Identity Theft: Duty of Care to a Non-Customer

Identity theft is big business, but it also makes finding the perpetrator of a crime that more difficult. Financial and fraud investigators need to look at more then just the raw data they need to get the whole picture and story before jumping the gun. As an example, the following linked article demonstrates how being a little to quick to identify the frauster lead to the wrong person. >Identity Theft: Stutzman on a Bank's Duty of Care to a Non-Customer: It just goes to show that a what appears to be a smoking gun, isn't always the truth. Our Forensic Technology Team understands this and helps you work through these investigations methodically and with due care.

Read more!

Thank You For Putting Customer Satisfaction Last!

Taking a break from the normal week to write on this topic that has been bothering me for quite a while. If a company loses your data… and you are at risk for identity theft, they think it is kosher to offer you “up to one year of identity theft monitoring”.

So my question is… What about the next 2-20 years of your life?

A quick search on Google reveals that credit monitoring costs sit in the $12/month range. Yes that means if they lose your Social Security Number, Credit Card Numbers, PINs, etc… They owe you just $144. A sort of… “Oops! Sorry we lost your data.”

Five years down the road when someone decides to cash in on the theft they have made of YOUR data… Weellllllll… You’re on your own!

What organizations should start doing (besides including security in everything they do) is at least offer a lifetime worth of this service. This would say “We are extremely sorry that we lost your data, we will do anything we can to make sure that it will not be used maliciously. And if someone does… this will help you be able to stop them before they get anything!”

So until that day comes... (or never)… Those who have had their identity stolen will have problems like this guy... for years to come for much longer than “up to one year.”

Read more!

You want my what? Really.

They say that identity theft is a larger and more profitable business than drug trafficking.

I wonder why.

Hmmm, I don't know, maybe because EVERYONE HAS MY PERSONAL INFORMATION.



Help desk analyst I talked to recently:

"In order for me to help you, I'll need your Social Security Number."

My response: Really?

Person from certification body auditing my credentials:

"If you'll give me your Social Security Number, I might be able to save some time in collecting the information I need."

My response: Really?

Nurse at doctor's office that I spent all of 6 minutes at:

"I'll need all of your information filled out on this form, including your Social Security Number."

My response: Really.

Enough is enough. In the past 3 weeks, I've been asked for my Social Security Number by 7 people that I didn't know or inherently trust. Some of these people had legitimate reasons for asking for my info, but for others it was simply them wanting to "save some time".

As security professionals and evaluators of controls and procedures, we should be first to say, "Hey, how about we NOT ask for their SSN and maybe use other sources of info to verify their identity?"

I know what you're thinking.Wait, let ME say it. Social Security Numbers are one of the few reliable sources of personally identifiable information out there. I understand this. I just wonder why organizations worldwide use them so publicly and openly.

Bottom line: our Social Security Numbers shouldn't be the one and only source of information that we use to identify the people that interact with us. Organizations all over the world should be a little more creative with this process.

And to the people that GIVE this information so freely to the people that request it, all you need to do is say one word: "Why?" The organization or person should be able to answer this. If the response you're given makes your stomach hurt, just say: "Is there another piece of information that I can give you to identify me?" Most of the time there will be, and asking simple questions helps to limit the exposure in a number of ways.

Let me esplain...no wait, there is too much, let me sum up:

• If you're in a crowded area, and someone asked you to verbally give them your credit card number, would you do it? I hope not. Granted, the number of people that can memorize 12 to 16 digits after hearing them once is pretty limited, but you get my point.
• The majority of the time, call center operators that ask for anything related to your Social Security Number are only asking for the last 4 digits. Most of the time this is all that's visible to them on the monitor in front of them. If someone is asking for the full meal deal, take caution and again ask, "Why?".
• Stay on the side of caution when ANYONE asks for your SSN. Be cautious. Once you give it up, that's it. It's not like you can call American Express and ask them to issue you a new one.
  

All in all, let's work a little harder in keeping private information just that: PRIVATE. Organizations that need to identify us as consumers can do a better job of storing information about us that don't require something so personal, and we as customers and affiliates can do our part by questioning and limiting the use of our individual so-called secret number.

Read more!