Identity-theft specialist Robert Siciliano explains how criminals use stolen Social Security Numbers to open credit cards and loans in victims' names, costing the U.S. $48 billion in 2009. Banks often refuse to reimburse victims, leaving them responsible for the fraud. He notes that Canada's adoption of chip-and-pin technology has reduced skimming fraud compared to the slower U.S. rollout.
Chapters
Tonight, 8 Eastern, 5 Pacific, on CNN.
We've been talking about the dangers and costs of cyber crimes. Uh, governments, corporations, of course, are in the target here. We've been running a special series on cyber weapons, but today we're going to bring these threats closer to home. We're going to take a look at identity theft. It's a pretty worrying picture. Look at that— Canadians lost $10 million last year, 1 in 6 Canadians a victim. 10 million Americans falling victim in 2009. And look at that, $48 billion in ID theft in the States in 2009. For more on identity theft, we're joined by Robert Siciliano. He's a McAfee consultant an identity theft expert in Boston. Hi there, Robert. Hello. You think this is a huge problem for the public. Give us an idea of the scale.
Well, like you said, you know, it's approaching a $50 billion issue here in the States. It's really, you know, worldwide at this point over the past 5 years, some estimates make it at about $1 trillion in losses to businesses and consumers and government agencies. It's a huge problem, unfortunately one that's going to get worse before it gets any better.
Now you've got some terms for us, SSN and SIN. Just remind us what they are and why they're contributing to the problem.
So certainly the Social Security Number, SSN, and Social Insurance Number, SIN, are our primary identifiers, at least here in the northern part of North America.. And because we have these 9 digits as our primary identifier, government-issued, and they are used by credit bureaus, by banks, creditors, you know, credit card companies, even video places, mobile phone companies, utilities, just about any lender of any kind, any creditor uses the Social Insurance Number or the Social Security Number. And because that's our primary identifier and it's available in so many places, it makes for new account fraud such a problem. The bad guy just gets your SIN or SSN and they go ahead and open up these new accounts under your name.
Robert, I must admit, I don't want to sound like a luddite, but I've never really taken this very seriously in a personal context. I mean, if you have your bank card spiffed at the RABBA, you know, the bank gives you your money back if you take $1,000 out of your account. You know, why, you know, what risk do people take personally, either financially, reputation I get, but what's the personal financial risk that consumers and business people take in this area? Because I don't quite get it, to be honest. Sure.
Okay, so you spoke of a new account fraud. If money's taken out of your bank account, then the bank will go ahead and replenish that money. Generally, that's termed as a zero liability policy. However, not all banks will refund your money in the event that you are hacked or that money's taken out of your account. For example, I'm contacted all the time by people who are a victim of ATM skimming. And ATM skimming, of course, is when bad guys put devices in the face of the ATM, they punch in your PIN code, or they skim the information off the back of your magnetic card, they get the information off your PIN code via a wireless camera, and then they create a clone card hours later and they take all the money out of your account by punching in your PIN and using that clone card. Often, victims of that crime will not get their money back because the bank doesn't want to believe them. They don't want to believe that they, in fact, were skimmed in that way. And so the bank doesn't always reset the clock. If the victim's credit card, say, is compromised and they don't refute those charges within a specified period of time, generally it's 60 days, the bank will put the money back in their account if they don't refute those charges. Again, not all account takeover does the money actually go back in the account for a number of different reasons. So that in and of itself is costing consumers billions of dollars every year. I have heard of it.
Yeah, I was going to say, I have heard of one story where, again, recently, a fellow found out someone bought a car with his credit card that had a PIN, one of those chip PIN ID things, and the bank didn't believe that he actually hadn't inserted his own PIN with the chip card, and there was a big tussle about that. And, you know, now that we're all being pushed these PIN IDs, and yet it's so easy, of course, to frankly, as you said yourself, ripped that off somehow. I mean, is the industry pushing the liability onto the consumer for the first time really since credit cards have been issued for, what, 2 generations now?
Well, you have EMV, which is Euro MasterCard Visa, rolling out in Canada, whereas we don't have that in the States, which is one of the reasons why ATM skimming and point-of-sale skimming is such a huge problem here. And the banks generally, banks, creditors in general, do not want to believe that you were scammed. That by default, they think that you are a bad debtor. They think that you are irresponsible first and foremost, and they come after you for those funds, whether it's new account fraud or account takeover. So pushing the responsibility towards the consumer, that is by default, and it always has been that way. You have to jump over hurdles and beg and plead and fill out all kinds of documentation to prove that in fact wasn't you. Identity theft is the only crime that I can think of that you are guilty until proven innocent. And then, and then there's new account fraud. A new account fraud is when they take that SIN or SSN, like I said at the beginning, and they open up these new accounts under your name. They get new credit credit cards, new loans, and so forth. And when that happens to you, you're— and the bad guy doesn't pay the bill, because they generally don't pay the bill. Then you go to apply for a loan to buy a house, to buy a car, and your credit's bad. And so the creditor looks at your credit and they go, "Well, you're not getting this home because you have bad credit, so you're out of luck." And you go, "Well, I pay all my bills." And you look at your credit report and it says that you have this credit card that is outstanding for the past year, and now your credit score has went from the 8s to now to the 5s. That's bad for a consumer. So identity theft does affect you for new account fraud and for account takeover in a number of different ways. It can take anywhere from an hour to 600 hours or more. It can cost anything from nothing to $20,000, $30,000 in legal fees and lawyers. And some people even go to jail for the crimes of an identity thief.
Unbelievable. What a nightmare. And let's hope you and us and our viewers don't get trapped in this anytime soon. Robert, thanks so much for joining us.
Thank you.
Robert Siciliano, he is a McAfee consultant, an identity theft expert in Boston. Yeah, what a horror show, you know, tens of thousands of dollars in legal fees to try to get you— try to establish you're not the person who did all this spending.
Well, it's the person who actually pretends— used to be you'd pretend you're a dead person and go and take out loans and get a driver's license and a SIN number. Now it's clearly, you know, grabbing Andrew's ID and going around and buying a house or a car or getting a mortgage on that basis. You know, the industry needs to figure this out, clearly.
And I mean, as we move towards NFC-catalyzed commerce using cell phones, smartphones, right, which is around the corner in '12, and it'll be probably blossoming in '13, that clearly can impact cybercrime, I would think, even more.
I guess the one hope— and we're going to be looking at a phone in a second that recognizes your face— It may be biometric, you know, your face or—
But now you're waving your credit card, right? You want to pay $20, you wave your credit card. There's no PIN, there's no signature, it's just, you know, you're walking by. It's fascinating.
It's truly amazing. Okay, we gotta take a break. Coming up next, we're gonna take a look at what may be in store for Research in Motion when it reports its Q3 results in less than an hour from now.
