There was a time when online identity theft was largely the domain of hackers who were challenged by the task of stealing identities and then reusing them for their own fun. The thought was scary for some, but wasn’t nearly as threatening as the new breed of criminals who have set out to use those identities to rake in billions of dollars a year.
“Criminal hackers have changed their motivation,†says Robert Siciliano, a Boston-based identity theft expert and consultant. “They used to steal identities for fun and fame, and now they’re doing it for financial gain.â€
The numbers back up Siciliano’s warning: According to the Federal Trade Commission, one in six Americans were victims of identity theft in 2008, with 9.93 million people having had some type of identity theft crime committed against them within the past 12 months.
One of the most popular ways that thieves steal personal information is through a scam called phishing, which begins with an e-mail to potential victims that appears to come from a legitimate business, such as a bank or a software company. The message asks the recipient to submit credit card information, social security numbers, bank account information, or additional personal data under a false pretense.
“This pretense is often a money-making opportunity, but it might also be a seemingly routine request to verify personal information,†says Jay Opperman, senior director of security and privacy for Comcast in Philadelphia. “The scammer’s e-mail may even include a link to a legitimate-looking Web site to capture this information.â€
According to the National Cyber Security Alliance, bots (also known as Web robots) are the Internet’s fastest-growing cyber crime right now. Using them, thieves are able to collect personal data from unsuspecting victims. “If a computer gets infected with a bot, it can steal credit card information, bank account information, sensitive business data, and social security numbers, which can lead to identity theft,†Opperman says.
With the holiday season in full swing — and with a high number of consumers expected to go online to search for bargains this year — the thieves are lurking everywhere. “They could be sitting outside of your home or office, monitoring your Internet transactions via wireless Web connections, tapped into your Internet Service Provider’s server, or infiltrating retail Websites, where you’re conducting transactions,†Siciliano says.
So how does one go about enjoying the information- and bargain-rich Internet in a way that doesn’t compromise
his or her identity? According to Opperman, the first step is to install, use, and update a reputable antivirus program such as MacAfee or Norton. That strategy alone can help detect any viruses (such as bots) that thieves would use to steal identities.Anti-phishing software is equally as important, and is also available from the antivirus software developers. Such applications help ward off criminals that disguise themselves as legitimate retailers or financial institutions, and that whisk unsuspecting consumers off to the criminals’ Websites from which they can collect sensitive personal information. “Using anti-phishing software that resides on your toolbar, you’ll know immediately that you’ve landed at a phishing site,†Opperman says.
Opperman also tells consumers to use “good, strong passwords†that go beyond the typical pet, children, and spouse names. “Use a password that is no less than eight characters, and that includes a combination of upper and lower case characters and numbers,†says Opperman. “Mix it up, and change them often to ensure that the bad guys can’t use harvest attacks (schemes that find criminals randomly attempting to decipher passwords based on a list of pet and children names, for example) to steal your identity.â€
Finally, Siciliano says, one of the best ways to protect your identity online is to do business only with reputable companies that you know and trust.
The Federal Trade Commission offers three steps in fighting and preventing identity theft:
DETER
Shred financial documents and paperwork that has personal information before you toss them.
Protect your Social Security number. Don’t carry your Social Security card in your wallet or write down your Social Security number. Give it out only if necessary or ask to use another way to identify yourself.
Never click on links sent in unsolicited e-mails. Use firewalls, anti-spyware, and anti-virus software to protect your computer at home as well as at your business, and be sure to keep them up-to-date. Visit OnGuardOnline.gov for more information.
Keep your personal information in a secure place at home, especially if you have roommates, employ outside help, or are having work done by outsiders in your home.
DETECT
Monitor your financial accounts and billing statements. Be aware of signs that require immediate attention such as when bills arrive unexpectedly, credit denial notices arrive for no apparent reason, or you receive calls or letters about purchases that you did not make.
Stay up to date on the information in your credit report. The law requires the major nationwide consumer reporting companies–Equifax, Experian, and TransUnion–give you one free copy of your credit report each year if you request it.
DEFEND
Place a “Fraud Alert” on your credit reports, and review the reports carefully. The alert tells creditors to follow certain procedures before they open new accounts in your name or make changes to your existing accounts. The three main consumer reporting companies have toll-free numbers for placing an initial 90-day fraud alert.
Equifax: 1-800-525-6285
Experian: 1-888-EXPERIAN (397-3742)
TransUnion: 1-800-680-7289
Call the security or fraud departments of each company where an account was opened or changed without your permission. Follow up in writing, with copies of supporting documents. You can use the ID Theft Affidavit to support your written statement. Ask for verification and keep organized and detailed documentation in processing any type of complaint or notification.
File a police report to help you with creditors who may want proof of the crime. Also, report the theft to the Federal Trade Commission online, by phone (1-877-ID-THEFT), or by mail (Identity Theft Clearinghouse, Federal Trade Commission, Washington, DC 20580).
For more information on identity theft, see the Federal Trade Commission’s guide for businesses.