Gazette - It’s personal

COVER SECTION

Identity fraud and the Canadian consumer

Insp Barry Baxter
Counterfeit and Identity Fraud
RCMP Commercial Crime Branch

Once armed with a few key documents, criminals can apply for and obtain a passport, resulting in a full tombstone identity being created.

Identity fraud — the theft and fraudulent use of personal information for criminal purposes — is one of the fastest growing crimes of the new millennium. It is estimated that the fraudulent use of personal identities costs Canadian consumers more than $2 billion annually.

Our personal and financial information has become a valuable commodity. It can be — and is — captured through sophisticated Internet schemes, computer or database hacking, or organized mail-theft rings, then bought and sold in cyberspace.

Given the potential for high profit and the low risk of detection, identity fraud has drawn the interest and active involvement of organized crime. These crime groups are joining forces with sophisticated cybercriminals who have progressed from flashy notoriety-motivated attacks to stealthier, targeted and sophisticated attacks on government and corporate personal information databases.

Acquiring and using personal information to fraudulently obtain genuine identity documents or create forged identity documents is also a concern.

Identity theft or identity fraud?

The public and media continue to use the term “identity theft” to describe the criminal activity. In fact, your identity is a possession that cannot be stolen from you and you cannot be deprived of it. It can be assumed or taken over for periods of time, but you will always be you. The true criminal activity and the correct term is “identity fraud.”

There are two distinct acts in the fraudulent use of an identity. There are also different motivations for each act.

The first act is the actual acquisition or theft of personal or financial data. Sophisticated Internet schemes known as phishing or pharming attempt to deceive the public into revealing account numbers, passwords or other personal data. There have also been hacker attacks directed at mass information storage databases.

Criminals also conduct research of open-source databases such as vital statistics to create profiles from deceased persons, the so-called “tombstone identities.” Once armed with a name and date of birth, criminals can obtain a rental postal box and cellular telephone number from which applications can be made for a replacement birth certificate, Social Insurance Number (SIN) card, health card or other documents as well as credit cards. With these documents a passport can be obtained, resulting in a full tombstone identity being created.

In Canada, the federal government has recently introduced new legislation under Bill C-27 that, if passed, will make it an offence to procure, possess, transfer, sell or offer for sale another person’s identity document without lawful excuse, or to knowingly obtain, possess or traffic in another person’s personal information for fraudulent purposes.

In the meantime, the second act — fraudulent use of the another person’s personal data — is the true criminal activity. This can include falsely applying for government services or programs, obtaining genuine government-issued documents through false applications, or acquiring fraudulent payment cards. Once armed with sufficient levels of personal and financial data, criminals can take over bank accounts, move funds held on deposit or acquire lines of credit — all in another person’s name and without their knowledge or consent.

Fraudulent use can also include impersonation as defined in Section 403 of the Criminal Code, when an identity is actually assumed or taken over, usually to obtain goods or services such as an office rental or cellular telephone. The assumed identity is used to hide the true identity of the culprit. Systematically created identity packages including forged or fraudulently obtained documents also facilitate a criminal’s ability to travel nationally or internationally in anonymity.

Payment cards

Payment card fraud is technically identity fraud. For that brief time period when a forged card is being utilized for a transaction, that person’s identity is being fraudulently used.

A payment card is legally defined as either a credit card or a debit card. A card’s magnetic data can be obtained by criminals without the owner’s approval through a card skimming operation. Your personal identification number (PIN) can be obtained through the use of a pinhole camera or a pin pad overlay. Once armed with your card’s magnetic data and PIN, a criminal can create a forged or counterfeit card and use it to obtain goods and services.

Virtually all payment card fraud is related to organized crime. The 2006 combined payment card fraud losses in Canada exceeded $1 million per day. These proceeds fund a variety of criminal activities including drug trafficking, buying weapons, smuggling, loan sharking and prostitution.

If fraud is determined, the account holder’s financial institution suffers the monetary loss. There is also a short period of denial of service as cards are replaced. This directly impacts consumer confidence in Canada’s economic stability.

Who investigates identity fraud?

All law enforcement agencies are responsible for the investigation of offences under the Criminal Code. Most identity fraud offences relate to some form of deceit, false pretense or false application.

Within the RCMP, the Commercial Crime program is responsible for the investigation of identity fraud offences that are of a national or international significance, such as when the federal government, a provincial government or their programs or services have been victimized or when the integrity of a corporate entity’s database has been compromised. Because many of these types of investigations are Internet-related and global in nature, Commercial Crime works closely with the Technological Crime Branch for the information technology aspect and with the National Anti-Counterfeiting Bureau for the examination of documents.

Identity fraud trends

Criminal groups and cybercriminals are using advances in technology to create and deliver very sophisticated attacks. Internet phishing sites are developed to duplicate legitimate user sites and entice unsuspecting Canadians into providing personal and financial information that is later used for fraudulent purposes.

The frequency of the attacks on personal information databases held by government and private industry entities is worrying. These “hacker attacks” target government agencies, credit profile agencies, service providers, financial institutions and other holders of large volumes of data. Statistics indicate private businesses account for 40 per cent of all compromises followed by government offices at 25 per cent, the health care industry at 20 per cent and educational institutions at 15 per cent.

Many Canadians are exposing their personal data on social networks such as Facebook and MySpace, and through online dating services. All of these entities are susceptible to hacking and compromise.

Victims

Instances of identity fraud in Canada are significantly under-reported. Many people who are victimized are reluctant to report the incident to police because of embarrassment at being scammed or a perceived lack of evidence to provide police. Within the payment card industry, once a skim site is identified, all card holders whose card may have been compromised are notified that their present card has been cancelled and that they will receive a new card. The skim site is not identified, so the card holder cannot report the incident to police.

In Canada, the holders of personal and financial data are under no regulation or obligation to publically report breaches of their security — either to those potentially affected or to law enforcement agencies. In the past few years, there have been a number of high-profile database compromises that have resulted in significant Canadian victimization.

Your credit rating is the mechanism by which you can obtain credit, a mortgage or a business loan. If your rating is adversely affected by identity fraud, you are required to provide assurances to the credit services that unpaid bills, defaults on loans, and collection processes instituted against you are not of your own doing. It may take several years before your proper profile can be restored. The newly introduced legislation under Bill C-27 allows a court to order restitution to victims for expenses incurred to re-establish their identity, replace identity documents and correct their credit history and credit rating.

For more information and protection guidelines, visit www.rcmp-grc.gc.ca and follow the links to scams/fraud.