McAfee reports on worldwide identity theft trends

Although, identity theft has become a global issue, there are very few studies that put the trends together from a global perspective.

Since identity theft can travel thousands of miles with the click of a mouse (or with the use of automated software), we could learn a lot by studying the problem as a whole.

McAfee has just released a white paper, which does this.

From the McAfee site:

According to the report, the number of keyloggers - malicious software code that tracks typing activity to capture passwords and other private information - has increased by 250 percent between January 2004 and May 2006. Additional findings show that the number of phishing alerts tracked by the Anti-Phishing Working Group has multiplied 100-fold over the same period of time. The report also provides practical guidelines that minimize the risk of identity theft to help readers protect themselves and prevent this increasingly common crime.

The study shows that identity theft exacts a high toll on national economies around the world. According to the Federal Trade Commission, the annual cost for consumers and businesses in the United States alone reaches $50 billion annually(1). In the United Kingdom, the Home Office has calculated the cost of identity theft to the British economy at $3.2 billion during the last three years(2) and some estimates from the Australian Centre for Policing Research place the cost of identity theft at $3 billion each year(3).

The conclusion of their report is:

We must first admit that every one of us—individuals and businesses—are threatened and potentially vulnerable to identity theft; this is not something that happens only to others. Despite the seriousness of current incidents and the
increasing threat, some basic principles allow us to significantly reduce the risk. Awareness is the best defense. Through awareness, we develop our senses to spot identity theft and to protect personal and corporate information, while maintaining the benefits of information technology.

Not only covered in the report are technological means in which identities are stolen and used, but it also covers known cases, such as "dumpster diving, mail theft and employee theft."

It also shows how victims are denied credit, identification and even labeled as "terrorists" because their identity had been assumed, and used for "illicit" purposes.

The paper is substantiated by referencing a lot of (worldwide) government and private studies.

The paper also has a lot of relevant tips for both individuals and organizations on how to avoid becoming a victim.

All in all - a very "interesting" read.

McAfee White Paper, here.

Does eBay now see fraud protection as an important part of their continued profitability?

There has been a lot written about fraud on auction sites, particularly eBay. Perhaps, with all the competition going after their "extremely profitable business model," they are reconsidering the importance of preventing fraud on their site?

Mark Raby of the TG Daily writes:

During a webcasted conference with some of the online auction site's top sellers, eBay's North America president Bill Cobb expressed concern over the rise of people who don't ship out items or list counterfeit merchandise as real, along with people who have found more clever ways of manipulating the system.

Cobb said that one key target that could more easily be monitored is the selling of fraudulent and pirated merchandise, which is not always easily caught or reported by the buyers, or the wording in the auction is deceptive so that the victim has no means of restitution.

Top-end products, like cars and jewelry, will also be on Ebay's watch list as it puts new measures into place to ensure that both the buyers and sellers are legitimate. With around two billion new items put up for sale every year, it has historically been difficult and financially unmanageable to have a comprehensive anti-fraud program for the site.

TG Daily story, here.

Although - as always - "money talks," it's great to see some forward motion on this issue, which has left too many people "holding the bag."

Here is a previous post, I wrote about competition forcing more "fraud protection" in the auction world:

Will competition make it harder to write off fraud costs on auction sites?

Has a lot of money been lost because of fraud, waste and abuse in Iraq?

There is no doubt that the war in Iraq has cost the taxpayer's a lot of money. Many brave young and women have even paid a greater price.

Jim Fry (Voice of America) is reporting:

"Government auditors told Congress Thursday that waste and fraud in the reconstruction of Iraq have been rampant. They predict they will uncover losses in the billions of dollars. Key Democrats on the House Armed Services Committee demanded an accounting within two months."

Voice of America story, here.

There are going to be some, who claim that this is political posturing for for the "upcoming" presidential elections, but there is no doubt - we need to take a hard look at what's been going on.

If fraud has been a problem in Iraq - and hard evidence is brought forward - the guilty should punished, severely. After all, many of our nation's finest (the brave men and women I referred to above) have paid with their "blood" for justice in Iraq.

They deserve some (justice), also!

Should this turn out to be "political posturing," the voters (who by now should be getting tired of special interest/pork barrel politics) should make their voices be heard on election day.

I will be one of the people, who vote every election, watching the results of this, carefully!

TJX named as point-of-compromise in International data breach - millions of people at risk!

Data breaches are happening at an alarming rate. Until some meaningful action is taken to address them, such as following already established principles (data and PCI security compliance), we're probably going to see them continue.

Reuters is reporting (courtesy of the Washington Post):

TJX said the breach involves the computer network that handles credit card, debit card, check and return transactions at its T.J. Maxx, Marshalls, HomeGoods and A.J. Wright stores in the United States and Puerto Rico; and its Winners and HomeSense stores in Canada.

It said the intrusion could also affect customers at stores in the United Kingdom and Ireland, and its Bob's Stores in the United States.

Reuters story, here.

This time not only credit and debit-card information was compromised, but check and all the personal information gathered when someone makes a refund might have been exposed, also.

The breach - reported to have been discovered in December - was kept quiet at the request of law enforcement.

The company has set up hot-lines, which are 866-484-6978 in the United States, 866-903-1408 in Canada and 0800-77-90-15 in the U.K. and Ireland. I called one of them and they didn't seem to be able to answer much, but told me if I wanted more information to go their website, here.

The problem in these large data breaches at merchants (TJX isn't the only one) is that too much personal and financial information is being maintained in databases, which aren't protected properly.

The Privacy Right's Clearinghouse maintains ample evidence of this, here.

The Payment Card Industry has already established data security standards, which aren't being followed in a lot of cases. Visa did a press release announcing that they are offering financial aid to Level 1 and Level 2 merchants. There is also mention that fines will be increased for merchants who fail to comply.

Unfortunately, even Visa states that compliance for Level 1 merchants is at 36 percent and 15 percent for Level 2 merchants.

Although, I commend the action by Visa, I fear fining non-compliant entities might not be enough.

Tech Web's "Dark Reading," has an excellent essay on the need to become more proactive, here.

In their essay, they state:

One recommendation is that Congress pass a law that compels organizations to protect sensitive information rather than one that simply determines when and how customers will be notified after the fact. There's been a consensus in Congress that standards are needed to safeguard personal information, but there's been a lack of unanimity in the details of how this should be done, says, Liz Gasster, acting executive director and general counsel for the Cyber Security Industry Alliance. "It was a real letdown for the citizens of this country that legislators weren't able to overcome their differences last year and pass a law," she says, adding that one big sticking point was Congress not wanting IT security improvements to create additional costs for industries operating in their constituencies.

Maybe with a new Congress, we'll see some "forward thinking" on this issue? After all, it's their responsibility to represent the people, who are having their personal and financial information compromised.

It would also be nice to see more funding to go after the criminals behind this growing problem. After all - the companies being breached aren't the source of this issue.

And besides enacting legislating and prosecuting the criminals doing this, we have the matter of "trust" and "consumer confidence" to consider. These are two "key" business principles that fuel economies. Failure to do something now; might lead to some unfortunate consequences, later.

If you would like to learn more about payment card compliance and data security, here's a site I recommend:

PCI and Data Security Compliance

Here's a previous post, I wrote on this subject:

With all the data breaches - something needs to be done!