Identity Theft: Not So Scary Anymore?

This article originally appeared on F5.com on 10.20.15.

With Halloween in our rearview mirror and the holiday shopping season upon us, a couple surveys are out examining our fears and in particular, our concerns about identity theft. Apparently, ID theft is not so scary anymore - like entering a haunted house for the hair-raising screams but walking out with nervous giggles.

Over at Bankrate.com, only 54% of surveyed tricksters says they are somewhat or very frightened of ID theft. That's down 80% from those who expressed the same level of concern back in 2008. Almost half, 43%, claim they have little or no fear, trouncing the 19% who were brave in 2008. This is all while the overall victim count remains at similar levels - 12.5 million in 2008 verses 12.7 million in 2014 according to Javelin Strategy & Research. As far as knowing someone who has been hit, 46% say they or a friend has been a victim compared to 34% in 2008.

They chalk it up to people being desensitized to breaches due to the almost weekly confessions of data intrusions. The general feeling is that if large retailers, health care providers and credit agencies can't keep my data safe, how can I. More of those same folks however are also following some good advice of shredding sensitive documents (72%), checking their credit report regularly (56%), avoiding insecure WiFi (54%) and almost 20% have frozen their credit files. These are all good ways to help you worry less.

And Chapman University published their Survey of American Fears, Wave 2 (2015) examining the fears of average Americans. The domains of fear include areas like crime, natural and man made disasters, personal anxieties, environment, technology and others. Along with the corruption, terrorism and warfare, identity theft comes in at 39.6% and credit card fraud sits at 36.9%. Both in the Top 10.



So, while ID theft is still one of our top fears, by the time you get to Nightmare on Identity Street 4, Freddy isn't so freighting and you have some tools to deal with him.

Besides, your insecure connected kettles could be exposing your WiFi passwords without your knowledge. Now that's scary!

ps

Related

• Survey: More Americans say 'boo' to the ID theft boogeyman
• America’s Top Fears 2015
• Connected kettles boil over, spill Wi-Fi passwords over London
• The Breach of Things
• The Reach of a Breach
• 5 Stages of a Data Breach

Technorati Tags: identity theft,breach,privacy,crime,fears,silva,fraud

Connect with Peter:	Connect with F5:

Fear and Loathing ID Theft

Do you avoid stores that have had a credit card breach?

You are not alone. About 52% of people avoid merchants who have had a data breach according to a recent Lowcards survey. They surveyed over 400 random consumers to better understand the impact of identity theft on consumer behavior. 17% said they or a family member was a victim of identity theft over the last year with half the cases being credit card theft. 94% said they are more concerned or equally concerned about ID theft. They estimate that there were 13.5 million cases of credit card identity theft in the United States over the last 12 months.

These concerns are also changing the way some people shop.

Over half (56%) are taking extra measures to protect themselves from identity theft. Some of these behaviors include using a debit card less (28%), using cash more (25%), ordering online less (26%) and checking their credit report more (38%). These are all reasonable responses to the ever challenging game of protecting your identity and is important since 89% of security breaches and data loss incidents could have been prevented last year, according to the Online Trust Alliance's 2014 Data and Breach Protection Readiness Guide.

The game is changing however, and mobile is the new stadium. Let's check that scoreboard.

Most of the security reports released thus far in 2014, like the Cisco 2014 Annual Security Report and the Kaspersky Security Bulletin 2013 show that threats to mobile devices are increasing. We are using them more and using them for sensitive activities like shopping, banking and storing personally identifiable information. It is no wonder that the thieves are targeting mobile and getting very good at it. Kaspersky's report talks about the rise of mobile botnets and the effectiveness since we never shut off our phones. They are always ready to accept new tasks either from us or, a foreign remotely controlled server with SMS trojans leading the pack. Mobile trojans can even check on the victim's bank balance to ensure the heist is profitable and some will even infect your PC when you USB the phone to it.

Distribution of exploits in cyber-attacks by type of attacked application

I guess the good news is that people are becoming much more aware of the overall risks surrounding identity theft and breaches but will the convenience and availability of mobile put us right back in that dark alley? Mobile threats are starting to reach PC proportions with online banking being a major target and many of the potential infections are delivered via SMS messages. Sound familiar?

Maybe we can simply cut and replace 'PC' with 'Mobile' on all those decade old warnings of:

Watch what you click!

ps

Related

• Some consumers changing habits because of data breach, ID theft worries, report finds
• LowCards Exclusive Study: Identity Theft Concerns Shifting Shopping Habits of Americans
• Kaspersky Security Bulletin 2013. Overall Statistics for 2013
• Mobile Payments and Devices Under Attack
• An SMS Trojan with Global Ambitions
• Mobile Malware Milestone
• Mobile Threats Rise 261% in Perspective
• Nine Security Best Practices You Should Enforce

 

Technorati Tags: mobile,shopping,breach,malware,idtheft,behavior,silva,trojan,security

 

Connect with Peter:	Connect with F5:

Moving Target

I moved recently. Not too far away nor to a different state, just the other side of town. It is simultaneously exhilarating and exhausting. Most people in the U.S. moving during the summer. Kids are out of school, the weather is mostly nice, friends might be available to help and you are settled in for the holidays. And while you are worrying about packing, movers, mail and all the other check lists, your identity is ripe for the picking.

The increased risk of identity theft during a move is because personally identifiable information is being shuffled around from one home to the next. At the same time, buyers and renters are preoccupied with the move and can forget to protect their sensitive documents. You may lock up or personally carry your jewelry, checkbook and other 'valuables' but your personal information might be unprotected and targeted during a move.

If you are moving this summer like I just did, there are a few things you can do to minimize the risk. While most moving sites have 'Change of Address' as their top protection mechanisms (which we'll get to), I feel that shredding old bills, receipts and financial info is critical. First, you might not want to drag all that old paperwork with you, especially if you are paying by the pound but more importantly, shredding important documents can prevent thieves from finding any information in your trash. Old-skool dumpster diving is still a viable method to steal personal information. You also might not want the movers themselves to have access to those documents, particularly if you are having them help pack. I was fortunate to find reputable movers but mover fraud is becoming more commonplace in the U.S.

Mail call! What? Oh yea, Change of Address. Seems like a no brainer, filling out a postal change of address but it is also important. Make the change with all the companies, financial institutions, magazines, and other organizations that regularly send you mail. Identity theft is often carried out by stealing mail. The folks who move into your old house might not steal your identity, but they will most likely throw away mail that isn’t theirs, and they won’t necessarily take the care to shred it as you would. If your mail continues to be delivered to your old address, it might be left on the doorstep or in an unlocked mailbox, making it very easy for anyone to walk away with it.

Lock down your electronics. Many households have multiple computers now including tablets, mobile phones and other 'things' storing sensitive information. These are a treasure trove. You can carry/pack yourselves and make sure they are always in your possession or password protect and place in a slightly unmarked box. Maybe label it as 'dog food' and the crook, movers or otherwise, just might pass it over. If you plan on donating or recycling your old computer(s), make sure you totally erase the hard drive since criminals can easily retrieve those files and sue them for no good. Slightly related to this, I recently bought a refurbished Blu-ray player with various streaming services. I wanted to replace the one we broke with the exact same one but they stopped making that model. When it arrived, I went in to configure our Netflix account. So I clicked the Netflix icon and it loaded fine. Wait a minute, that's not my Instant Que. Whoever had the unit prior to me, still had their Netflix saved and I could see all their viewing habits. Old episodes of Leave it to Beaver and Attack of the 50 Foot Cheerleader.

And keep an eye out for yourself before, during and after. Check credit monitoring if you have it; your credit report a few months later for anything suspicious; that all your mail is arriving intact; that all your household items are accounted for; and we often leave cars, garages, and other entrances wide open when moving so keep an eye there, if the location warrants.

Physical items can be used to create digital identities and while we may read about ID theft topics when computer breaches are reported, the physical realm is still ripe with fraudsters. Everything is game nowadays but you can take physical and digital action to stay safe when you are finally home sweet home.

ps

Resources:

• Prevent ID Theft while moving
• Identity Theft Risk Factor: Moving to a New Home
• Moving and Identity Theft - How to Protect Yourself
• Ten Tips to Avoid Identity Theft When You Move
• Minimizing the Risk of Identity Theft When You’re Moving

 

Technorati Tags: identity theft,id theft,moving,home,household,iot,mail,security,pii,silva,f5

 

Connect with Peter:	Connect with F5:

So Where Do We Go From Here?

If you are who you say you are.

I've been travelling the last few weeks shooting some videos for VMware PEX and RSA. When that happens, my browser tabs get crowded with the various stories I'm interested in but will read later. This time they all seemed to hover around Identity Theft. When I got home, in my awaiting physical mail was a letter from Target. I also returned something to a national hardware store and the cashier tried to crumple my credit-card-info-having receipt into a trash can. Kismet.

Let's take a look...

The FTC recently announced that Identity Theft is the #1 complaint in 2013, for the 14th consecutive year. Is that a record? While down slightly from 2012, it still accounted for 14% of the 2 million overall complaints. This is down from 18% in 2012. Florida, followed by Georgia and California were the worst hit states for ID theft. The IRS has also named Identity Theft as their #1 Dirty Dozen Tax scam for 2014.

Speaking of California, 7.5 million of the over 110 million breached Target accounts were Californians. California is one of the few states that require disclosure when more than 500 accounts are compromised. The first year California required reports, 2012, there were 131 breaches reported...in 2013 that rose to 170. The other interesting thing about California breaches is that many target smaller companies. In 2012, half of the reported breaches came from companies with fewer than 2500 employees and almost a third were businesses with less than 250 employees. Being small and relatively unknown is no shield.

Also in Southern California, the Feds busted a couple guys running a Tijuana-based identity theft ring. These dudes broke into a U.S. based mortgage broker's servers and siphoned off mortgage applications which included most of the borrower's personal info: name, birthday, SSN, DL number, tax info, the works. They then used that info to open credit lines and, with the info they had, were able to change access to the people's brokerage accounts. From there, transferring money to other accounts was a snap. From Dec 2012 thru June 2013 they stole personal data on 4200 individuals.

Javelin Strategy and Research released their annual 2014 Identity Fraud Study stating that in 2013, a new instance of identity fraud occurred every 2 seconds. 1 Mississippi, 2 Mississippi. Another. There was 13.1 million identity fraud victims on 2013. While the people number is going up, the actual money stolen, according to Javelin, in going down. They estimated that the total cost of identity fraud in 2013 to be around $18 billion, more than $3 billion less than 2012. 2004 holds the record at $48 billion. Attackers are now focusing on opening new accounts rather than piggy backing existing credit cards. Account take-over's, particularly for utilities and mobile phones are the new free-bees. Most of the stolen info appears to be from corporate breaches and about 1/3 of those who receive a breach letter actually becomes a theft victim. Your debit card also seems more valuable than your social security number. 46% of consumers with breached debit cards became victims verses only 16% of breached SSNs.

And in an interesting twist, the top complaint against debt collectors is mistaken identity. Trying to collect a debt from the wrong person was by far, the most common complaint to the Consumer Financial Protection Bureau (CFPB). I know this all too well since over the last 3+ years, we've been getting debt collection calls looking for a certain person. We tell them that we've had our phone number for years and stop calling. Few months go by, the debt gets sold to another collector and we get calls again. It got so bad that this person's own mother called to tell her son that the dad was in the hospital and probably wouldn't make it. About 2 weeks later we got a call from another family member looking to talk about the father's death. This guy was running from debt so much so, that his own mother couldn't get a hold of him when dad was on his death bed. Now that's bad.

So where do we go from here? Will we all need that personal chip installed on our left earlobe to verify identity? The payment terminal says, 'Please listen for verification.' Riff-raff will then be all like, 'Oh, listen to this cool song,' as they plug the bud into your ear only to suck the data off your PID chip. You didn't hear? That's our IPv6 Personal Identity Chip inserted into every newborn starting in 2025.

Oh, it will happen.

ps

Related:

• FTC: Identity theft is the plague of the country
• Calif. attorney general focuses on retailers' data theft
• Tijuana-Based ID Theft Conspiracy Busted
• Javelin Study: A New Identity Fraud Victim Every Two Seconds
• The 2013 FireEye Advanced Threat Report!
• Mistaken identity top complaint against debt collectors
• RSA 2014: Anti-Fraud Solution (feat DiMinico)

 

Technorati Tags: identity theft,id theft,security,privacy,banking,pii,breach,fraud,silva,f5

 

Connect with Peter:	Connect with F5:

Identity Theft Hits Close to Home

While certainly not the likes of having SWAT show up at my house like Krebs or even Honan's fiasco, we've had some ID theft attempts occurring for the past few months...actually my wife has.

It all started innocently enough at a child's birthday party. 

We were invited to a now ex-friend's house for a kid's birthday party this past April.  We were told it would be a small gathering of a few close friends.  Usually, when we attend things like this, my wife will leave her purse covered, locked in the car.  In this instance, thinking it was a small group, she took her purse in.  To our surprise, this was not some small get-together, as we were told, but a big party with numerous parents, kids and jump bouncers in back.  Many people we had never met.  That's cool, meet some new families with kids around the same age.  Almost immediately, the 'host' told my wife that she would put her purse in the home office where it would be 'safe.'  At the time, we didn't think anything of it since we had been to this house numerous times and had trusted the family.

The following week, my wife mentioned that she couldn't find a couple credit cards but thought she had misplaced them.  'They gotta be around somewhere.'  You know the phrase.  After another week of not being able to locate them, she called the card companies and requested replacements.  At that point, nothing, as far we knew was amiss. 

A couple weeks later, we get a letter from the credit card company (the one we replaced) saying they were not able to change the mailing address of our cards since certain security verification was not provided.  This was for the old, just replaced card.  Clearly not knowing that we had already cancelled and replaced the card, the thief attempted to change the mailing address for our account.  What?!?  But couldn't provide a photo ID with the new address or the secret squirrel settings so it was denied.  Nice.  We asked the card company for details and they could only provide the basics: it happened, verification failed, it stopped.  But don't you have caller ID?...Can't you go back and look?....What question failed?  Nothing.  See, while potential fraud was potentially attempted, it never actually occurred since it was not successful...thus no investigation.  I can understand.

We locked and froze and alerted the credit community.

Another couple weeks go by and due to the alerting in place, my wife gets a call asking if she's currently attempting making a purchase of some high end sunglasses online.  She wasn't.  Add to that, whoever apparently entered the wrong billing address.  Denied.  This was a different credit card than the address change attempt.  We got the CC transaction ID and hoped, maybe, that the online vendor could correlate.  What address did they enter?...Can you get any meta information from the transaction logs?...Can I talk to your IT department?  As you probably know, CC transaction numbers do not always match the merchant's transaction ID and neither was able to correlate the other's.  They did their best providing what they could but nothing to connect the two incidents...even though we had our suspicions.

Change of address request could come from anywhere and purchasing online...well it is the world wide web.  There was no way to tentatively finger someone but we did file a police report. 

And then last week, my wife gets a call from our local pharmacy informing her that the doctor had denied her cough medicine refill and that she needed to make an appointment with the doctor if she needed the medicine.  The only problem was that she hadn't requested a refill.  This was for some codeine laced cough syrup that was scripted over a year ago.  The caller had her name, doctor and birthday...plus knew exactly what medication to request and which store to request it from.  Big mistake.  The geographic region of the perpetrator just shrunk from world wide to our area.  There was/is only one person who would have all that info - the host of the birthday party.  It was her doctor (recommended to my wife) and she went with my wife when the cough medicine was prescribed.  I told the pharmacy to just fill something with grape juice and hold whoever tries to pick it up.  Yeah, ahh, they don't do that.  I guess a sting operation is outside the realms of a pharmacy but sounded good to me.  Now we've added an 'attempted' medical ID theft with a controlled substance sidebar.  Another police report filed.

While we do not have a video of the individual attempting the crimes, all indications point to one person.  Some of you might know that my wife is a retired Federal Investigator.  She spent some time hunting fugitives as a US Marshall and protected past #2s while in the Secret Service.  So she went down every other possible investigative path. The only one who had access to her purse, who also likes to purchase expensive sunglasses and would know specifically my wife's birthday, our pharmacy, and that particular medication along with who prescribed it?  It finally sunk in.

According to ITAC, more than 1.5 million consumers were victims of familiar fraud, which is fraud when victims know the fraudster.  Back in 2006, the FTC Identity Theft report noted that 2% of thieves were co-workers of the victim, 6% were relatives or family members and 8% were friends, neighbors or in-home employees.  For medical ID theft, Ponemon's 2013 Survey on Medical Identity Theft said a family member took the personal identification or medical credentials without consent 28% of the time.  Unfortunately, many of these crimes go unreported due to the perpetrators being friends and family.

Identity theft is on the rise and if I remember correctly, medical ID theft is the fastest growing segment.  I'm certainly not suggesting to keep your personal secrets locked from your trusted, long time best friend or a family member.  But for us, this experience will make us think twice about divulging certain information to fly by friends.

ps

• Reporter’s Identity Stolen
• The World Has No Room For Cowards
• Largely a family affair, medical identity theft on the rise
• I challenged hackers to investigate me and what they found out is chilling
• Identity Fraud by Friends or Family
• Identity Thief Is Often Found in Family Photo
• ITRC Fact Sheet 115 - When You Personally Know the Identity Thief
• Who Commits Identity Theft?
• Your Identity Thief Could Be Your Sibling or Child
• Parental Identity Theft Statistics

Technorati Tags: identity theft,medical,privacy,security,friends,family,credit card,silva

 

Connect with Peter:	Connect with F5:

The Hacker Will See You Now

More than 1.8 million medical ID theft victims in 2013

That's a 19% increase over last year according to the 2013 Survey on Medical Identity Theft.  More than 300,000 new medical identity theft cases were reported during the one-year period, the study found.  The 4th annual survey, conducted by the Ponemon Institute, defined medical identity theft as a person using an individual's name or personal identity “to fraudulently receive medical service, prescription drugs and goods, including attempts to commit fraudulent billing.”

One of the biggest contributors to the increase was fake or spoofed medical websites and spam emails.  Medical identity theft victims who reported that a cyber schemes caused their troubles doubled from 4% in 2012 to 8% in 2013.  It is clear that the amount and frequency of spear phishing specifically targeting medical ID theft has gone up.  This is not the simple 'Buy this personal enhancement drug here' emails but authentic looking emails from a provider.  You click the malicious link and either malware is installed to your computer or you are directed to a website that looks exactly like your medical provider's and you enter (give away) your credentials there.  You might even be able to log into something that will request you update your personal information.  Perfect, I get your credentials along with some additional Rx information or mailing address or SSN or date of birth anything that I can use to impersonate you.

As far as data breaches as a cause, only 7% (up 1 tick from last year) felt a data breach by their insurer, health care provider or related was linked to the fraud.

A separate but related survey, a new Deloitte report says healthcare organizations are in various stages of mitigating the security risks of medical devices.  These include patient monitors, infusion pumps, ventilators, pacemakers and imaging devices.  Deloitte interviewed the medical device security leaders at nine large hospital systems and they indicated that their organizations have a long way to go and that they need more cooperation from device manufacturers. 

The Food and Drug Administration (FDA) recently released a guidance on the "content of premarket submissions for management of cyber security in medical devices."  The guidance suggested that device makers incorporate security features into their products to limit access to only trusted users, trusted content, and use fail-safe and recovery devices. They want manufacturers to consider threats like hacking, malware and other vulnerabilities of the device's software and to work with providers on addressable scenarios.  This is certainly an area of importance for both providers and the device manufactures.  Remember all the wrangling with PCI and those payment devices?  Granted, the FDA guidance is a recommendation and not a regulation like PCI so there is reluctance to include security measures in purchasing contracts.

The other issue healthcare organizations face is trying to secure older proprietary devices.  These closed systems make it almost impossible to scan for vulnerabilities but they are still in widespread use.  For other devices that run on well know commercial operating systems, they are vulnerable to the same threats that any device with that software has.

Deloitte also asked the medical device security heads where their organizations stood in several areas of cyber security.  These included: organizational leadership, risk framework, identification and evaluation, data flow, vulnerability management, vendor agreements and manufacturer engagement.   Ken Terry over at Information Week goes into detail of each.

So far there have been no documented instances of "intentional threats" to medical devices, according to the report but healthcare providers are not required to report security incidents to the FDA or the device manufacturer unless a death or serious injury has occurred.

ps

 

Related:

• 2013 Survey on Medical Identity Theft
• Medical Device Security: A Work In Progress
• Malware Threatens Medical Device Security
• Networked Medical Device Cybersecurity and Patient Safety: Perspectives of Health Care Information Security Executives
• Lost Records a Day Shows Doctors are Blasé
• Web 2.0 and your Health
• Identity Theft Roundup
• Useful IT. Bringing Health Record Transfer into the 21st Century.

 

Technorati Tags: healthcare,medical,identity theft,vulnerabilities,devices,medical devices,risk,security,fda,silva,malware,phishing

 

Connect with Peter:	Connect with F5:

Lost Records a Day Shows Doctors are Blasé

#HealthCare #Privacy Challenges

I always wanted to write, 'In the USA Today, today' in the Life section snapshots sidebar there is an interesting stat from a December 2012 Ponemon Institute study of 80 health care organizations showing that the data lost or stolen most often are our medical records at 48% and billing/insurance records at 48% followed by payment details at 24%.  Multiple responses were allowed which is why the percentages break 100.  What is more alarming is that over the last two years, 94% of health care organizations have been breached at least once and 45% have had 5 or more incidents!  What is sad is that over half (54%) have little or no confidence that they can detect patient data loss.

I know many of us often delay or avoid the doctors for fear that we might get diagnosed with something terrible but maybe now we'll avoid with the notion, 'eh, I'm healthy and I don't want to be afflicted with identity theft disease.'  Ask your doctor about ITD - common side effects include increased heart rate, depression, headaches, loss of appetite and in some patients, bank account drainage.  Why risk it?  Heck, the last time my wife went to her now previous doctor and asker her about how she complies with HIPAA, the doctor didn't even know what that was!  How can that be?  How can a practicing physician be unaware of HIPAA?  That's like a bank unaware of PCI or the numerous other financial regulatory requirements.  But is it 'unaware' or 'just don't care.'

The primary causes of health care data breach include lost or stolen devices along with employee or 3rd party mistakes and they only learned of the breach because of an audit.  Data gets moved around amongst various parties for multiple reasons it is often hard to determine who and where leaked it.

Suggestions include appointing senior security roles reporting to the board, securing mobile devices, using encryption, develop breach plans that are ready and tested, education and as more health care organizations turn to the cloud, understand and control that risk - whatever it may be.

Oh, and have a seat, we'll be with you in a moment.

ps

Related:

• Healthcare data breaches a growing concern
• 94% of health care organizations had data breach in past two years
• Study on Patient Privacy & Data Security
• Encryption Shortfalls Plague Healthcare Industry
• High-tech B.C. care cards spark privacy concerns
• 11 Data Security Tips for Healthcare Organizations in 2013
• Medical Records Privacy (Privacy Rights Clearinghouse)

Connect with Peter:	Connect with F5: