, with the intent to represent that he or she is the other person for the purpose of:

(a) Depriving the other person of property;

(b) Obtaining benefits or property to which he or she would otherwise not be entitled;

(c) Making financial or credit transactions using the other person's identity;

(d) Avoiding detection; or

(e) Commercial or political benefit.

Ohio (O.R.C. § 2913.49) adds that it does not matter if the person whose identity was stolen is dead; the crime is still a crime. For a list of state statutes on identity theft, go to http://www.consumer.gov/idtheft/id_laws.htm. This is a Web site of the Federal Trade Commission (FTC), which also offers information on steps to take if one suspects one has been a victim of identity theft.

Many states are also doing more to assist their citizens before a possible theft. Many states have laws requiring businesses to notify customers if personal data has been accessed by security breach. (Had such a law not been in place in California, ChoicePoint might never have been compelled to disclose it had been tricked into selling personal information on over 100,000 consumers.) Iowa has a special passport issued to victims of identity theft, and has enhanced security features in its drivers licenses.

Protect Yourself—Tips

The best defense, of course, is a good offense. Therefore, here are some prevention tips.

Around the house:

·Shred any and all unwanted credit card offers, or, indeed, any no-longer-necessary personal papers with personal information on them. Be careful as to who house-sits if you are away. You might hide unused checks, but it only takes a used check with the routing number on it to open the door to theft (Remember Frank “Catch Me if You Can” Abagnale, Jr.? All it takes is some check-washing ability.). The best policy—keep personal papers locked away when not actually using them.

·If you live in an area where the mail carrier picks up mail from your mail box, do not place outgoing mail containing personal information (a credit card payment, for example) in the box. Take it to a mail box. If you have reason to think mail might easily be stolen from your mailbox, rent a post office box.

·There is no need to put the full credit-card number on a check used to pay the account. Your credit card provider knows your number. Simply put the last four digits. Along this same line, do not have your social security number printed on your checks. Never, never, never. Do not have your social security number on your drivers license. When depositing a check to a personal bank account, do not include the bank's routing number. A short identifying number (the last four digits, for example) should suffice.

·Family members can often be identity-thieves, sorry to say. A drug addict, a compulsive gambler, a person with “champagne tastes on a beer budget” often cannot resist temptation. Unfortunately, these persons trade on the family tie to protect them; even more unfortunate, other family members often pressure the victim to take no action.

·If you bank or pay bills on the Internet, monitor your accounts regularly so you will readily detect any suspicious activity. Many persons have signed up for credit-monitoring services (see the section Is There any Good News?). Others feel this is unnecessary because by law persons are entitled to a free credit report annually. If you decide to order your own credit reports, be extremely cautious that you are ordering from the legitimate site. This is an individual matter. If you shop online, shop only from a trusted site. You will see a small lock at the bottom of the page, and the secure site's URL will begin https://. Some consumers have one card they use only for online shopping.

·Take a photocopy (front and back) of all the credit cards, health cards, etc., that you carry with you. Then, if your wallet is stolen you have all the information to notify creditors, bank, etc.

Your computer:

·Be sure you are using a firewall (a hardware firewall is recommended because it is harder to crack), anti-virus software, and any of the other programs readily available that will protect your files from being read by outside entities. For even better security, buy a program to erase spyware and rootkits. Any computer use should be with a hard-to-guess password. A combination of letters and numbers works best; your phone number or any other easily-guessed combination is not a good idea. Never use a word found in the dictionary.

·Do not reply to suspicious e-mails. If you have never talked to someone about refinancing your home, why would you respond to an e-mail beginning “after talking to you about refinancing, we just need a few more details…..”? Remember, neither your bank nor the government will e-mail you, so don't reply to an e-mail purporting to come from them. If in doubt, re-read the section entitled Common Causes.

Out and about:

·Never carry your social security card with you. If you must have checks while you are out, carry one or two, not the entire checkbook. If you have a health card with your social security number on it, carry a photocopy with the SSN blocked out.

·When shopping with a credit card, especially at a busy time of year, make sure your card is returned to you. Remember, you often hand your card to a complete stranger. This is particularly true in restaurants where the server disappears with your card. It is possible to buy a “skimmer” that reads your card as it is swiped and the server can download the information into his or her own computer.

·Be watchful who is around you. If you are at an ATM, shield your pin with your hand as you enter it. Don't stand in a line with an ATM or credit card in full view—anyone with a camera phone can photograph it. Many ATMs now have cameras to deter criminals. Do not let the camera record your PIN number. Be wary of ATMs not connected to a bank; some of them have reportedly been used to record account number and PIN number of the intended victim.

·If you must give information orally, be careful as to who might be eavesdropping nearby.

Finally, if you have become a victim of identity theft:

·Notify your credit card issuers immediately and close the accounts. Contact your banker to see if closing your account is advisable.

·If your social security number has been stolen, call the consumer reporting agencies to place a fraud alert on your credit reports. That means that no one can open new accounts in your name. (In theory, of course. Unfortunately not every merchant is careful about extending credit.) Call the Social Security Administration, and, if your drivers license has been stolen, call the state DMV and follow their procedures for getting a replacement. Ask the agency to flag your file so no one else can obtain an identification document.

·If your information has been misused, file a police report and file a complaint with the Federal Trade Commission. The FTC's Web site also offers useful information for victims of identity theft (http://www.ftc.gov/ftc/consumer.htm).

Is There any Good News?

Insurance is widely available. ISO has an endorsement HO 04 55 03 03 that provides up to $15,000 for the expenses incurred as the result of any one identity fraud first discovered during the policy period. Various insurers offer the coverage: Travelers High Value Homeowners Policy includes $15,000 expense coverage; USAA includes up to $5,000. The Insurance Information Institute's Web site says that Allstate, American International, Chubb, Encompass, Farmers Group, Fireman's Fund, Liberty Mutual, and Metlife offer coverage. Remember, though, that insurance does not protect against identity theft; it simply offers a dollar amount, in event of a stolen identity, to help defray the expenses of restoring one's credit.

There are credit-monitoring sites that the consumer can access. The site for free reports is: http://www.annualcreditreport.com. The site is sponsored by the big three companies, TransUnion, Experian, and Equifax. Because, by law, each of these must provide a free credit report to a consumer annually, it is possible to order a report every four months and thus monitor any suspicious activity. (Many persons have gone to freecreditreport.com; this site is sponsored by Experian and sells credit-monitoring services. Another recent site to appear on television ads is truecredit.com. This is not the site for a free credit report. MyFico.com, which is owned by Fair Isaac, also sells credit monitoring through TransUnion. Fair Isaac, recall, is the organization that first developed credit scoring as an underwriting tool.) These companies do not offer preventive services however; they focus on something having already occurred.

A new breed of companies has come forward with technology to, theoretically, prevent a theft from occurring. Remember that one means of identity theft is to set up new credit, whether bank accounts or charge accounts, in the victim's name. These new companies operate by placing either credit freezes or fraud alerts on the customer's account. A credit freeze (which is not available in all states and which might be overturned by federal legislation) blocks any new accounts from being opened, while a fraud alert warns financial institutions to call to verify any new credit applications. Other companies monitor data available on the Internet, and notify customers if stolen information is discovered.

There are companies that offer computer security services for the consumer. These go beyond the typical antivirus software. Some will alert the user if a site is suspicious or a reported phishing site. For Google searchers, one company has software that will let the user know if the site is legitimate, if the searcher should use caution, or if not enough is known to make a determination. For a current list, see The Wall Street Journal, August 2, 2006 article “New PC-Security Software Combats Latest Scams,” by Vauhini Vara.

Visa has announced a new program to require merchants who process fewer than six million card transactions a year to comply with more rigorous standards. The other credit card providers—MasterCard, American Express, and Discover, are also considering more stringent standards.

Finally, if after faithfully following all tips and purchasing insurance, identity theft still occurs, move. A recent study (see various articles dated July 11, 2006) found that the cities that are most at risk for identity theft are: San Francisco, Seattle, Denver, San Jose, San Diego, Atlanta, Salt Lake City, Las Vegas, Sacramento and Phoenix. The cities with least risk: Rochester, Providence, Cincinnati, Cleveland, Virginia Beach, New Orleans, Birmingham, Louisville, Buffalo, and Pittsburgh.