Skip to content
Surf Wiki
Save to docs
general/identity-theft

From Surf Wiki (app.surf) — the open knowledge base

Identity theft

Deliberate use of someone else's identity

Identity theft

Deliberate use of someone else's identity

Note

the concept of identity theft

Example of an identity theft crime: 1. The fraudster files tax return paperwork in the victim's name, claiming a refund. 2. The IRS issues a refund to the fraudster. 3. The victim submits their legitimate tax return. 4. The IRS rejects the return as a duplicate.

Identity theft, identity piracy or identity infringement occurs when someone uses another's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The term identity theft was coined in 1964. Since that time, the definition of identity theft has been legally defined throughout both the UK and the U.S. as the theft of personally identifiable information. Identity theft deliberately uses someone else's identity as a method to gain financial advantages or obtain credit and other benefits. The person whose identity has been stolen may suffer adverse consequences, especially if they are falsely held responsible for the perpetrator's actions. Personally identifiable information generally includes a person's name, date of birth, social security number, driver's license number, bank account or credit card numbers, PINs, electronic signatures, fingerprints, passwords, or any other information that can be used to access a person's financial resources.

Determining the link between data breaches and identity theft is challenging, primarily because identity theft victims often do not know how their personal information was obtained. According to a report done for the FTC, identity theft is not always detectable by the individual victims. Identity fraud is often but not necessarily the consequence of identity theft. Someone can steal or misappropriate personal information without then committing identity theft using the information about every person, such as when a major data breach occurs. A U.S. Government Accountability Office study determined that "most breaches have not resulted in detected incidents of identity theft". The report also warned that "the full extent is unknown". A later unpublished study by Carnegie Mellon University noted that "Most often, the causes of identity theft is not known", but reported that someone else concluded that "the probability of becoming a victim to identity theft as a result of a data breach is ... around only 2%". For example, in one of the largest data breaches which affected over four million records, it resulted in only about 1,800 instances of identity theft, according to the company whose systems were breached.

An October 2010 article entitled "Cyber Crime Made Easy" explained the level to which hackers are using malicious software. As Gunter Ollmann, Chief Technology Officer of security at Microsoft, said, "Interested in credit card theft? There's an app for that." This statement summed up the ease with which these hackers are accessing all kinds of information online. The new program for infecting users' computers was called Zeus, and the program is so hacker-friendly that even an inexperienced hacker can operate it. Although the hacking program is easy to use, that fact does not diminish the devastating effects that Zeus (or other software like Zeus) can do on a computer and the user. For example, programs like Zeus can steal credit card information, important documents, and even documents necessary for homeland security. If a hacker were to gain this information, it would mean nationwide identity theft or even a possible terrorist attack. The ITAC said that about 15 million Americans had their identity stolen in 2012.

Types

Sources such as the Non-profit Identity Theft Resource Center sub-divide identity theft into five categories:

  • Criminal identity theft (posing as another person when apprehended for a crime)
  • Financial identity theft (using another's identity to obtain credit, goods, and services)
  • Identity cloning (using another's information to assume his or her identity in daily life)
  • Medical identity theft (using another's identity to obtain medical care or drugs)
  • Child identity theft.

Identity theft may be used to facilitate or fund other crimes including illegal immigration, terrorism, phishing and espionage. There are cases of identity cloning to attack payment systems, including online credit card processing and medical insurance.

Identity cloning and concealment

In this situation, the identity thief impersonates someone else to conceal their own true identity. Examples are illegal immigrants hiding their illegal status, people hiding from creditors or other individuals and those who simply want to become "anonymous" for personal reasons. Another example is posers, a label given to people who use someone else's photos and information on social networking sites. Posers mostly create believable stories involving friends of the real person they are imitating. Unlike identity theft used to obtain credit which usually comes to light when the debts mount, concealment may continue indefinitely without being detected, particularly if the identity thief can obtain false credentials to pass various authentication tests in everyday life.

Criminal identity theft

When a criminal fraudulently identifies themselves to police as another individual at the point of arrest, it is sometimes referred to as "Criminal Identity Theft." In some cases, criminals have previously obtained state-issued identity documents using credentials stolen from others, or have simply presented a fake ID. Provided the subterfuge works, charges may be placed under the victim's name, letting the criminal off the hook. Victims might only learn of such incidents by chance, for example by receiving a court summons, discovering their driver's licenses are suspended when stopped for minor traffic violations, or through background checks performed for employment purposes.

It can be difficult for the victim of criminal identity theft to clear their record. The steps required to clear the victim's incorrect criminal record depend on which jurisdiction the crime occurred and whether the true identity of the criminal can be determined. The victim might need to locate the original arresting officers and prove their own identity by some reliable means such as fingerprinting or DNA testing and may need to go to a court hearing to be cleared of the charges. Obtaining an expungement of court records may also be required. Authorities might permanently maintain the victim's name as an alias for the criminal's true identity in their criminal records databases. One problem that victims of criminal identity theft may encounter is that various data aggregators might still have incorrect criminal records in their databases even after court and police records are corrected. Thus a future background check may return the incorrect criminal records. This is just one example of the kinds of impact that may continue to affect the victims of identity theft for some months or even years after the crime, aside from the psychological trauma that being 'cloned' typically engenders.

Synthetic identity theft

A variation of identity theft that has recently become more common is synthetic identity theft, in which identities are completely or partially fabricated. The most common technique involves combining a real social security number with a name and birthdate other than the ones that are simply associated with the number. Synthetic identity theft is more difficult to track as it doesn't show on either person's credit report directly but may appear as an entirely new file in the credit bureau or as a subfile on one of the victim's credit reports. Synthetic identity theft primarily harms the creditors who unwittingly grant the fraudsters credit. Individual victims can be affected if their names become confused with the synthetic identities, or if negative information in their subfiles impacts their credit ratings.

Medical identity theft

Medicare cards

Privacy researcher Pam Dixon, the founder of the World Privacy Forum, coined the term medical identity theft and released the first major report about this issue in 2006. In the report, she defined the crime for the first time and made the plight of victims public. The report's definition of the crime is that medical identity theft occurs when someone seeks medical care under the identity of another person. Insurance theft is also very common, if a thief has your insurance information and or your insurance card, they can seek medical attention posing as yourself. In addition to risks of financial harm common to all forms of identity theft, the thief's medical history may be added to the victim's medical records. Inaccurate information in the victim's records is difficult to correct and may affect future insurability or cause doctors to rely on misinformation to deliver inappropriate care. After the publication of the report, which contained a recommendation that consumers receive notifications of medical data breach incidents, California passed a law requiring this, and then finally HIPAA was expanded to also require medical breach notification when breaches affect 500 or more people. Data collected and stored by hospitals and other organizations such as medical aid schemes is up to 10 times more valuable to cybercriminals than credit card information.

Child identity theft

Child identity theft occurs when a minor's identity is used by another person for the impostor's personal gain. The impostor can be a family member, a friend, or even a stranger who targets children. The Social Security numbers of children are valued because they do not have any information associated with them. Thieves can establish lines of credit, obtain driver's licenses, or even buy a house using a child's identity. This fraud can go undetected for years, as most children do not discover the problem until years later. Child identity theft is fairly common, and studies have shown that the problem is growing. The largest study on child identity theft, as reported by Richard Power of the Carnegie Mellon Cylab with data supplied by AllClear ID, found that of 40,000 children, 10.2% were victims of identity theft.

The Federal Trade Commission (FTC) estimates that about nine million people will be victims of identity theft in the United States per year. It was also estimated that in 2008; 630,000 people under the age of 19 were victims of theft. This then gave the victims a debt of about $12,799.

Not only are children in general big targets of identity theft but children who are in foster care are even bigger targets. This is because they are most likely moved around quite frequently and their SSN is being shared with multiple people and agencies. Foster children are even more victims of identity theft within their own families and other relatives. Young people in foster care who are victims of this crime are usually left alone to struggle and figure out how to fix their newly formed bad credit.

The emergence of children's identities on social media has also contributed to a rise in incidents of digital kidnapping and identity theft. Digital kidnapping involves individuals stealing online images of children and misrepresenting them as their own.

Financial identity theft

The most common type of identity theft is related to finance. Financial identity theft includes obtaining credit, loans, goods, and services while claiming to be someone else.

Tax identity theft

One of the major identity theft categories is tax-related identity theft. The most common method is to use a person's authentic name, address, and Social Security Number to file a tax return with false information, and have the resulting refund direct-deposited into a bank account controlled by the thief. The thief in this case can also try to get a job and then their employer will report the income of the real taxpayer, this then results in the taxpayer getting in trouble with the IRS.

The 14039 Form to the IRS is a form that will help one fight against a theft like tax theft. This form will put the IRS on alert and someone who believed they have been a victim of tax-related theft will be given an Identity Protection Personal Identification Number (IP PIN), which is a 6 digit code used in replacing an SSN for filing tax returns.

Techniques for obtaining and exploiting personal information

Identity thieves typically obtain and exploit personally identifiable information about individuals, or various credentials they use to authenticate themselves, to impersonate them. Examples include:

  • Using public records about individual citizens, published in official registers such as electoral rolls
  • Stealing cheques (checks) to acquire banking information, including account numbers and bank codes
  • Guessing Social Security numbers by using information found on Internet social networks such as Twitter and MySpace In some cases, after obtaining a victim’s personal information, identity thieves may alter the victim’s contact details such as their mailing address, phone number, or email to prevent notifications from reaching them and to delay detection of fraudulent activity.

Individual identity protection

The acquisition of personal identifiers is made possible through serious breaches of privacy. For consumers, this is usually a result of them naively providing their personal information or login credentials to the identity thieves (e.g., in a phishing attack) but identity-related documents such as credit cards, bank statements, utility bills, checkbooks, etc. may also be physically stolen from vehicles, homes, offices, and not the least letterboxes, or directly from victims by pickpockets and bag snatchers. Guardianship of personal identifiers by consumers is the most common intervention strategy recommended by the US Federal Trade Commission, Canadian Phone Busters and most sites that address identity theft. Such organizations offer recommendations on how individuals can prevent their information from falling into the wrong hands.

Identity theft can be partially mitigated by not identifying oneself unnecessarily (a form of information security control known as risk avoidance). This implies that organizations, IT systems, and procedures should not demand excessive amounts of personal information or credentials for identification and authentication. Requiring, storing, and processing personal identifiers (such as Social Security number, national identification number, driver's license number, credit card number, etc.) increases the risks of identity theft unless this valuable personal information is adequately secured at all times. Committing personal identifiers to memory is a sound practice that can reduce the risks of a would-be identity thief from obtaining these records. To help in remembering numbers such as social security numbers and credit card numbers, it is helpful to consider using mnemonic techniques or memory aids such as the mnemonic Major System.

Identity thieves sometimes impersonate dead people, using personal information obtained from death notices, gravestones, and other sources to exploit delays between the death and the closure of the person's accounts, the inattentiveness of grieving families, and weaknesses in the processes for credit-checking. Such crimes may continue for some time until the deceased's families or the authorities notice and react to anomalies.

In recent years, commercial identity theft protection/insurance services have become available in many countries. These services purport to help protect the individual from identity theft or help detect that identity theft has occurred in exchange for a monthly or annual membership fee or premium. The services typically work either by setting fraud alerts on the individual's credit files with the three major credit bureaus or by setting up credit report monitoring with the credit bureau. While identity theft protection/insurance services have been heavily marketed, their value has been called into question.

Potential outcomes

Identity theft is a serious problem in the United States. In a 2018 study, it was reported that 60 million Americans' identities had been wrongfully acquired. In response, under advisement from the Identity Theft Resource Center, some new bills have been implemented to improve security such as requiring electronic signatures and social security verification.

Several types of identity theft are used to gather information, one of the most common types occurs when consumers make online purchases. A study was conducted with 190 people to determine the relationship between the constructs of fear of financial losses and reputational damages. The conclusions of this study revealed that identity theft was a positive correlation with reputable damages. The relationship between perceived risk and online purchase intention were negative. The significance of this study reveals that online companies are more aware of the potential harm that can be done to their consumers, therefore they are searching for ways to reduce the perceived risk of consumers and not lose out on business.

Victims of identity theft may face years of effort proving to the legal system that they are the true person, leading to emotional strain and financial losses. Most identity theft is perpetrated by a family member of the victim, and some may not be able to obtain new credit cards or open new bank accounts or loans.

Identity protection by organizations

In their May 1998 testimony before the United States Senate, the Federal Trade Commission (FTC) discussed the sale of Social Security numbers and other personal identifiers by credit-raters and data miners. The FTC agreed to the industry's self-regulating principles restricting access to information on credit reports. According to the industry, the restrictions vary according to the category of customer. Credit reporting agencies gather and disclose personal and credit information to a wide business client base.

Poor stewardship of personal data by organizations, resulting in unauthorized access to sensitive data, can expose individuals to the risk of identity theft. The Privacy Rights Clearinghouse has documented over 900 individual data breaches by US companies and government agencies since January 2005, which together have involved over 200 million total records containing sensitive personal information, many containing social security numbers. Poor corporate diligence standards which can result in data breaches include:

  • failure to shred confidential information before throwing it into dumpsters
  • failure to ensure adequate network security
  • credit card numbers stolen by call center agents and people with access to call recordings
  • the theft of laptop computers or portable media being carried off-site containing vast amounts of personal information. The use of strong encryption on these devices can reduce the chance of data being misused should a criminal obtain them.
  • the brokerage of personal information to other businesses without ensuring that the purchaser maintains adequate security controls
  • Failure of governments, when registering sole proprietorships, partnerships, and corporations, to determine if the officers listed in the Articles of Incorporation are who they say they are. This potentially allows criminals access to personal information through credit rating and data mining services.

The failure of corporate or government organizations to protect consumer privacy, client confidentiality and political privacy has been criticized for facilitating the acquisition of personal identifiers by criminals.

Using various types of biometric information, such as fingerprints, for identification and authentication has been cited as a way to thwart identity thieves, however, there are technological limitations and privacy concerns associated with these methods as well.

Market

There is an active market for buying and selling stolen personal information, which occurs mostly in darknet markets but also in other black markets. People increase the value of the stolen data by aggregating it with publicly available data, and sell it again for a profit, increasing the damage that can be done to the people whose data was stolen.

Spread and impact

Surveys in the US from 2003 to 2006 showed a decrease in the total number of identity fraud victims and a decrease in the total value of identity fraud from US$47.6 billion in 2003 to $15.6 billion in 2006. The average fraud per person decreased from $4,789 in 2003 to $1,882 in 2006. A Microsoft report shows that this drop is due to statistical problems with the methodology, that such survey-based estimates are "hopelessly flawed" and exaggerate the true losses by orders of magnitude.

The 2003 survey from the Identity Theft Resource Center found that:

  • Only 15% of victims find out about the theft through proactive action taken by a business
  • The average time spent by victims resolving the problem is about 330 hours
  • 73% of respondents indicated the crime involved the thief acquiring a credit card In a widely publicized account, Michelle Brown, a victim of identity fraud, testified before a U.S. Senate Committee Hearing on Identity Theft. Ms. Brown testified that: "over a year and a half from January 1998 through July 1999, one individual impersonated me to procure over $50,000 in goods and services. Not only did she damage my credit, but she escalated her crimes to a level that I never truly expected: she engaged in drug trafficking. The crime resulted in my erroneous arrest record, a warrant out for my arrest, and eventually, a prison record when she was booked under my name as an inmate in the Chicago Federal Prison."

In Australia, identity theft was estimated to be worth between A$1billion and A$4 billion per annum in 2001.

In the United Kingdom, the Home Office reported that identity fraud costs the UK economy £1.2 billion annually (experts believe that the real figure could be much higher) although privacy groups object to the validity of these numbers, arguing that they are being used by the government to push for introduction of national ID cards. Confusion over exactly what constitutes identity theft has led to claims that statistics may be exaggerated. An extensively reported study from Microsoft Research in 2011 finds that estimates of identity theft losses contain enormous exaggerations, writing that surveys "are so compromised and biased that no faith whatever can be placed in their findings."

Notable identity thieves and cases

References

References

  1. (September 2007). "Oxford English Dictionary online". Oxford University Press.
  2. Synthetic ID Theft [http://www.unc.edu/~dubal/idtheft/synthetic.htm Cyber Space Times] {{webarchive. link. (9 October 2015)
  3. Hoofnagle, Chris Jay. (13 March 2007). "Identity Theft: Making the Known Unknowns Known".
  4. Drew Armstrong. (13 September 2017). "My Three Years in Identity Theft Hell". Bloomberg.
  5. "Wisconsin Statutes, Sec. 943.201. Unauthorized use of an individual's personal identifying information or documents.".
  6. Federal Trade Commission – 2006 Identity Theft Survey Report, p. 4
  7. "Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown". gao.gov.
  8. Sasha Romanosky. "Do Data Breach Disclosure Laws Reduce Identity Theft?". heinz.cmu.edu.
  9. Giles, Jim. (2010). "Cyber crime made easy". Elsevier BV.
  10. Giles, Jim. "'Credit card theft? There's an app for that'".
  11. [https://www.bjs.gov/content/pub/pdf/vit12.pdf Victims of Identity Theft, 2012] BJS
  12. "Identity Theft Resource Center website". idtheftcenter.org.
  13. "Medical Identity Theft: What to Do if You are a Victim (or are concerned about it)".
  14. "Privacy Rights Clearinghouse".
  15. "In Re Colokathis | 417 B.R. 150 (2009)".
  16. McFadden, Leslie. (16 May 2007). "Detecting synthetic identity fraud". Bankrate.com.
  17. "World Privacy Forum".
  18. "Get to Know These Common Types of ID Theft".
  19. "The Medical Identity Theft Information Page". World Privacy Forum.
  20. "Correcting Misinformation on Medical Records". Identity Theft Resource Center.
  21. (12 January 2016). "Government Turns Spotlight on Child ID Theft Problem".
  22. Clemente, Jean. (Feb 2010). "Protecting and defending a young person in foster care from financial identity theft".
  23. (2024-02-21). "Young Children and the Creation of a Digital Identity on Social Networking Sites: Scoping Review". JMIR Pediatrics and Parenting.
  24. "What is Financial Identity Theft". ID Theft Center.
  25. "In Focus Resource Center from Citrin Cooperman | Ideas That Count".
  26. Loviglio, Joann. (March 2012 }}{{dead link). "If Microsoft co-founder's ID isn't safe, is yours?". NBC News.
  27. "Identity Theft".
  28. Olmos, David. (6 July 2009). "Social Security Numbers Can Be Guessed From Data, Study Finds". Bloomberg.
  29. "What is identity theft? Explanation with examples".
  30. [http://www.idtheftcenter.org/Fact-Sheets/fs-117.html IDtheftcenter.org] {{webarchive. link. (17 April 2016, Identity Theft Resource Center Fact Sheet 117 Identity Theft and the Deceased - Prevention and Victim Tips.)
  31. "Identity Theft Protection Services".
  32. "Identity-Theft Protection: What Services Can You Trust?".
  33. (2018). "Protecting Children from Identity Theft Act: report (to accompany H.R. 5192) (including cost estimate of the Congressional Budget Office).".
  34. (1 May 2018). "Impact of Fear of Identity Theft and Perceived Risk on Online Purchase Intention". Organizacija.
  35. "ID Theft Aftermath Shows a Wake of Financial and Emotional Victims {{!}} Credit Union Times". Credit Union Times.
  36. "Testimony before the Subcommittee on Technology, Terrorism and Government Information".
  37. "A Chronology of Data Breaches".
  38. [http://www.siia.net/software/pubs/iit-00.pdf Internet Identity Theft - A Tragedy for Victims] {{webarchive. link. (22 April 2011 , [[Software and Information Industry Association]]. Retrieved 30 June 2006.)
  39. (2016). "Data thieves in action: examining the international market for stolen personal information". Palgrave Macmillan.
  40. (8 July 2015). "The ripple effect of identity theft: What happens to my data once it's stolen?". Information Age.
  41. "Airlines and governments not checking stolen passports register". The Daily Telegraph.
  42. "Identity crime and misuse in Australia".
  43. "Usurpation d'identité: la loi ou la technique pour se protéger ?".
  44. "The Information Technology Act 2000".
  45. "List of Facebook Users by Country Wise Top ranking 2016 - Tech Unblocked".
  46. "SFS 2016:485 Lag om ändring i brottsbalken".
  47. "Seward, R. v [2005] EWCA Crim 1941 (11 July 2005)".
  48. "CIFAS: your identity".
  49. "UK Fraud Prevention Agency Say ID Theft Increase of 32% in 2009".
  50. "The most likely victims of identity fraud: men in their late 30s and early 40s".
  51. "Fraudscape: report reveals the UK's fraud landscape in 2010".
  52. "FTC.gov".
  53. "Prepared Statement of the Federal Trade Commission on "Identity Theft"".
  54. Doyle, Charles. (2013). [https://fas.org/sgp/crs/misc/R42100.pdf Mandatory Minimum Sentencing: Federal Aggravated Identity Theft.] {{webarchive. link. (11 October 2016 Washington, D.C.: [[Congressional Research Service]].)
  55. [http://www.consumer.gov/idtheft/ Federal Trade Commission]. Retrieved 30 June 2006. {{webarchive. link. (31 January 2006)
  56. "Getting Red Flag Ready".
  57. [http://www.ftc.gov/os/fedreg/2007/december/071213factafurnisheraccuracy.pdf 72 Fed. Reg. 70944 ] {{webarchive. link. (17 February 2013 (PDF). Retrieved 29 January 2008.)
  58. "Law Enforcement Contact1 January 1 December 31, 2001".
  59. (September 2002). "Federal Trade Commission – Identity Theft Survey Report". [[Federal Trade Commission]].
  60. (1 November 2007). "Federal Trade Commission: 2006 Identity Theft Survey Report: Prepared for the Commission by Synovate".
  61. "FTC.gov".
  62. (2011). "Identity Theft Reported by Households, 2005-2010". Bureau of Justice Statistics.
  63. Harrell, Erika and Lynn Langton. (2013). [http://www.bjs.gov/content/pub/pdf/vit12.pdf Victims of Identity Theft, 2012.] {{webarchive. link. (7 September 2016 Washington, D.C. [[United States Department of Justice). U.S. Department of Justice]], [[Bureau of Justice Statistics]].
  64. "California Office of Identity Protection".
  65. "DATCP Home Identity Theft Protection".
  66. "Indiana General Assembly".
  67. (6 December 2013). "Attorney General: ID Theft Prevention". In.gov.
  68. link. (5 November 2011)
  69. [http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf "Frequently Asked Question Regarding 201 CMR 17.00"] {{webarchive. link. (11 August 2011 , Commonwealth of Massachusetts, Office of Consumer Affairs and Business Regulation, 3 November 2009)
  70. "Taxpayer Guide to Identity Theft". US Internal Revenue Service.
  71. "Form 14039". US Internal Revenue Service.
  72. "ALERT: Beware of Phishing Scam Mentioning TAS". Taxpayer Advocate.
  73. Hyde, J. (2017). Preventing Identity Theft and Strengthening the American Health Care System. Policy & Practice (19426828), 75(5), 26–34.
  74. "States Offer Data Breach Protection".
  75. (15 June 2011). "Sex, Lies and Cybercrime Surveys". Microsoft.
  76. "Home Page".
  77. "Verbal Testimony by Michelle Brown".
  78. [http://www.acpr.gov.au/research_idcrime.asp Identity Crime Research and Coordination] {{webarchive. link. (30 December 2005 , Australasian Center for Policing Research. Retrieved 30 June 2006.)
  79. Home Office. (26 May 2004). "What is Identity theft?". identitytheft.co.uk.
  80. (9 February 2022). "Free help, tips and advice on avoiding and dealing with Identity Theft".
  81. Bruce Schneier. "Identity Theft Over-Reported".
  82. (10 June 2011). "Hi-tech crime and sexual partner surveys 'biased'". BBC.
  83. (15 October 2011). "Measuring the black web". The Economist.
  84. (June 2011). "Sex, Lies and Cybercrime Surveys". Proc. WEIS.
Info: Wikipedia Source

This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page.

Want to explore this topic further?

Ask Mako anything about Identity theft — get instant answers, deeper analysis, and related topics.

Research with Mako

Free with your Surf account

Content sourced from Wikipedia, available under CC BY-SA 4.0.

This content may have been generated or modified by AI. CloudSurf Software LLC is not responsible for the accuracy, completeness, or reliability of AI-generated content. Always verify important information from primary sources.

Report