Welcome 
#IDTheftFTC

Introductory Remarks 

John Krebs

Division of Privacy and Identity Protection, Federal Trade 

Commission
#IDTheftFTC

General Information 

• Please be aware that, if you leave the Constitution Center building for 

any reason during the conference, you will have to go back through 

security screening again.

• Restrooms are located in the hallway just outside conference room.
#IDTheftFTC

General Information 

• Please be advised that this event is being webcast. By participating in 

this event, you are agreeing that your image, and anything you say or 

submit, may be posted indefinitely at ftc.gov or on one of the 

Commission’s publicly available social media sites. 

• If you notice any suspicious activity, please alert building security.
#IDTheftFTC

Emergency Procedures • If an emergency occurs that requires you to leave the Conference Center 

but remain in the building, follow the instructions provided over the 

building PA system.

• If an emergency occurs that requires the evacuation of the building, an 

alarm will sound. Everyone should leave the building in an orderly manner 

through the main 7th Street exit. After leaving the building, turn left and 

proceed down 7th Street and across E Street to the FTC Emergency 

Assembly Area. Remain in the Assembly Area until instructed to return to 

the building.
#IDTheftFTC

Submitting Questions and Comments 

• During the conference

– Please use the provided notecards and hand them to FTC staff

• Following the conference

– Go to the Public Comments section of the conference event page 

(https://www.ftc.gov/news-events/eventscalendar/2017/05/planning-future-conference-about-identitytheft) 
#IDTheftFTC

My Contact Information 

John Krebs 

Federal Trade Commission 

jkrebs@ftc.gov 
#IDTheftFTC

Opening Remarks 

Maureen K. Ohlhausen

Acting Chairman, Federal Trade Commission
Setting the Stage: 

Identity Theft Today 
#IDTheftFTC

Presenters 

Keith Anderson, Bureau of Economics, Federal Trade Commission

Sean McCleskey, Director of Organizational Education and 

Measurement, Center for Identity, The University of Texas at Austin

Alana Benson, Identity and Document Fraud Consultant 
#IDTheftFTC

Keith Anderson 

Bureau of Economics, Federal Trade Commission
#IDTheftFTC

Identity Theft:

What Do the Statistics Tell Us?

Keith B. Anderson

Bureau of Economics

Federal Trade Commission
#IDTheftFTC

Introductory Items

• The views expressed here are just mine and do not represent 

the views of the Federal Trade Commission or any of the 

Commissioners.

• The data I will present here are based on the results of the 

Bureau of Justice Statistics 2014 ID theft supplement to the 

National Crime Victimization Survey.
#IDTheftFTC

Identity Theft, 2014

Number of 

Victims

Percent of Adult 

Population

Total Victims 17,576,200 7.0%

Existing Accounts Misused 16,392,600 6.6%

New Accounts or Other Misuses 1,760,100 0.7%

New Accounts Opened 1,077,100 0.4%

Information Used in Other Ways 713,000 0.3%
#IDTheftFTC

Financial Costs of ID Theft

The Total – Social –Cost of an Incident of ID Theft

• No financial cost was reported in 35% of ID thefts.

• This suggests that 4.5% of consumers were victims of an ID theft 

involving a financial cost.

• Looking just at those instances in which there was a financial loss, 

the median cost per ID Theft was $300.

• However, the losses from ID Theft are heavily skewed, with a limited 

number of incidents involving a much greater financial loss.

• In 20% of incidents that involved a financial cost, the total social cost per 

incident was at least $1,000.

• 10% of incidents involved social costs of at least $2,000 – more than 6 

times the median value. 

• Almost 3⁄4 of the total cost reported was accounted for by those incidents 

that involved the top 10 percent of loss per victim.
#IDTheftFTC

Financial Costs of ID Theft

Cost of an Incident of ID Theft That Was Borne by the Victim

• Not all of the costs resulting from ID Theft are borne by the victim.

• Indeed, only 13.8% of victims reported that they had paid money 

out of their own pocket in resolving the issue.

• Of those who incurred an out-of-pocket loss, the median amount 

was only $100.

• Again, these figures are highly skewed.

• In the 20% of cases that involved the highest victim costs, the had 

out-of-pocket expenses of $600 of more.

• In the 10% of cases that involved the highest victim costs, the victim 

paid at least $1,500.
#IDTheftFTC

Financial Costs of ID Theft

(Median of Non-Zero Values)

Social Cost Cost to the Victim

All ID Theft $300 $100

Misuse of Existing Credit Card $300 $40

Misuse of a Checking or Savings Account $200 $90

Misuse of an Other Existing Account $200 $200

Opening New Accounts $680 $300

Other Misuses $1,000 $500
#IDTheftFTC

Types of New Accounts and Other Misuses

Type of New Accounts or Other Misuse Number of 

Victims

Percent of New 

Account and Other 

Misuse Victims

New Credit Card Accounts 531,800 30.2%

Fraudulent Tax Return Filed 261,300 14.8%

New Telephone Accounts 201,700 11.5%

New Loans or Mortgages 157,900 9.0%

False Information Provided to Police 120,500 6.8%

New Checking or Savings Account 104,000 5.9%

Used in Applying for a Job 77,300 4.4%

Used to Get Medical Treatment 74,900 4.3%

New Online Payment Accounts 66,7000 3.8%
#IDTheftFTC

Types of New Accounts and Other Misuses 

(Continued)

Type of New Accounts or Other Misuse Number of 

Victims

Percent of New 

Account and Other 

Misuse Victims

Used to Rent an Apartment or a House 57,700 3.3%

Used to Apply for Government Benefits 53,000 3.0%

New Auto Insurance Policies 13,200 0.7%

New Medical Insurance Policies 12,000 0.7%
#IDTheftFTC

Other Financial Problems Experienced 

by Victims of New Account and Other 

Misuses ID Theft

Type of Problem Experienced

Credit-related Problems 13.1%

Banking Problems 6.7%

Problems with Debt Collectors 14.0%

Legal Problems 3.3%

Problems with Utility Services 1.6%
#IDTheftFTC

Non-Financial Costs Borne by Victims

• Victims must spend time resolving problems resulting from having their ID stolen

• At the time they were interviewed, just over a quarter – 27% – of victims of new 

account or other misuse ID theft indicated that they were still dealing with 

problems

• Of those who had resolved all problems, 22 % said that they had spent a month or 

more resolving their problems.

• Many victims also incurred emotional distress as a result of their experience.

• 55% of victims of new account or other misuse ID theft said that they had 

experienced either moderate or severe emotional distress as a result

• This is comparable with the percentage of those who had experienced an assault 

who said that they had experienced such levels of distress – 51 percent for simple 

assault and 60 percent for aggravated assault.
#IDTheftFTC

Who is More Likely to Become a Victim

• The prevalence of New Account and Other Misuse ID theft is 

highest among those aged 25 to 64. Among those of this age, 

about 0.8% were victims. This compares to 0.5% among those 

who were 65 or over and those between 18 and 24.

• While 0.8% of whites reported being a victim of this type of ID 

theft, the rates were somewhat higher for blacks or African 

Americans – 1.0% – and Hispanics or Latinos – 0.8%.

• There are no significant differences based on sex or income 

level.
#IDTheftFTC

Sean McCleskey 

Director of Organizational Education and Measurement, 

Center for Identity, The University of Texas at Austin
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

IDENTITY THEFT TODAY
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Identity theft is the fraudulent acquisition 

and use of a person’s personally 

identifiable information (PII)

Medical Identity Theft

Financial Fraud (via 

Devices, Credit Cards, 

Checks, Bank access)

Synthetic Identity 

Theft (False ID)

Tax Identity Theft

Cyber Intrusions Ghosting

Immigration 

(Passport & Visa 

Fraud)
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Impact of Identity Theft is Big, Real 

and Diverse.

Impact 

of 

Identity 

Theft

Financial 

Loss

Health 

Risks

Reputati

on 

Damage

Personal 

Security 

Risks

National 

Security 

Risks

Increase 

in Other 

Crimes
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Proliferation of Identity Theft:

It is simple economics.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Profit potential is high and hidden

– Much higher than those for robbery, 

burglary, and street level drug dealing

–Businesses are willing to absorb 

“acceptable levels” of fraud loss

–Proceeds are easy to launder and 

conceal
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Consequences are low

–These crimes are typically ...

• detected well after they are committed

• often unreported 

• due to jurisdictional issues and scarce 

resources, often never investigated

– Declinations are frequent, sentences 

tend to be light
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Identity crimes fund criminal 

enterprises

• These crimes are increasingly becoming the 

purview of organized criminal enterprises, 

many of which are transnational

• Often perpetrated by individuals and groups 

engaging in other more serious offenses to 

include narcotics trafficking, extortion, and 

murder for hire
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Identity crimes facilitate other crimes • Narcotics/Drug Trafficking 

• Organized Crime

• Mail Fraud/Mail Theft (can be a precursor to ID crime)

• Mortgage Fraud

• Weapons trafficking

• Homicide

• Terrorism/National Security

• Wire Fraud

• Human trafficking

• Online Impersonation 

• Revenge porn

• Extortion/blackmail
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

HOW IS IDENTITY STOLEN?

Copyright © 2017 Proprietary, 

The University of Texas at Austin 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

UT CID Identity Threat 

Assessment and Prediction (ITAP)

ITAP is a national analytical knowledge repository of identity theft and 

fraud cases occurring in multiple market sectors, including but not 

limited to DHS 16 critical infrastructure sectors.

ITAP is a computational model of “how Identity Theft and Fraud is 

done” identifying risks, vulnerabilities, consequences, solutions, and 

gaps to understand current threats and to predict future risks. 

 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Where are the vulnerable points of 

entry?

Source: UT CID Identity Threat Assessment and Prediction (ITAP) project.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

How is PII frequently stolen ? 

UT CID ITAP cases show common strategies...

• Physical theft- stolen wallets, purses, mail

• Phone and mail scams

• Dumpster diving and shoulder surfing

• Credit card skimming

• Email phishing

• Social engineering

• Using unprotected Wi-Fi networks

• Computer (Network/Software) breaches
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Identity Theft “Steal Me” Flags
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

UT CID ITAP models WHO and WHEN 

Identity Theft and Fraud occurs.

Insider Theft

10.2% Hacking 29%

Data on the Move

7.9%

Accidental Exposure

11.5%

Employee Negligence 10.9% Third Party Vendors

15.1%

Physical Theft 12.5%
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

THE BIG PICTURE: We all are impacted ...

consumers, corporations, and governments 

around the world

• We must understand that recovery from the theft of an 

Identity asset is not just about replacing a new credit 

card or driver license. 

• It can the sometime represent and insurmountable task 

of having to repair a lifetime of achievements.

• We need to capture more of these stories!
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Do we really even understand what Identity is?

• Again we normally think of Identity Theft in terms of a 

financial crime, but are there other crimes?

• Is Identity replaceable?

• Is Identity an asset and what is it value?
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

UT CID Identity Ecosystem defines the 

“Physics of Identity”: 

its Contents (PII nodes), Connectedness, Identity Value, Liability, Rate of 

Change and so on. 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Is Identity Replaceable?

• The theft of identity often is tied to a document, 

credential, or token.

• What about the path that leads to acquiring that 

item?

• Can you replace your reputation, good decisions, 

or your general standing in the world?
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

“To Protect a Thing is to 

Know a Thing”

• What is an identity asset?

• What is the value of an Identity asset?

• Who is looking to steal these identity assets?

• How are these identity assets compromised?
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

UT CID Identity Ecosystem Investigates 

Vulnerable “Entry” Points Given Breached PII. 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

“I AM NOT SURE WHAT I HAVE?!”

• What type of Identity assets do you hold?

• Where are those Identity assets located?

• Who has access to those identity assets?

• Are those identity assets monitored 

(analogue vs. cyber?)
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

MISCONCEPTIONS:

Cyber Security is the Total Solution!

• The term cybersecurity is generically used to 

describe any issues related to the protection or 

unauthorized disclosure/theft of identity information. 

HOWEVER

• 50% of unauthorized disclosures/theft are not related 

to a machine or network

-- according to UT CID ITAP research.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

MISCONCEPTIONS:

Cyber Security is the Total Solution!

 There must be a TWO-FRONT fight! ...

People & Technology

 Not every identity thief is a hacker operating from a foreign country 

or government

 Network/Software security is incredibly important!

 But don’t forget People, Processes, and Policies.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

WHAT CAN WE DO?

Research

Training

Awareness

Special Programs
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

More unbiased academic research is 

required to uncover the Identity 

Fundamentals.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Educate an Identity Workforce with the 

knowledge and skills to protect 

Identity ASSETS.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Who is the “Identity” Workforce?

• Everyone who uses PII to make decisions.

• Everyone who collects PII.

• Everyone who sells or trades in PII.

• Everyone charged with protecting PII and 

privacy.

• EVERYONE WHO TOUCHES PII.

• Everyone who looks and prosecutes the identity 

thieves and fraudsters.
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Law Enforcement needs training to look 

for the right things in the right places

• What does a patrol officer typically look for?

• What should a patrol officer or investigator look for when hunting 

identity thieves and fraudsters?

• Computers

• Printers/ Scanners

• Thumb/ Jump drives

• Cell Phones

• Card readers/ Encoders

• Embossers

• Laminators
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

What to look for ....
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Is this evidence?
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

This is not an easy crime to investigate.

• Evidence of an identity crime may look 

innocuous and unimportant

• Unfamiliarity on the process to collect the 

evidence

• Limited knowledge of the laws available 

• Don’t throw in the trash!!!
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Combating Identity Theft

Creation of Financial Crimes/Identity Theft Task 

Forces: Comprised in most cases of Federal, State 

and Local agencies
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

South Texas Regional Task Force

• Task Force created by USSS San Antonio Field 

Office to combat identity theft and major financial 

crimes 

• Comprised of the following agencies:

• US Secret Service, San Antonio Police 

Department, Bexar County Sheriff’s Office, Texas 

Department of Public Safety, Homeland Security 

Investigations, US Postal Inspection Service and 

IRS-Criminal Investigative Division
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Reduction in Identity-related Crimes

• The Untied States Attorney’s Office 

temporarily suspended loss requirement for 

case acceptance

• Intelligence was gathered on suspects with 

high rate of recidivism 

• Education of prosecutors and the judiciary 

• Outreach to business/organizations
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Reduction in Identity-related Crimes

• Task Force being switched hours of operation 

and utilized drug warrants to initiate contact with 

suspects

• Worked closely with SAPD and Bexar County 

narcotics and gang units

• Cultivated contacts in the hotel/motel community

• FINALLY-use of the 1028A statute!!!
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Prosecuting the Identity Thief and 

Fraudster

Copyright © 2017 Proprietary, 

The University of Texas at Austin 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Identity Theft Penalty Enhancement Act

18 USC 1028A – Aggravated Identity Theft

. . .knowingly transfers, possesses or uses without lawful 

authority, a means of identification of another person shall, in 

addition to the punishment provided for such felony, . . . 

. . . During and in relation to ANY felony violation
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Identity Theft Penalty Enhancement Act

. . . Be sentenced to a term of imprisonment 

of 2 years. 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

. . . A court shall not place on probation

any person convicted of a violation of this 

section . . .

Identity Theft Penalty Enhancement Act
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

. . . No term of imprisonment imposed on a 

person under this section shall run 

concurrently with any other term of 

imprisonment . . .

Identity Theft Penalty Enhancement Act
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Case Study: 

Theft of data from a hotel

• Group of Aryan Brotherhood members and 

methamphetamine users stole credit card portfolios from 

storage facility in five-star hotel located in San Antonio, TX

• Hotel unaware of the theft

• 17,000 plus portfolios-contained CC #’s, CVC #”s, name, 

address of customers

• Information was utilized in conjunction with public sources 

to create counterfeit credit cards and fraudulent ID 

documents 

 
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Case Study: 

Theft of data from a hotel

• Hotel unable to notify victims and comply with TX 

Business & Commerce Code

• Stolen information utilized to fund organized criminal 

organization

• Complete failure of hotel’s policies and procedures on 

securing identity information

• 1 Defendant (12 total) after release from prison was 

recently arrested 8 years later with thousands of the 

stolen portfolios still secreted for potential use
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Public Data.com
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

ID360 Scorecards from the 

Center for Identity helps 

organizations benchmark 

and improve.

• Unbiased

• Confidential

• Transparent

• Top-tier University

• Expert researchers and 

practitioners
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

Success in the future will rely on 

Research and Education.

• Understanding your identity vulnerabilities and risks

• Understanding the Identity Ecosystem

– PII content, connectedness, value, liability, ...

• Defining and measuring against best practice benchmarks

• Building a knowledgeable and skilled workforce

• Equipping law enforcement and prosecutors with knowledge 

and resources

ID360

18 USC 1028A 

UT CID ITAP

UT CID Ecosystem
© 2017 Proprietary, The University of Texas at Austin, All Rights Reserved. 

R. Sean McCleskey, JD

Special Agent (Retired), U.S. Secret Service

Director of Organizational Education and Measurement

Center for Identity

The University of Texas at Austin

201 East 24th Street, POB 5.102

Austin, TX 78712

512.471.6152

210.875.4844

sean@identity.utexas.edu
#IDTheftFTC

Alana Benson

Identity and Document Fraud Consultant


Identity at the 

Core
1. “Identities” are how agencies and 

institutions know us.

2. Agencies and institutions know our 

identities through documents.

3. Documents breed other documents:

birth certificate > driver’s license > passport. 


Identity Verifying 

Documents
Identity Supporting

Documents
How to Steal Identities with Documents

❖1. Find an appropriate obituary from an 

open state.

❖2. Order the death certificate first. 

❖3. Use the death certificate to order the 

birth certificate.
Open vs. Closed

OPEN CLOSED

WA

OH

KY

VT

ALL OTHER STATES
Open vs. Closed

OPEN CLOSED

NY** MA WA

KY

 OH

VT*

IL

WY

?

?

?

*Vermont is pending vital record legislation to become a closed state

**New York is broken into New York state vital records and New York 

City’s five boroughs 
How to Steal Identities with Documents

❖1. Find an appropriate obituary from an 

open state.

❖2. Order the death certificate first. 

❖3. Use the death certificate to order the 

birth certificate.
Birth | Death

❖ Full name

❖ Birth date

❖ City and state of birth

❖ Parents full names 

(including mother’s 

maiden name)

❖Full name

❖Death date 

❖City and state of 

death




Identity Supporting

Documents

ddd

ddd
... is anyone actually doing this?

❖ The Paper Trip I-IV

❖ In a report to the 

VT legislature, 

cited examples 

from NJ, CA, OK, 

VT, CO, and many 

others.

❖ As with all fraud, 

we do not really 

know how much is 

happening.
... but isn’t someone checking?

❖ CSI Effect

❖ Even when verification occurs, the information agencies have 

access to is not complete.

Source: GAO-13-574T
Thank you SSA!

❖ Social Security numbers were invented to keep track of Social 

Security beneficiaries. That number was then used by other 

agencies, specifically the IRS, to keep track of tax payer 

information. 

??
Numident Full DMF Partial DMF

❖ SSA’s record 

of Social 

Security 

beneficiaries, 

their SSNs, 

and relevant 

death data.

❖ Social 

Security Act 

forbids 

sharing state 

reported data, 

so a new 

database is 

created 

excluding ~11 

million 

deaths.

❖ Death 

information 

extracted 

from the 

Numident

into a file for 

six federal 

benefit 

giving 

agencies.
Why does the Partial DMF matter?

❖ Aside from the six agencies that pay 

federal benefits, the Partial DMF is 

what agencies and institutions use to 

confirm your identity.

❖ If agencies do verify identities, and the 

database they are using to do so is 

missing roughly 11 million identities, 

those agencies cannot be sure they 

are issuing benefits to real identities.

❖ Document fraud affects every agency 

and institution.

Graphic source: “Sometimes, It Pays to Be Dead.” Washington Post,
Using Benefits to Track Data

❖ Born in NJ

❖ Died in NH

❖ NH Vital Statistics reports death to Social Security Administration

❖ SSA stops payments and records death on Numident

❖ Death extracted from Numident, recorded on the Full DMF

❖ Because it was reported by NH, a state, it is NOT included on the 

Partial DMF

❖ NJ Dept. of Pensions continues to send checks because they 

do not have access to her death data.
Vermont’s H.111:

“The House of Representatives took 

a step toward overhauling the vital 

records system Wednesday with a 

preliminary vote to approve H.111, a 

bill that would require people to show 

identification to prove they are a 

relative or authorized representative 

of the person named on the record 

before they can receive a certified 

copy.”
Under current law, we are not authorized to share state 

death information with the DNP portal. Section 205(r) of 

the Social Security Act (Act) limits the purposes for which 

we may disclose state death information. While the 

Federal Improper Payments Coordination Act of 2015 

(P.L. 114-109) requires us to share our death information 

with DNP, it did not amend section 205(r) of the Act to 

include authority for us to provide DNP State death 

information. Thus, we appreciate GAO's 

recommendation that "Congress should consider 

amending the Act to explicitly allow SSA to share its full 

death file with Treasury for use through the DNP working 

system." This recommendation also aligns with a 

proposal in the President's fiscal year (FY) 2017 Budget 

that would grant us the legal authority to share all our 

death information, including data from the states, with 

DNP. 
Works Cited

Bertoni, Daniel. “Social Security Death Data: Additional Action Needed to Address Data Errors and Federal Agency Access.” United States Government Accountability Office, n.d. 

http://www.gao.gov/assets/660/659289.pdf.

“Bill Would Tighten Vt. Birth Certificate Access.” Burlington Free Press. Accessed May 3, 2017. http://www.burlingtonfreepress.com/story/news/politics/2017/03/29/bill-would-tighten-vt-birth-certificateaccess/99741094/.

Bovbjerg, Barbara D. “Social Security: Observations on Improving Distribution of Death Information.” United States General Accounting Office, November 8, 2001. http://www.gao.gov/assets/110/109062.pdf.

CGP Grey. Social Security Cards Explained. Accessed April 24, 2017. https://www.youtube.com/watch?v=Erp8IAUouus&feature=push-u-sub&attr_tag=ImO3vYdLf2kfqfIv-6&ab_channel=CGPGrey.

Cristaudo, Frank. “Comments from the Social Security Administration,” As featured in GAO-17-15, "Do Not Pay Working System," P. 49 September 19, 2016. http://www.gao.gov/assets/690/680631.pdf.

Davis, Beryl H. “Improper Payments: Strategy and Additional Actions Needed to Ensure Agencies Use the Do Not Pay Working System as Intended.” United States Government Accountability Office, October 

2016.

Devereux, Dennis J., and Maida Townsend. An act relating to vital records, Pub. L. No. H. 111 (2017).

DMV.org. “Applying for a New License (Drivers 18+) in Wyoming.” Accessed May 2, 2017. http://www.dmv.org/wy-wyoming/apply-license.php.

GAO, Social Security Administration: Preliminary Observations on the Death Master File, GAO-13-574T (Washington, D.C.: May 8, 2013). P. 5.

New Hampshire Department of Safety, Division of Motor Vehicles. “REAL ID COMPLIANT IDENTIFICATION AND RESIDENCY REQUIREMENTS United States Citizens,” April 2017. 

https://www.nh.gov/safety/divisions/dmv/forms/documents/identification-residency-uscitizen-compliant.pdf.

“Sometimes, It Pays to Be Dead.” David A. Fahrenthold and Todd LindemanWashington Post. Accessed May 3, 2017. https://www.washingtonpost.com/apps/g/page/national/sometimes-it-pays-to-be-dead/556/.

Fahrenthold, David A., and Todd Lindeman. “Sometimes, It Pays to Be Dead.” Washington Post, November 3, 2013. https://www.washingtonpost.com/apps/g/page/national/sometimes-it-pays-to-be-dead/556/.

Spice, Christie. “Effective February 21, 2017, the Official Format of Washington State Birth, Death, Marriage and Divorce Certificates Will Change.,” January 17, 2017. 

http://www.doh.wa.gov/LicensesPermitsandCertificates/BirthDeathMarriageandDivorce/OrderCertificates.

Stone, Gale S. “Numident Death Information Not Included on the Death Master File.” Office of the Inspector General, September 21, 2016.

Alana Benson | alanabenson10@gmail.com
#IDTheftFTC

Tracking the Use of Leaked 

Consumer Data

Presenters

Dan Salsburg

Christina Yeung

Office of Technology Research and Investigation, 

Federal Trade Commission
#IDTheftFTC

OTech | FTC Office of Technology Research & Investigation

www.ftc.gov/OTech | research@ftc.gov
#IDTheftFTC

What Happens to Leaked Credentials?

Research question:

When consumer credentials are made public, 

does anyone use them?

Goal:

Design and conduct a study that tracks the attempted 

use of stolen consumer credentials
#IDTheftFTC

Study of Credential Use

1. Create ~100 consumer 

accounts

2. Post account data publicly

3. Track use of data
#IDTheftFTC

Fake Customer Data

1. Name

2. Address

3. Phone number

4. Email address

5. Password

6. Payment mechanism

• Credit card number

• Online payment 

account

• Bitcoin wallet
#IDTheftFTC

Posting of Fake Customer Data

MAY

 APRIL MAY

 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

Posting 1 on 

paste site

Posting 2 on 

paste site

End data 

Collection
#IDTheftFTC

Posting One vs. Posting Two

• Same data, posted twice

• Different format and time of day

Posting 1: ~100 views

Posting 2: ~550 views

(Picked up by Twitter bot)
#IDTheftFTC

Monitoring of Data Usage

• Monitored for about three weeks

– Week before Posting 1 (Pre-study control)

– Week after Posting 1 (Week 1)

– Week after Posting 2 (Week 2)

• Logged

– Email account access attempts

– Payment account access attempts

– Credit card attempted charges

– Texts and calls received by phone numbers
#IDTheftFTC

Time Before First Unauthorized Access Attempt

Posting 1 Posting 2

1.5 hours 9 minutes
#IDTheftFTC

Total Unauthorized Access Attempts

1

119

1108

0

200

400

600

800

1000

1200

Pre-Study Week 1 Week 2

Number of Attempts
#IDTheftFTC

Unauthorized Access Attempts by Account Type

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Email Services Credit Card Numbers Payment Accounts
#IDTheftFTC

Account Activity

Posting 1 Posting 2

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

4/24 4/25 4/26 4/27 4/28 4/29 4/30 5/1 5/2 5/3 5/4 5/5 5/6 5/7 5/8 5/9 5/10

Email Services

Credit Card Numbers

Payment Accounts
#IDTheftFTC

Email Account Access Attempts by Week

1

47

466

0

50

100

150

200

250

300

350

400

450

500

Pre-Study Week 1 Week 2

Number of Attempts
#IDTheftFTC

Email Access Attempts by Unique IP Addresses

0

5

10

15

20

25

30

1 2 3 4 5 6 7 8 9 10 11 12 13 14 ... 44

Number of Unique IPs

Number of Attempts

(Likely underestimates access attempts)
#IDTheftFTC

Geolocation of IPs Used in Access Attempts

0

5

10

15

20

25

30

35

40

45

50

# of Unique IP Addresses

IP Country of Origin

IP Addresses

Suspicious IP Addresses*

*IP addresses identified as suspicious by a freely available service
#IDTheftFTC

Credit Card Purchase Attempts

• Max: $2,697.75, at a clothing website

• Total amount within two weeks: $12,825.53

– Includes multiple payment attempts

– Includes preauthorization charges

• Noteworthy attempts:

– Online dating service

– Pizza place

– Hotels
#IDTheftFTC

Amount Attempted per Charge

137

119

43

32

52

19 20 17

1 1

0

20

40

60

80

100

120

140

160

Number of Charges

Identified preauthorizations

Charges
#IDTheftFTC

Charge by Category

164

79

59

39 36

23 12 9 8 7 3 1 1

0

20

40

60

80

100

120

140

160

180

Number of Charges
#IDTheftFTC

Additional Thoughts 

• If you post it, they will use it

• Paste sites should be monitored by email and 

payment service providers

• Two factor authentication provides some 

protection against stolen credentials

• Merchants should consider refusing seriatim 

purchase attempts
#IDTheftFTC

Future work

• Analysis of email spam, text spam, and 

phone calls received by fake consumer 

email accounts

• Posting of consumer data in other ways 

that might attract different types of thieves

Have relevant research?

www.ftc.gov/OTech | research@ftc.gov
#IDTheftFTC

Contributors

• Sheryl Roth

• Phoebe Rouge

• Joe Calandrino

• Aaron Alva

• Justin Brookman

• Phillip Miyo

• Nicole Davis

• Aaron Kaufman

• Amber Howe

• Biaunca Morris

• Jonathan Aid

• Anne Blackman
BREAK
The Identity Theft 

Marketplace
#IDTheftFTC

Moderator 

John Krebs, Division of Privacy and Identity Protection, 

Federal Trade Commission

Panelists

Danny Rogers, CEO, Terbium Labs

Robert Hoback, Assistant to the Special Agent in 

Charge, Criminal Investigative Division, United States 

Secret Service
#IDTheftFTC

Danny Rogers

CEO, Terbium Labs
#IDTheftFTC

Online Anonymity 101
#IDTheftFTC

The “Dark Web”
#IDTheftFTC

The “Dark Web”
#IDTheftFTC

Is the “Dark Web” all bad?

Tor Funding .onion Content
#IDTheftFTC

What are they doing with this data?

• “Classic” Identity 

Theft (mortgages, 

loans, etc.)

• Tax Fraud

• Three-way 

ecommerce and other 

retail scams
#IDTheftFTC

Impact: Domestic & 

International Gang 

Activity
#IDTheftFTC

Impact: Subsidizing 

Geopolitical Interference
#IDTheftFTC

Impact: 

Undermining Trust 

in the Internet
#IDTheftFTC

Robert Hoback

Assistant to the Special Agent in Charge, Criminal 

Investigative Division, United States Secret 

Service
#IDTheftFTC

ShadowCrew & Operation Firewall

• The concept of ShadowCrew (a “dark web” cybercrime chat forum) was 

developed in early 2002 during a series of chat sessions between cyber 

criminals. They came up with the idea of an eBay style business model 

and the subsequent vendor review system that introduced people in need 

of stolen data or counterfeit identification to verified sellers of such 

products.

• The ShadowCrew website also contained a number of sub-forums where 

the latest information about hacking tricks, social engineering, credit card 

fraud, virus development, scams, and phishing

• carderplanet.com owned by Dmitry Gubolov a.k.a. Script, a website 

primarily in the Russian language.
#IDTheftFTC

ShadowCrew & Operation Firewall

• Important to note that Shadowcrew was the forerunner of today's 

cybercrime forums and marketplaces. The structure, marketplace, 

review system, and other innovations that began with Shadowcrew

laid the basis of today's underground forums and marketplaces

• This was the beginning of the Secret Service beginning to focus on 

the dark web and underground marketplace for stolen financial 

information and PII/Identity Theft

• Shadowcrew website was taken down in 2004 by the Secret Service 

– Criminal communities regrouped on Eurasian sites using the 

Shadowcrew concept
#IDTheftFTC

Underground Forum Advertisement

• Advertisement on a dark 

web cyber crime forum 

for automated card 

vending shop 2pac.cc
#IDTheftFTC

2pac.cc Automated Card Vending Shop

• Automated websites for the sale 

of stolen credit cards

• Administered by cyber criminals

• Sell stolen cards obtained 

through skimming operations, 

online retail breaches and 

largescale point-of-sale 

breaches

• Customer support

• Refund Policy
#IDTheftFTC

Dark Web Recent Trends

• Cybercrime-as-a-Service 

(CaaS) or Malware-as-aService (MaaS) - i.e. 

Account Checkers

• Medical Records / Electronic 

Health Record Databases

• Institutions of Higher 

Learning / Educational 

Services
#IDTheftFTC

Recent Trends – Cybercrime-as-a-Service

• Sale of stolen credit cards

• Sale of compromised bank accounts

• Sale of malware

• Sale of “botnet” logs

• “Drop” services

• Exploit Kits

• DDOS services

• Bulletproof Hosting

• “Cashout” services

• Cybercrime tips

• Self-policing
#IDTheftFTC

Recent Trends – Cybercrime-as-a-Service

• It is lucrative, there is a market for it, and the risk is very low. The market 

is those criminals who are good at committing fraud but may not have had 

the ability in the past to create malware and write code.

• Exploit kits that steal credit card information, crack passwords or harvest 

credentials can be bought for the right price. Botnets can be rented if you 

are interested in constructing a DDoS attack, or you simply want to scam a 

business by threatening a DDoS attack unless they pay a ransom 

(scareware). 

• By lowering the barrier to entry, anyone with rudimentary knowledge can 

suddenly use “top notch” malware to steal, hold files for ransom, or cause 

general havoc. 

• THE DARK WEB MARKETPLACE = ONE STOP SHOPPING
#IDTheftFTC

Recent Trends – Medical Records/EHR 

Databases

• Health records have gone digital in the last seven years – If online theft continues to 

accelerate at the current pace, everyone in the U.S. will have had their health care 

data compromised

• Common theme - It is very lucrative. As a hospital administrator, how much do you 

think your patients medical records that contain PII (Personably Identifiable 

Information – Name, DOB, SS#) are worth on the criminal underground?

• Records contain not just your PII, but driver’s license #, credit card #’s and 

INSURANCE INFO (fraudulent billing and prescription fraud)

• Electronic Health Record Databases – Complete EHR databases can command 

$500,000 on the dark web. 

• *Monetizing raw data such as PII is not new on the dark web, but EHR contains 

data that can be used to create new markets for fraudulent tax returns, fake ID’s, 

birth certificates, stolen prescriptions = Synthetic Fraud*
#IDTheftFTC

Recent Trends – Educational Services

• Research studies across myriad disciplines conducted at universities put them in 

the sights of state-affiliated groups.

• However, according to Verizon, breach findings showed that over half involved the 

compromise and disclosure of stored personal information of both students and 

employees, while only a little over a quarter resulted in the disclosure of intellectual 

property.

• Criminal actors want your PII info to sell on the dark web and what better place to 

obtain it than your school personnel files?

• Phishing via email was the most prevalent variety of social attacks, while use of 

stolen credentials against web applications was the dominant hacking tactic.
#IDTheftFTC

Account Checkers

• Account checkers are basic brute 

force tools that test emails and 

passwords against a company 

website in order to validate accounts.

• Most likely over 20 sites/domains on 

the dark web that offer account 

checkers for approximately 85 wellknown businesses (retail, hospitality, 

home improvement – ecommerce and 

brick and mortar)
#IDTheftFTC

Popular Account Checking Toolkits 

(Private Keeper & Sentry MBA) 
#IDTheftFTC

Popular Account Checking Toolkits (con’t)

• Increase of account checkers over the past year on dark 

web forums – why?

• Recent massive database leaks (Yahoo/LinkedIn) leads 

to increase in “combo lists” (compromised user names 

and passwords) for sale on dark web. Attackers can 

attempt to reuse against other sites

• The data base info/”combo lists” are widely circulated 

among underground actors who use it in conjunction with 

account-checker tools
#IDTheftFTC

SLILPP.BIZ Homepage
#IDTheftFTC

SLILPP.BIZ Homepage
#IDTheftFTC

Only the Finest Customer Support
The Identity Theft 

Marketplace

Moderated Discussion
The Impact of Identity 

Theft: The Big Picture
#IDTheftFTC

Moderator

Mark Eichorn, Division of Privacy and Identity Protection, Federal Trade 

Commission

Panelists

Ann Patterson, Senior Vice President, Program Director, Medical Identity Fraud 

Alliance

Christopher Mascaro, Vice President, Threat Intelligence & Analytics, First Data 

Corporation

Michael Beebe, Director, Return Integrity & Compliance Services (RICS) and IRS 

Security Summit Executive Lead, Internal Revenue Service

Todd Egaas, IRS Executive Official, Identity Theft Tax Refund Fraud ISAC, Internal 

Revenue Service

Kenn Kern, Chief of Staff to the Investigative Division and Special Assistant for 

International Relations, New York County District Attorney’s Office
#IDTheftFTC

Kenn Kern

Chief of Staff to the Investigative Division and 

Special Assistant for International Relations, New 

York County District Attorney’s Office
#IDTheftFTC

• Investigation Division

– Cybercrime and Identity Theft 

Bureau

• High Technology Analysis Unit

• Cyber Intelligence Unit 

– Financial Fraud Bureau

– Major Economic Crimes Bureau

• Financial Intelligence Unit

• International Money 

Movement Center

– Rackets Bureau

– Tax Crimes Unit

– Asset Forfeiture Unit

– Public Corruption Unit

– Investigation Bureau

STRUCTURE OF THE OFFICE
#IDTheftFTC

• Cybercrime or identity theft related charges 

make up over 25% of all felony complaints

• District Attorney Vance created the 

Cybercrime and Identity Theft Bureau in 2010

– 15 full-time ADAs – 90 additional Trial Division ADAs – 15 analysts

• Provide training to other parts of the Office

• The Bureau also includes an in-house lab for 

computer, phone, and other digital forensic 

work

• Cyber Intelligence Unit conducts long-term, 

strategic investigations into high-value targets

THE CYBERCRIME AND 

IDENTITY THEFT BUREAU
#IDTheftFTC

How Thieves Commit Fraud

• Recent arrest on May 3, 2017

• 39 defendants

• Theft of over $1 million through counterfeit 

check cashing
#IDTheftFTC

How Thieves Commit Fraud
#IDTheftFTC

Complexity of Identity Theft Cases

• The Defendants gained control of legitimate 

StubHub accounts, fraudulently purchased etickets for popular events, resold the tickets, 

and then laundered the money 

internationally 

• Victimized more than 1,600 StubHub users 

and credit card accountholders

• Charged with Money Laundering, Grand 

Larceny, Criminal Possession of Stolen 

Property, and Identity Theft, among others
#IDTheftFTC

Collaboration and Partnership
#IDTheftFTC

Barriers to Investigation: Encryption
The Impact of Identity Theft: 

The Big Picture

Moderated Discussion
LUNCH
The Victim’s 

Perspective
#IDTheftFTC

Moderator

Lisa Schifferle, Division of Consumer and Business Education, 

Federal Trade Commission

Panelists

Amy Wang, Identity Theft Victim

Tamera Fine, Assistant United States Attorney, District of Maryland

Eva Velasquez, CEO, Identity Theft Resource Center

Ellen Abbott, Manager, Consumer Investigations, Identity Theft & 

Breach Notification, Kroll
#IDTheftFTC

Tamera Fine

Assistant United States Attorney, District of 

Maryland
#IDTheftFTC

Dangers to Victims – Financial Fraud

• Dangers flow from the way the identities are being 

used.

– Huge variance in how much harm is sustained by 

financial fraud victims.

– Generally these variances fall into established patterns, 

but...

 ....there are always outliers and we must 

always remain open to assisting victims who are the 

unlucky few percent of victims who sustain lasting harm.
#IDTheftFTC

Dangers to Victims – Financial Fraud

• Some types of financial fraud, such as account takeovers, auto 

and home purchases, are generally easily resolved, due to 

records maintained by the creditor.

• New Accounts require significantly more effort to resolve.

• Utilities and Services are notoriously difficult to convince that you 

have been a victim, as are rental management companies.

• There are groups, such as the Felony Lane Gang out of Florida, 

which specifically target bank accounts, which often result in 

victims losing access not to credit, but to their own funds.
#IDTheftFTC

Dangers to Victims – Financial Fraud

• Just as financial fraud targets banks and businesses, benefits 

fraud targets the deep pockets of Uncle Sam. Benefits fraud 

includes:

– Stolen Identity Refund Fraud (SIRF)

– Unemployment, Social Security Retirement and Disability.

• This fraud diverts funds from the victims to the perpetrator. 

• Whether it is a tax refund you are expecting and don’t get, or a 

social security check that gets diverted into another account, 

these disruptions can cause significant hardship, even if the funds 

are eventually restored.

• In addition, benefits can be cancelled due to an identity thief 

earning income using the victim’s identity.
#IDTheftFTC

Dangers to Victims – Employment

• Anywhere there is a large illegal immigrant 

population, there is use of other’s identities for 

employment purposes. This use can create big 

issues for victims:

– Tax Issues

– Benefits issues

– MVA/DMV suspensions and revocations

– Criminal Warrants
#IDTheftFTC

Dangers to Victims – “Collateral” Impacts

• Even financial fraud and use of a stolen identity 

for employment can have massive collateral 

consequences for victims:

– Inability to get a job.

– Inability to pass a background check.

– Loss of security clearance.
#IDTheftFTC

Dangers to Victims – Medical Identity Theft

• One of the most devastating forms of identity theft 

is medical identity theft

– Medical treatment is obtained using stolen health 

insurance information, or sometimes “on credit.”

– The residual unpaid bills are the least of the problem.

– The victim’s medical record becomes “polluted” with 

information about the health conditions, medications, and 

treatments of the identity thief.

– In emergency situations, this has potential catastrophic 

consequences.
#IDTheftFTC

Dangers to Victims – Medical Identity Theft

• Identity Theft of Medical Credentials

– We have had examples of people who pose a medical 

professionals, including treating patients and prescribing 

medications.

– Here, again, access to what seems like insignificant personal 

details can greatly assist in the identity theft: where the victim 

went to school, what states they are licensed in, where they 

have practiced in the past.

• In addition to the danger this form of identity theft poses 

to the reputation and license of the medical 

professional, think of the potential of harm to the public.
#IDTheftFTC

Dangers to Victims – Criminal Activity

• Many career criminals use stolen identities 

because they have warrants outstanding.

• If caught, they give the fraudulent identification 

information.

• Stolen identities are often used to commit new 

crimes, such as check fraud schemes.

• When the scheme unravels, law enforcement 

comes after the name on the fraudulent account –

the victim.
#IDTheftFTC

Dangers to Victims – Criminal Activity

• The problem of erroneous arrest of identity theft 

victims has become so significant that states are 

taking steps to “authenticate” identity theft victims to 

law enforcement.

• Use of stolen identities to avoid SORNA reporting 

requirements is common. 

• Identity theft victims have been placed on terrorist 

watch lists and even forcibly removed from 

airplanes.
#IDTheftFTC

Contact Information

• Contact Information:

– Assistant U.S. Attorney (AUSA) 

Tamera Fine

– 410-209-4806 (work)

– 410-961-4502 (cell)

– tamera.fine@usdoj.gov
#IDTheftFTC

Eva Velasquez

CEO, Identity Theft Resource Center
#IDTheftFTC

888.400.5530 | www.idtheftcenter.org |itrc@idtheftcenter.org
#IDTheftFTC

The Aftermath: In their own words

• “One of the worst ways identity theft has affected me is the ongoing 

feeling of persecution. Not being able to trust ANYONE and being 

borderline paranoid when anyone asks for ANY personal information for 

any reason even when it is business related.”

• “I am always in fear about what will happen next, and who my 

information will get sold to.”

• “The identity theft was a bewildering, stressful experience. Since I don’t 

know who perpetrated the theft, I worry that he/she could use my 

information to victimize me again.” 
#IDTheftFTC

Emotional Reactions

Frustration/Annoyance (81%)

Fear for financial security (69%)

Rage or Anger (58%)

Powerlessness/helplessness (54%)

Loss of ability to trust (51%)

Isolation (31%)

Shame or embarrassment (28%)

Suicidal (8%)
#IDTheftFTC

Behavioral and Physical Reactions

Sleep disturbances (42%)

Inability to concentrate (39%)

New physical illness (29%)

Loss of appetite (21%)

Start or relapse of unhealthy or 

addictive behaviors (15%)

Unable to work (10%)
#IDTheftFTC

Lost Opportunity Costs

Spent time away 

from other life 

experiences (39.9%)

Took time off work 

(28.8%)

Spent time away 

from family (26.3%)

Spent time away 

from family (26.3 %)

Delayed educational 

opportunities (16.7%)
#IDTheftFTC

From a household to our nation: 

• The ripple effect that directly impacts you

Borrowed money 

from family/friends 

(35%)

Used online accounts 

less frequently or not 

at all (33%)

Closed existing 

online accounts 

(23%)

Applied for 

government benefits 

(17%)
#IDTheftFTC

The Aftermath: In their own words

• “The thief was my landlord; hence I had to go to the Sheriff’s office to 

get assistance in gaining access to what was left of my personal 

property. I spent hundreds of dollars in legal paperwork, a mover, hotel 

rooms I had to live in until procuring another place to rent.” 

• “I have been forced to do my income tax separate from my spouse at a 

higher bracket.”

• “Used my name for medical treatment. I was assessed with unpaid 

taxes, medical bills, and my medical record corrupted. I have yet to be 

able to get her information off my medical records.” 
The Victim’s Perspective

Moderated Discussion
Resources for 

Recovery
#IDTheftFTC

Moderator

Ryan Mehm, Division of Privacy and Identity Protection, Federal 

Trade Commission

Panelists

Nat Wood, Associate Director, Division of Consumer and Business 

Education, Federal Trade Commission

Laura Ivkovich, Policy Analyst, Office for Victims of Crime, U.S. 

Department of Justice

Eugenia Buggs, Vice President, Global Marketing, Identity and 

Digital Protection Services, Generali Global Assistance
#IDTheftFTC

Nat Wood

Associate Director, Division of Consumer and 

Business Education, Federal Trade Commission
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC
#IDTheftFTC

Laura Ivkovich

Policy Analyst, Office for Victims of Crime, U.S. 

Department of Justice
#IDTheftFTC

Presentation Overview 

• What is OVC?

• How can OVC Help? 

• Victims of Crime Act Funding (VOCA)

• Victim Services Available (In person and On line)

• National ID Theft Victim Assistance Network 

(NITVAN)

• Benefits of Collaboration/Force Multipliers
#IDTheftFTC

Office for Victims of Crime (OVC)

• In 1982, President Reagan established the President's Task Force on 

Victims of Crime, 

• Task Force charged with assessing the treatment of crime victims 

throughout the Nation, 

– "The innocent victims of crime have been overlooked, their pleas for justice have 

gone unheeded, and their wounds—personal, emotional, and financial—have 

gone unattended." 

• Task Force recommendations resulted in: 

– Victims of Crime Act (VOCA) enacted in 1984

– VOCA establishes the Crime Victims Fund 1985

– 1988 amendment to VOCA formally establishes the Office for Victims of 

Crime
#IDTheftFTC

VOCA

• Victims of Crime Act of 1984: 

– VOCA authorizes OVC to use monies from the Crime Victims 

Fund to support a number of programs that assist crime victims, 

including:

• State Victim Assistance programs (formula)

• State Compensation programs (formula)

• Discretionary programs
#IDTheftFTC

VOCA Authorized Activities

Crime Victim 

Compensation 

(formula)

• To states to fund direct 

payments for crime victims

• Reimbursement for 

crime-related expenses 

(e.g., medical, mental 

health counseling, funeral 

and burial, lost wages, and 

loss of support)

Victim 

Assistance 

Services 

(formula)

• To states for 

community-based victim 

service programs

• Supports the delivery of 

direct services (e.g., 

counseling, legal 

advocacy, etc.)

Discretionary 

Activities

• National scope training 

and technical assistance

• Demonstration programs

• Victims’ legal assistance

• Program evaluation

• Fellowships

• Services to victims of 

federal crimes (e.g. Tribal 

Victim Assistance)
#IDTheftFTC

VOCA Funding Appropriations Cap Raised

States See Quadruple Rise in Victim Assistance Grant Funding

• VOCA Cap: 

– FY 14 - cap was $745 Million

– FY 15 - cap went up to $2.361 Billion

– FY 16 - cap went up to $3.042 Billion * 

• OVC Awarded: 

– FY 14 - $456 million in state victim assistance grants

– FY 15 - $1.9 billion in state victim assistance grants 

– FY 16 - $2.2 billion in state victim assistance grants 

– * VOCA statute expand s use of federal funds to include “victim services,” in addition to the current authority 

for demonstration projects, program evaluation, compliance efforts, and training and technical assistance 

services.
#IDTheftFTC

OVC Online Directory of Victim Services
#IDTheftFTC

National ID Theft Victim Assistance Network 

(NITVAN) 

• State Victim Resources (numbers, links)

• Laws including Civil Suits, Access Devices, Cyber Crimes, 

Security Breaches

• Security Freeze Law & State-Specific ‘How To’s’

• ID Theft Passport Law

• Inclusion in state’s restitution definitions

• ovcttac.gov/identitytheftnetwork

• Twitter.com/IDTheftNetwork

• Facebook.com/IdentityTheftNetwork
#IDTheftFTC

NITVAN Resources You Can Use Now

• Printable Outreach Material

– Brochures

– Website Material

– PSA Scripts & Audio & Visual Samples

• Quick Tip Sheets

• Ready-To-Use Forms

• Sample MOU’s 

• Training Slides, Instructor Manuals, Worksheets
#IDTheftFTC

• NITVAN II – New OVC Funding... – Adding 20 additional coalitions to the network (3-yr project) – competitive 

$50,000 sub-awards

– Training and TA as well as policy assistance 

– Guidance to the new and existing programs and coalitions... with an emphasis 

on cybercrime identity theft victims

– Force multiplier – help expand the outreach and capacity of victim service 

programs to better address the rights and needs of victims of identity theft 

through the establishment of collaborative regional, statewide, or communitybased coalitions dedicated to improving the response to victims of id theft
#IDTheftFTC

OVC - Online Interactive Training for 

Advocates

www.ovcttac.gov/IdentityTheft
#IDTheftFTC

ID Theft Help Mobile App

Features: . 

• Identity Theft Q&A Solution 

Tree

• LiveChat

• Direct Dialing 

• Educational Information

• Resources

The ITRC ID Theft Help Mobile App is available on both the Apple 

and Android Platforms and is completely free of charge.

www.itrc.org
#IDTheftFTC

Eugenia Buggs

Vice President, Global Marketing, Identity and 

Digital Protection Services, Generali Global 

Assistance
#IDTheftFTC

Risk is a Reality

• No company or service can guarantee that 

your identity will never be stolen,

 BUT...
#IDTheftFTC

Risk is a Reality

• No company or service can guarantee that 

your identity will never be stolen,

 BUT...
#IDTheftFTC

A Lot At Stake

There Is 

Financial Loss

Reduced 

Credit Score

Emotional 

Distress

Sense of 

Frustration

Invasion of 

Privacy

Loss of Peace 

of Mind Time off or 

away from 

work

Inability to make 

major purchases

Having to forego 

or delay payment 

of other things

Anxiety

Hassel of having 

to change 

banking/credit 

accounts

Legal Issues

Damaged 

Reputation

Loss of 

Federal or 

State Benefits

Inaccurate 

Medical 

Treatment

Loss of Trust

Damaged 

personal 

relationships

Denial of 

Employment
#IDTheftFTC

Identity Protection Services Typically Include:

• Prevention/Education

• Monitoring & Alerts

– Credit

– Identity

• Resolution

• Insurance
#IDTheftFTC

What Should Consumers Research?

• Prevention/Education

• Monitoring

– Credit

– Identity

• Alerts

• Resolution

• Insurance

• Prevention/Education

• Resolution

• Insurance

– Trends

– Tips

– Tools

– Support

– Full Service

– 24/7 Availability

Key 

Considerations

– Is it Insurance

– What’s Covered

ALL SERVICES ARE NOT CREATED EQUAL
#IDTheftFTC

Where Should Consumers Start? 
Resources for Recovery 

Moderated Discussion
#IDTheftFTC

Closing Remarks 

Thomas B. Pahl

Acting Director, Bureau of Consumer Protection, Federal 

Trade Commission
THANK YOU!