December 4, 2007
Montreal Gazette
(CanWest News Service)
By Jeff Buckstein
Lynn Correia was online, conducting her regular monthly Visa statement review in the spring of 2006 when she suddenly noticed items from a grocery, liquor and retail store near Sutton, Ont. - transactions the Toronto-based chartered accountant knew she couldn't possibly have made.
Although the bogus purchases were for relatively small amounts, Correia didn't wait for her statement to be mailed out; she immediately called the bank that issued her Visa. They, in turn, instantly cancelled her old card and issued a new one, along with an amended statement.
"I feel fortunate," said Correia, who conducts forensic investigations and knows things could have been much worse. "I was only a victim of credit card theft (and) ... didn't suffer any monetary loss."
Still, she had to spend about five hours locating and informing potential payees - including companies entitled to pre-authorized payments from her old account - that the number had been changed.
Experts point out, however, that is a fraction of what others have needed to do in the wake of what is often called identify theft, but is more accurately the false assumption of a victim's identity by an impersonator.
"Where you know all that's happened is your credit card is missing, and there have been some errant charges on your credit card; you cancel it and move on. But rarely is that the scenario. What if someone pieced together your identity?" asks Brian Lapidus , chief operating officer in the fraud solution practice of Kroll Inc., a global firm that provides investigative, accounting and other services.
Lapidus says a person can assume another individual's online identity and become "someone who looks and acts like you" by stealing personal information, like a name, address, date of birth, social insurance number, financial account information and a health card number to mimic the victim online.
Another possibility is to "create a forged credit card containing the proper information - the bits and bytes of data that allow transactions to take place," then take that card to an ATM machine, insert it, and have the machine read all of the appropriate data on the magnetic stripe, he adds.
Once the criminal element has accumulated enough information to "build a profile" of a victim, they might do a number of damaging things to them, like contacting their financial institution to begin manipulating accounts, including moving money, says Insp. Barry Baxter of the RCMP's Commercial Crime Branch in Ottawa.
This is a serious problem in Canada, adds Baxter, who says the force's anti-fraud call centre in North Bay, Ont., received reports from 12,859 people reporting such a crime, with related losses at about $8.6 million, in 2005; that was followed by 12,236 people claiming losses of $15.7 million in 2006.
The federal government recently announced legislation would be forthcoming to combat the collection, possession, and illegal trafficking of personal information for criminal purposes, as well as to compensate victims for losses subsequently sustained.
Sorting out the mess caused by identity theft is no easy task.
"There's a ton of work that goes into fixing your identity once it's been compromised," said Lapidus from his office in Nashville, Tenn. "I think the estimate in the U.S. now is somewhere between 700 to 1,200 hours of recovery work - what the consumer would have to do to rectify their identity and get it back to its pre-ID theft status."
Bob Ferguson, a partner with Ernst & Young LLP's fraud investigation and dispute services in Toronto, points out the original credit card number may never be used. The criminal might immediately apply for a new card using the stolen number as a credit reference. Then they "can buy whatever they want and hit the credit limit pretty quickly on that other card."
It might be three or four months before the victim realizes what's happened, he said.
"Then a debt collector probably knocks on your door to say 'Why aren't you paying this Visa bill?' "
Worse, the perpetrator might do far more damage than merely overspend. Jennifer Fiddian-Green, a Toronto-based chartered accountant who, ironically, conducts fraud investigations for a living, received a call in April 2004 from a mortgage collector who "wanted to know why I wasn't paying my mortgage."
It turned out there were two properties in Brampton, Ont., mortgaged to the hilt, worth almost $500,000, falsely listed in Fiddian-Green's name. The perpetrators had managed to obtain her social insurance number and parlay that into a fake SIN card, a Canadian citizenship card and about three years' worth of fake tax assessment notices, which they used to successfully obtain a mortgage.
Experts generally recommend that an individual whose good credit rating has been sullied as a result of non-payment of bills or fraudulent transactions in their name should follow a few basic steps. One is to call police immediately in order to get a report issued and file started that can be presented to a financial institution or to an insurance company if the victim's policy covers identity theft. Next, they should call their financial institution and ask them to cancel all of their old credit cards and accounts and have new ones issued and opened.
"You want to make sure that you've put the flag on the credit file that your previous card was compromised, so the individual who's stolen your ID can't make the same call and say 'I need a new credit card issued. The one I'm holding isn't working,' " Ferguson said.
Experts and Speakers
Kroll Fraud Solutions employs globally recognized experts with extraordinary knowledge of the many physical, procedural and electronic security gaps through which confidential data is breached, as well as the criminal landscape where stolen identities are bought, sold and used fraudulently.
Your Identity Is Your Business. Protecting It Is Ours .
