Will You Spend to Thwart ID Theft? Internet Based or Not, Ill-Protected Records Are Yielding Criminals a License to Steal. Vendors and Bankers Want to Fight Back (2005)

When it comes to identity fraud and its narrower cousin, identity theft, the Federal Trade Commission is red alert and banks are rethinking the issue of combating thieves who lift legitimate account holder's credentials to line their own pockets. You could say the tipping point occurred with headlines from February's ChoicePoint data breach and the Alpharetta, Ga.-based firm's required disclosure under California law. Or, that the issue was greenlighted to greater importance soon after with an insider infiltration of a database at a newly acquired subsidiary of New York City headquartered LexisNexis, itself active in the ID theft prevention market. (Although no known cases of identity theft have, as of yet, resulted from these events, there is a high correlation between breaches and subsequent spikes in consumer accounts fraud.) Clearly, there has been a spike in consumer awareness and anxiety. It has helped to generate renewed industry interest in a chronic problem. In terms of what the hard evidence illustrates, reported complaints of ID theft have shot up to 9.3 million from 500,000 in 2001, according to the FTC and other sources. Before recent events and headlines, leading banks were already struggling to work more effectively with law enforcement and considering which channels to monitor (ABABJ, January 2001, p.27). Certain ATMs, as an example, can be altered to take in account and password information and new account fraud tends to occur in the branch. Moreover, the most progressive banks have taken steps to address problems particular to their organizations. But ID theft continues to confound more than a few financial services firms with its shifty form. Some variants include new account opening with a false identity and account takeover--or use of stolen information to say, pay the bills of the thief, who is perhaps more desperate than professional in that instance. To this day, the topic inspires mixed industry commentary, particularly on background, where an astute listener will notice that all the experts have a distinct opinion about (1) whether the problem really is significant enough to take drastic action against it; (2) what root causes of ID theft are the best ones to address; and 3. whether the problem will spike further or gradually level off and become a non-issue its own over time. short-run patterns are any indication, ID fraud will only continue--gushing before it settles into a trickle. Yet all sources seem to agree this point and off the record: as part of an operational risk management plan, banks need to have some strategy in place because of the potential impact of ID theft their brand and because it can erode consumer confidence in the banking industry. Synergistic effect Today some of the terms of debate have shifted, but talk, and, finally, action, has intensified in an effort to head criminals off at the pass. Consider phishing attacks, which have reared their collective ugly head over the last two years. These have also promoted interest in addressing ID theft and fraud, as the technique represents yet another way to harvest account information. In this variation, phishers trick unwitting internet users into giving up account information by presenting legitimate looking e-mails that link to phony web pages, which harvest data. Some technologists believe that--as phishing the information gathering that can lead to other types of fraud--capabilities such as scripts, Trojans, bots, and spyware will be increasingly used to set other aspects of fraud spinning out in a no-holds-barred auto-attack. It's conceivable that fraud will have a mechanized aspect in the future, says Eli Katz, practice director in the global financial services practices, Unisys, Blue Bell, Pa. If that happens, phishing will only be part of a broader, automated theft industry, he explains, adding, Certainly today, there is more to the story of ID theft than phishing. …