With the "prosecutor purge" scandal hanging over him, Attorney General Alberto Gonzales and Federal Trade Commission (FTC) chairman Deborah Platt Majoras released the latest federal strategy for fighting identity theft Monday.

Consumer advocates and privacy specialists were generally underwhelmed by the plan.

Gonzales and Majoras are co-chairs of the President's Identity Theft Task Force, comprised of heads of multiple government agencies, commissioned to come up with comprehensive strategies for fighting identity theft, fraud, and cybercrime.

Although Gonzales was bombarded with questions related to his role in the firing of multiple U.S. attorneys from their jobs, he attempted to focus his statements on the identity theft plan.

"Much has been accomplished, and there are more protections in place now than ever before," Gonzales said. "But the president and the task force recognize that we need to do more."

"Identity thieves steal consumers' time, money, and security, just as sure as they steal their identifying information, and they cost businesses enormous sums," Majoras said. "The Strategic Plan submitted to the President provides a blueprint for increased federal prevention and protection."

Gonzales' role in the prosecutor firings has cost him considerable standing on Capitol Hill and led many to call for his resignation.

"Several senators have raised the question of whether you can be credible and whether or not you can be an effective attorney general," one reported asked at today's news conference. "Do you still believe you can, and have you offered your resignation to the president?"

"No," Gonzales replied curtly. "I'm focused on making sure our kids are safe, making sure our neighborhoods are safe, making sure consumers are safe, and that's one of the reasons I'm here today."

One Step Forward ...

The plan came in two volumes, totaling 190 pages. The first volume contained the Task Force recommendations, while the second contained information and resources relating to identity theft. Among the recommendations:

• The formation of a National Identity Theft Law Enforcement Center as a clearinghouse to collect, analyze, and share identity theft information among the various private and public sector agencies. The Center would be headed by the Justice Department, and would include the FTC, the Social Security Administration, the U.S. Postal Service, and the FBI, among others.

• Decrease the usage and collection of Social Security numbers on the state, local, and federal levels. The Task Force recommended that the federal Office of Personnel Management (OPM) complete its review of how various agencies utilize SSNs, and to help develop guidance on limiting their collection to absolutely necessary functions.

• Establishing federal standards for data breaches, including risk evaluations to determine the severity of the breach, consumer and media disclosures, and enforcing the standards in the public and private sector.

• Developing a "Universal Identity Theft Report Form" to be used as the standard for all complaints across the board

• Extensive education of the public, private, and consumer sector on how to protect oneself from identity theft.

... One Step Back

Several aspects of the report may actually hinder stronger prosecution and enforcement against identity theft. The report recommends that its federal laws pre-empt existing state laws on identity theft and fraud, many of which are stronger and more favorable to the consumer than legislation currently proposed at the federal level.

If the new recommendations become law, California's data breach disclosure laws -- acknowledged to be the strongest in the nation -- would be superseded.

Were it not for those rules, the public might never have known about the ChoicePoint data breach that vaulted the issue to the national stage, cost the embattled data broker $15 million in an FTC settlement, and turned it into a model of privacy protection.

Federal legislation proposed in the Senate, by contrast, would give law enforcement carte blanche to delay consumer notification of data breaches while they investigate, and would enable businesses to handle their own "risk assessments," rather than opening their records to neutral third parties.

The report is also lukewarm on endorsing "credit freezes," which enable consumers to lock out access to their credit unless they give specific permission. Although many states already have credit freeze laws on the books, the report only recommends further study of the legislation.

Indeed, the report's strongest words about credit freezes are these: "Because most companies obtain a credit report from a consumer before extending credit, a credit freeze will likely prevent the extension of credit in a consumer's name without the consumer's express permission."

Both volumes of the report are available as free PDF downloads from the government's identity theft "resource" page, IDTheft.gov.

In a surprise reversal and a major win for consumers, the Trans Union credit bureau announced that it would offer consumers the ability to "freeze" their credit files in all 50 states in order to protect themselves against identity theft and fraud.

The service will be available in the 11 states that do not already have credit-freeze laws, costing consumers $10 to set the freeze and $10 to unlock it, and will "meet or exceed the requirements" of states with existing freeze laws.

The freeze service will be free to victims of identity theft, and is scheduled to roll out Oct. 15. TransUnion is also offering a more expensive package that combines credit monitoring with the ability to lock and unlock credit freezes online, for $14.95 monthly.

"TransUnion understands that many consumers are concerned about identity theft and want access to tools that provide them with a personal level of comfort," said Trans Union's Mark Marinko.

"We're pleased to be in a position to empower all consumers with the extra measure of security and peace of mind that a file freeze can deliver under the right circumstances."

Consumer advocates hailed Trans Union's decision and urged the remaining bureaus to follow suit. For a security freeze to be effective to stop new account identity theft, it must be placed at each of the three major credit reporting agencies, said Consumers' Union's Gail Hillebrand. Thats why it is so essential for Experian and Equifax to offer the freeze nationwide.

Equifax followed suit, announcing yesterday that it too would offer credit freezes for customers in all 50 states, and would roll out its own plan sometime in October.

Experian undecided

The last of the "Big Three" credit bureaus, Experian, is still "studying the process," said spokesperson Don Girard. "We expect to make an announcement on our decision in the near term."

Credit freezes prevent new credit accounts or loans from being made in someone's name without their explicit authorization, such as a password or PIN code.

The freeze can reduce or prevent the most common form of identity theft, where someone's personal information is used to open new credit cards and take out loans in their name, without their knowledge.

Thirty-nine states and the District of Columbia already have laws in place enabling consumers to freeze their credit, with varying rules and costs for usage. The credit and financial industries have aggressively lobbied against credit freeze laws, claiming they would reduce the availability of credit and discourage shoppers from making big-ticket purchases due to the time spent unlocking a credit account.

Efforts by the credit industry to push weaker national credit protection laws that would preempt state law stalled out in Congress. States such as Utah have passed laws enabling citizens to freeze and unfreeze their credit accounts in as little as 15 minutes.

Consumer advocates and identity theft protection companies such as TrustedID have also heavily advocated the passage of credit freeze laws in all 50 states, claiming that the availability of personal information combined with easy access to credit makes consumers too vulnerable to identity theft and fraud.

Just as the major credit bureaus began offering comprehensive -- and expensive -- identity theft protection services to customers in the wake of the explosion in high-profile data breaches, credit freezes and associated protection plans represent a potentially lucrative new revenue stream for the bureaus to make use of.

But as Consumers Union's Hillebrand notes, if the bureaus have the technical means to enable instant locking and unlocking of credit, they should not be charging high fees to use a service that can be turned on and off in minutes.

TransUnion and the rest of the credit bureaus should follow the lead of the states with the best security freeze laws and provide this protection to all consumers for no more than $5, Hillebrand said. All three credit bureaus should make it fast, affordable, and easy for consumers nationwide to take advantage of this important identity theft safeguard.

 

 

November 1, 2005
Forty-six state Attorneys General are calling on Congress to help protect consumers from identity theft by enacting national security breach and credit freeze legislation.

The proposed laws would require businesses entrusted with personal financial data to notify consumers if their company's data files are breached and allow consumers to put a credit freeze on their accounts.

In the letter, the AGs point out that millions of consumers over the past year have been exposed to potential ID theft because of security breaches suffered by large financial and retail establishments.

California adopted the nation's first security breach notification law in 2003, and 21 states enacted similar statutes in the past year.

"Personal information" acquired or accessed by an unauthorized person which would trigger notification includes: • Social Security number. • Driver's license number or government-issued ID number. • Unique electronic ID number. • Unique biometric data such as fingerprint, voice print or retina image. • Home address or telephone number. • Mother's maiden name. • Month and year of birth.

The Attorneys General also called for a strong federal security freeze law that would give consumers the right to place a "fraud alert" on their credit reports for at least 90 days, with extended alerts when an ID theft occurs.

Provisions recommended by the Attorneys General include: • Making the security freeze available to all consumers at no or low cost. • Banning fees for victims of ID theft who have a police report or FTC affidavit, seniors, veterans and persons who receive notice of a security breach. • Allowing consumers to selectively or temporarily lift the freeze. • Permitting consumers to contact one consumer reporting agency and have the freeze apply to all three major credit agencies.

April 19, 2005
New York Attorney General Eliot Spitzer and representatives of consumer advocacy and crime victims organizations are urging the State Legislature to protect consumers from identity theft and the unauthorized use of personal data.

Spitzer has submitted a package of bills aimed at providing consumers better control over the dissemination of their personal information, strengthening government's ability to prosecute crimes leading to identity theft and increasing penalties for such crimes.

"It has been said that the theft of one's identity and personal information is not a matter of 'if' but a matter of 'when'," Spitzer said. "New York State must enact reforms to strengthen consumers' ability to control personal information and to facilitate the prosecution of identity theft crimes."

In February, the Federal Identity Theft Data Clearinghouse reported that 38 percent of all fraud claims in 2004 related to identity theft, and New York State ranked seventh in the nation in per-capita identity theft reports. Moreover, a national survey conducted by the Federal Trade Commission estimated that the number of victims in 2002 approached 10 million, including 663,300 New Yorkers.

Spitzer noted that in the last nine weeks alone, numerous incidents have highlighted the issue including:

• Two major information brokerage companies, ChoicePoint, Inc. and LexisNexis have admitted that data files of over 455,000 consumers were breached;
• One of the world's largest financial institutions, Bank of America, confirmed that backup tapes containing personal data on 1.2 million accounts were missing;
• Federal authorities confirmed an investigation into the electronic hacking theft of eight million credit card accounts from the processor of credit transactions for MasterCard, Visa, Discover and American Express;
• A popular shoe store chain, DSW Shoe Warehouse admitted that customer credit information was stolen from over 100 of its stores; and
• Approximately 180,000 GM Mastercard holders will soon receive notification that someone might have stolen their personal information in a data breach at Polo Ralph Lauren Inc.

Spitzer's legislative proposals would address many of these incidents by:

• Providing identity theft victims better control over their personal identifying information, including: allowing for "security freezes" on credit files; and providing significantly increased protections against a private company's disclosure of a customers' social security numbers;

• Requiring companies to provide notice to individual consumers involved in instances in which a security breach has exposed personal information concerning 500 or more New Yorkers;

• Facilitating the ability of victims to file criminal complaints with law enforcement agencies;

• Requiring that information brokers notify consumers whenever a report containing personal information - such as telephone numbers, bank account information, income, medical information, driving record, and purchasing preferences - has been issued and mandating the disclosure include contact information of the entity that requested the report. The bill also would provide consumers access to their profiles compiled by information brokers;

• Establishing statewide personal information "opt-out" lists, similar to the Telemarketing Do Not Call program, for consumers who want to ensure their confidential personal information is not disclosed;

• Facilitating prosecutions against computer hackers by creating specific criminal penalties for the use of encryption to conceal a crime, to conceal the identity of another person who commits a crime, or to disrupt the normal operation of a computer;

• Increasing criminal penalties for gaining unauthorized access through a computer to data about employment, salary, credit or other financial or personal information;

• Facilitating prosecutions against hackers and others who surreptitiously gain access to computers, but do not steal or destroy computer material.

 

How does a driver's license stolen from a St. Louis, Missouri, man end up in a cheap motel room hundreds of miles away?

That's a question that initially baffled investigators when they found the ID in the Merriam, Kansas, flophouse.

But it didn't take long for police to solve the mystery once they learned the motel room doubled as an identity theft laboratory -- filled with computers, scanners, printers, and dozens of stolen ID's -- and the masterminds behind the operation were methamphetamine addicts.

"There's a close link between methamphetamine use and identity theft," says Prosecutor Vanessa Riebli, head of the Johnson County, Kansas, District Attorney's Economic Crime Unit. "ID's are traded or sold for drugs across the country, and drug users are supporting their habit with identity theft."

And they're making good money. The husband-wife team involved in the Merriam, Kansas case netted $60,000-$100,000 in their scheme, Riebli says.

"Identity theft is so much more profitable than other crimes," she says, adding the husband made the phony checks and the wife passed them using the fake ID's. "And if the defendants get caught, they know the penalties for identity theft are less severe than other crimes."

Riebli charged the couple involved in this 2003 case with identity theft, but neither served much time behind bars. Thirty-seven-year-old Owen Samuel Barlow, a former computer programmer at Sprint, received a two-year sentence. His wife -- 41-year-old accountant Teresa A. Barlow -- received an 18-month sentence.

Story continues below video

Riebli says this case illustrates why methamphetamine addicts have turned to identity theft -- the fastest growing crime in the country -- to support their habits.

"Why would you rob a bank when you can walk inside a bank, commit check fraud, get more money, and -- if you get caught -- receive a much less severe penalty?"

100% Free Financing

Owen & Theresa Barlow Source: Kansas Department of Corrections

Detective Byron Pierce of the Overland Park, Kansas, Police Department has investigated scores of identity theft cases.

And he's noticed a sharp increase in the number of methamphetamine users stealing or assuming someone else's identity to finance their addictions, which can cost hundreds of dollars a day.

"When our officers bust meth labs, they're seeing stolen personal information like credit cards, driver's licenses, Social Security cards, checkbooks, employee ID's," says the veteran detective with the department's Financial Crime Unit.

"There's a direct correlation between drugs and fraud. When drugs are involved, fraud is involved. When fraud is involved, drugs are involved. The two are almost synonymous. And there's no question that there's a correlation between methamphetamine use and identity theft," he said.

What's the driving force behind this criminal phenomenon?

"Identity theft is 100 percent free financing for their drugs," Pierce says. "When you finance your drugs with other peoples' personal information, there's no risk associated with buying any amount of drugs because it's not affecting your bottom line.

"Identity theft is also an easy crime to commit, and if you get caught the penalties are less severe than those associated with other crimes," he adds. "The people involved in these crimes know that. Everyone talks ... there's a lot of collaboration and they'll say 'that's a good idea, let's try it.'"

"Time to plot out a plan to get money"

Methamphetamine addicts are also excellent candidates to commit identity theft because of the effects the drug has on their systems, medical experts say.

A meth user, for example, can stay awake for days and do such repetitive tasks as piecing together shredded documents or testing credit card numbers to buy merchandise online.

"These users can be up for days and that gives them time to plot out a plan to get money," says Jim Philipps with the National Association of Counties. His organization studied the criminal effects methamphetamine has on communities. "They'll come up with ways to get money ... usually by stealing mail or credit cards."

Twin Scourges Intertwine

Law enforcement officials say the connection between methamphetamines and identity theft has become a nationwide problem -- one that started in the West and is rapidly moving across the country.

Consider:

• Two Oxford, Georgia, women who ran an identity theft scheme pleaded guilty in November 2006, to possession of stolen mail. The women confessed they dealt methamphetamines and their customers paid them with stolen mail. The women would then use the financial information in the stolen mail -- including paychecks, credit cards, and bank statements -- to commit identity theft. "This case demonstrates that the twin scourges of meth and identity theft often intertwine -- multiplying their damaging effects on the public, since one crime is used to fuel the other," said United States Attorney David E. Nahmias.

• Postal inspections in 2005 tracked down an Arizona woman -- who had eluded them for than a year -- in a Phoenix apartment. Investigators found personal information belonging to 400 potential identity theft victims, a stash of methamphetamine in the kitchen, and merchandise purchased with stolen credit cards.

• The San Diego, California, District Attorney's Office reported that cases involving methamphetamine and identity theft jumped 35 percent from 2002-2005. Law enforcement officials in San Diego also noted that 75 percent of the suspects in local identity theft cases showed evidence of methamphetamine abuse. San Diego officials called the connection between meth and identity theft "a clear danger to both the public and business community."

• In 2006, The National Association of Counties examined the criminal effect of methamphetamine on communities. Of the 500 sheriffs who responded to the survey, 31 percent reported an increase in identity theft-methamphetamine related crimes.

One of the sheriffs who participated in that study is Patrick Hedges of San Luis Obispo, California.

"Our experience with meth users is that they often steal mail," he says. "There are people who go around almost every night and look for mailboxes that have the flags up. They take the mail and if they find checks, they'll doctor them and make the checks payable to themselves. Or they'll apply for a credit card using the stolen information."

He adds: "These meth users are usually people on the street who have to support their habit. They're the ones who lift mail, get involved in stolen checks and credit cards, or copy down someone's personal information at a restaurant or gas station. They're involved in less risky types than someone on heroin."

"A Wave of Identity Theft

This growing methamphetamine-identity theft problem has captured the attention of U.S. Senator Maria Cantwell, (D-Wash.).

In 2005, Cantwell introduced a bill that asked the Justice Department to investigate the link between ID theft and methamphetamine use. The measure was referred to the Judiciary Committee, but never came up. Cantwell's office says the senator plans to reintroduce the bill this year.

When she introduced the measure in 2005, Cantwell said: "The meth epidemic is creating a wave of identity theft."

Her bill has the support of U.S. Senator Dianne Feinstein (D-Calif.).

"In recent years, we've seen the number of meth labs seized and reports of identity theft shoot up," Feinstein said in 2005. "Law enforcement officials are reporting that this is not just a coincidence. These two crimes can turn people's lives upside down and threaten entire communities. It's time to take a closer look at the connection between meth use and identity theft."

Identity Theft Capital

One of the hotbeds of identity theft in the country -- and a state where methamphetamine is widespread -- is Arizona.

The Federal Trade Commission in 2006 even named the Grand Canyon State the identity theft capital of the United States. The FTC reported Arizona had 156.9 identity theft victims per 100,000 people.

U.S. Postal Inspector Bob Maes says there's a good chance the criminals who stole those victims' identities were hooked on meth.

"In the West it seems like methamphetamine abuse runs hand-in-hand with identity theft," says Maes, who worked in Phoenix until 2004 and then transferred to Utah. "These meth addicts all know someone who will trade drugs for Social Security numbers. One meth addict will know someone who does dumpster diving, one knows someone who steals mail, and another knows someone who is into home burglaries.

"The issue is not the ID, it's the date of birth, Social Security, or identification number on that ID," he adds. "That's what they want. And when you talk to these meth users, they'll know the going rate for a checkbook or a credit card."

Detective Pierce with the Overland Park Police Department says a good ID in Kansas has a street value of $100-$500.

But some ID's go for much more.

"I've learned through interviews with people I've arrested that these guys love checkbooks with Ph.D, CEO, or doctor on the checks. The ID's of a Ph.D. or doctor is much higher and worth a lot more on the street."

Pierce and other law enforcement officials say methamphetamine users will stop at nothing to get someone's ID and other personal information.

"What we're finding is these meth users are committing burglaries themselves and looking for personal data and information they can turn into something usable," Pierce says.

But there are other unsuspecting ways methamphetamine users can obtain your personal information to support their drug habits:

• A clerk at a bank, retail store, or dry cleaner can write down your personal information or credit card number. "We've had cases where a clerk at a convenience store wrote down information from checks and then turned around and sold that information," says Postal Inspector Maes.

• A waiter or waitress can scan your credit card -- or write down the numbers -- and sell the information. "When you give your credit card to waiter you don't know what happens to it," says Sheriff Hedges of San Luis Obispo.

• Files can be stolen from your investment company. "Many times this happens by an insider who works for a financial institution and is a drug addict," Maes says.

• Employees of painting or cleaning companies -- working after the businesses close -- can steal client information. "They can steal a few files and no one will know they're missing until the information is compromised," Maes says.

Consumers are also "asking for trouble" if they leave birth certificates, checkbooks, saving accounts information, Social Security cards, and other personal information in an unlocked car or home, Maes says.

The Underground Market

If your identity is stolen, law enforcement officials say, you're likely to be victimized again -- in many cases by another methamphetamine user.

"There's an underground market where your information is traded and bartered all over streets and maybe all over the country," says detective Pierce. "Remember, this is 100 percent free financing for these methamphetamine users. The drugs are free when they buy them and they're free when they sell them."

Prosecutor Riebli of Johnson County, Kansas, agrees.

"If you've had your identity compromised, it can happen again and again," she says. "There's nothing to prevent these individuals from trading ID's for their drugs."

That means your stolen identity could wind up in some cheap motel room and be used to finance another meth-head's addiction.

Next: Types of Identity Theft

Identity theft is a growing problem because it is so easy for a criminal, with just some of your personal information, to open lines of credit in your name. A way to make it harder for identity thieves is freezing your credit report, but should you take that step?

A growing number of states have passed laws allowing consumers to tell the three major credit reporting agencies - Equifax, Experian and TransUnion - to place a "freeze" or block on sharing their credit reports. A credit freeze prevents potential creditors and other third parties from accessing credit reports without your approval.

Even if the thief has your Social Security number, he may not be able to steal your identity if your have a freeze on your credit report. Most businesses will not open credit card or other accounts without checking your credit history at the reporting agencies. If your credit files are frozen, an identity thief probably would not be able to get credit in your name.

While the credit agencies will freeze your account, there is a charge for that service. A credit report freeze costs $10 each to place a freeze with the credit bureaus, or $30 total for the three reporting agencies. The fee is waived in most states if the consumer has already been a victim of identity theft.

But what happens when you want to get a bank loan or apply for a credit card? A freeze on your credit report means you won't be able to do it. The freeze remains in place until you ask to remove it. To lift a credit freeze, consumers must contact each credit reporting agency and pay the required fee. By law, the maximum each company may charge is $12.

Consumer advocacy organizations have been petitioning the credit bureaus to make setting up a credit freeze easier and quicker. They claim that consumers have been slow to sign up for them because the procedure is time-consuming and costly.

While freezing your credit report provides a measure of protection, it's not bulletproof. Identity thieves could still use your existing credit card or other accounts, and some new accounts may not require a credit check such as telephone, wireless, and bank accounts. But a freeze can prevent the vast majority of identity theft that involves opening a new line of credit.