Identity Theft

The ease of creating false documents and the huge amount of information about people that is freely available has fuelled a rise in identity theft crimes.  This is where someone has stolen the identity of another person (IRD number, bank account numbers, credit card information), usually in order to commit fraud.

This isn’t a new crime – back in the old days of credit card transactions, where merchants threw away the carbon copy of the transaction, it was easy to get someone’s details and start charging purchases.  The Internet has simply made that access easier – either by obtaining the details through a security breach at the company you are purchasing from or by hacking into your own computer for the information.  The Internet has also made it easier to construct a complete false identity, not just credit card information.

The best protection from identity theft is, again, common-sense.  By following some of the steps discussed in the fraud section – choosing reputable companies to deal with who have excellent procedures in place - you decrease your chances of having your information misused.  If you spend a lot of time on the Net, have a constant (not a dialup) connection, have a hotmail account, visit ICQ or IRC, these are all factors that might increase your vulnerability to hackers.  You can purchase security software which lets you know if someone is trying to get in your system and who they are.  If you go online simply to send emails once or twice a week – you may not need such software.  But if you do think someone is misusing your personal information, follow it up right away with your bank.  They can help you change passwords etc to keep your information and assets secure.

Personal Story

Our thanks to a friend of ISG who shared his experience of identity theft with us.

My identity was stolen and used for fraudulent purposes in 1999.  Somewhere on the Web, there is another person who has bought things on my credit card, who has an email address in my name, and has a street address exactly the same as mine - except his fictional Wellington address is in Alabama not New Zealand!

At that time I was working in development of e-commerce services and I was actively using as many of the new Internet services as I could to better my understanding of how businesses might develop new products and services to make the Internet a more useful and safer place to conduct commerce.

In 1999 eBay was making big headlines, so I won an auction and made payment to an individual in upstate New York using the services of an American site that promised to send a money order to any US address requested - with the amount of the money order, postage costs and a small fee being debited to a nominated credit card. 

The money order site had only just expanded its business to serve customers living outside of the USA, but their registration process had not been updated and still required a US state of residence be provided.  To over come this bug, the site advised to select any state at random to complete the registration form, they would ignore this information for overseas customers.  I selected AL (Alabama) to complete the form for no other reason than it was first on the list.

The eBay transaction went well, but over the following two months someone assumed my identity and made hundreds of dollars of Internet purchases - all paid for by my credit card! Most of the items were of the sort that can be supplied over the Internet, like registering software licences or buying access to secure sites.

From information gained from the Internet retailers that the fraudster had hit, it was easy to establish from where my personal data had been stolen.  My enrolment at the money order site was the one and only time my address has ever been detailed as being in Tawa, Wellington, New Zealand, Alabama - exactly the same variation as was given by the identity thief as he fraudulently purchased goods in my name. 

Not too surprisingly, the Money Order site disappeared and I was never able to discover exactly how their records were compromised.  Fortunately, banks will reverse any credit card transactions of this type and so the total cost of the experience was limited to inconvenience.

The lesson?  For all sensitive types of Internet transactions, especially those where significant personal information is being submitted, make sure that the service provider is a known and trusted brand - that way, in the very unlikely event that something goes wrong you can be confident they will still be online the next day to help fix the situation. 

At the time of my experience - in the middle of the period of 'dot.com' boom - most of the new and innovative Internet services were provided by 'start-up' businesses, many of which didn't stand the tests of time. Some, like eBay, go on to become Internet giants while others, like my money order provider, can disappear overnight without a trace.