Category: Crime & Fraud

The long and short of it

1st May 2009by Consult Hyperion1 Comment

[Dave Birch] I was at the European Patent Forum in Prague talking about biometrics in an enjoyable seminar on Privacy and Identity Theft, along with Ivo Teutloff from EPO and Max Snijder from the European Biometrics Group. The reason that the session was so enjoyable is that we’d each chosen to focus on different aspects of the topic. By coincidence, when I woke up and was sitting in my hotel room looking through my slides with BBC Breakfast TV in the background, the first item on the BBC news was the rise in card fraud, again. And this is in hand-in-hand with another massive increase in identity-related fraud in general.

A 40% increase in the number of people being impersonated indicates that the flat trend seen in 2008 (where identity fraud increased by only 0.06% from 2007) was exceptional. While last year’s figures were a surprise, the sudden and significant increase in the first quarter of 2009 heralds an unwelcome return of identity fraud as the fraudsters’ method of choice; as fraudsters assume creditworthy identities in order to swindle individuals and companies alike: stealing funds, goods and services at someone else’s expense… During this quarter, a staggering 75% increase in facility takeover (also known as account takeover) frauds – where the fraudster gains access to, and plunders the legitimately obtained accounts of innocent victims – continued the steep upward trend seen throughout 2008.
[From Fraud trends and recession go hand in hand – CIFAS Online]

If biometrics could make a dent in that, you would think that banks would be rushing to implement them. After all, as CIFAS notes, the account takeover fraud explosion has been going on for some time. Plenty of time to plan and develop a biometric countermeasure, you might think.

UK account takeover fraud grows 207% year-on-year in 2008 – study [From UK account takeover fraud grows 207% year-on-year in 2008 – study]

Yet nothing much is happening. Identity theft is growing and, in the UK at least, the government’s identity card scheme won’t do anything to help. But why? Max made a very interesting point, which goes back to my current obsession, the “narrative”. In his presentation, he pointed out that because the biometric sector had its origins in the identification problem, that is how they see the world. So they would see the retail payments problem as an identification problem, which leads to PayByTouch. On the other hand, other people (eg, me) see the retail payments problem as an authentication problem: so we need progress in what he called “anonymous” biometrics to get down to solving that particular problem. And he made a very positive suggestion that I had not considered before.

Continue reading “The long and short of it”

Time for a National Privacy Card scheme

2nd April 2009by Consult HyperionLeave a comment

[Dave Birch] There was a bit of media attention around the recent report on government databases from the Joseph Rowntree Foundation (the authors include Forum friends William Heath and Angela Sasse) but I’m not sure that the government was listening. The report was quite strong on the extent of the problem within government:

A quarter of all government databases are illegal and should be scrapped or redesigned, according to a report.
[From BBC NEWS | UK | Call to scrap ‘illegal databases’]

The way to protect personal data most effectively, particularly in large organisations such as the government, is not to store it in the first place. This may seem unworldly. After all, I want Tesco to provide me with a good service, so why shouldn’t I give up some of my personal data in order to get it? Setting aside the issue of whether what I bought in Tesco yesterday is “my” data or not, I am perfectly happy to have, and wield, my Tesco Clubcard. After all, it’s not in my real name and Tesco never ask me for data I don’t want to give them, so I’m more than happy for them to record what I buy. And, to their credit, I can say with hand on heart that I have never once received junk mail, spam or unsolicited phone calls for the imaginary alter-ego who shares my home, from which I deduce that Tesco have kept to their side of the bargain and not disclosed “my” data to a third party. So why am I concerned about the government having big databases of stuff about me?

Continue reading “Time for a National Privacy Card scheme”

Government interface

24th March 2009by Consult Hyperion2 Comments

[Dave Birch] Government identity is so important that the vigilance of the “issuers” must be unwavering. Thus, the rest of the identity management value network can function. It’s so important that one might even go so far as to say that a key role of government should be to test it’s own vigilance in an open and transparent way. In other words, shouldn’t parts of the government be checking up on other parts of the government and telling us what happened. This would be a really interesting experiment to try here in the UK, now that the government has started issuing identity cards. It would be great to have some reassurance that the process is indeed protecting us from international terrorists, dole scroungers and health tourists. The National Audit Office (NAO) could try and obtain bogus identity documents from the Identity and Passport Service (IPS) and see what happens. Just like the recent experiment in the US.

To do so, GAO designed four test scenarios that simulated the actions of a malicious individual who had access to an American citizen’s personal identity information. GAO created counterfeit documents for four fictitious or deceased individuals using off-the-shelf, commercially available hardware, software, and materials. An undercover GAO investigator then applied for passports at three United States Postal Service (USPS) locations and a State-run passport office.
[From Security Document World]

And the results? Did the ever-vigilant staff, the best IT that money can buy and the process designed by top management consultants come together to defeat these almost trivial attempts to deceive?

In its four tests simulating this approach it was successful in obtaining a genuine U.S. passport in each case.
[From Security Document World]

Uh oh.

Continue reading “Government interface”

Virtual washing machines

20th March 2009by Consult HyperionLeave a comment

[Dave Birch] I have from time to time expressed some concern that the cost of complying with money laundering laws, policies and regulations increases the net welfare because, as far as I can see, there is just as much money laundering going on in the world now as there was before. But I may be wrong because I don’t have access to any exact figures for how much money is being laundered. Except in the UK, where we know the precise amount:

In other words, we have over £82,000 of money laundering where notes were accidentally washed through washing machines;
[From The Financial Services Club’s Blog: Sorry sir, the dog ate my lunch money]

Yet another problem with notes and coins duly recorded.

crime and fraud, bugs and mistakes, notes and coins

Continue reading “Virtual washing machines”

A good solution, but only if you don’t understand the problem

12th January 2009by Consult Hyperion2 Comments

[Dave Birch] It’s all for the kiddies. There’s a terrible problem out there on the interweb: there are people who aren’t children who are pretending to be children and there are children who are pretending to be not children. Therefore, something must be done.

MySpace is now encouraging users to post their real names to their profiles. This is quite a shift – like many sites, MySpace used to refer to a ’screen name’ rather than ‘real name’.
[From Privacy Value Networks » Blog Archive » The danger of ‘real names’?]

Well, it might be considered an inconvenience that your children’s identities should be disclosed to the entire world online, but it’s for the greater good, right? And if we know who the children are online, then we can protect them, and help retailers to avoid accidentally selling knives to teenagers, and that’s a good thing too.

Child-safety activists charge that some of the age-verification firms want to help Internet companies tailor ads for children. They say these firms are substituting one exaggerated threat — the menace of online sex predators — with a far more pervasive danger from online marketers like junk food and toy companies that will rush to advertise to children if they are told revealing details about the users.
[From Ping – Online Age Verification for Children Brings Privacy Worries – NYTimes.com]

Perhaps this whole anonymity vs. absonymity argument around online identities is actually important, and perhaps we should be doing some thinking about it instead of leaving it to people (eg, Ministers) who don’t really understand the problem or the solution.

Continue reading “A good solution, but only if you don’t understand the problem”

It’s always, always the same

22nd December 2008by Consult HyperionLeave a comment

[Dave Birch] One of the reasons why a digital identity infrastructure ought to be more than just building a big database of everyone and then letting everyone have access to it is that the infrastructure will inevitably be abused by those on the inside, no matter how much effort goes into keeping out the bad guys on the outside.

Missouri Citibank employee Brandon Wyatt… accused of tapping Citibank's computers for customer information, then using it to set up checking accounts online with competing banks, including Bank of America, Washington Mutual and AmTrust. Wyatt allegedly wire transferred customer funds from Citibank to the new accounts, then cashed them out with additional transfers, checks, debit card purchases and ATM withdrawals. His take, according to federal prosecutors in St. Louis, was at least $380,000.
[From Fed Blotter: Citibank Worker Allegedly Plunders Customer Accounts | Threat Level from Wired.com]

It's hard to see how you can stop this from happening completely in an economic way, but what you can do is make sure that there is an audit trail so that someone how decides to have a go at this kind of fraud has a reasonable expectation of being caught. Although I have to say that armed bank robbers have a reasonable expectation of being caught (and a reasonable expectation of a long sentence if they are caught) but they still do it. Anyway, my point is that if you take people personal data and put it in a honeypot, there is only one outcome. A database is not an infrastructure.

Continue reading “It’s always, always the same”

Gambling on ID security

3rd December 2008by Consult HyperionLeave a comment

[Dave Birch] It’s been a landmark week for those of us fascinated by the UK’s national identity card scheme. The first cards have now actually been issued, so even as we speak identity fraud in the UK will be going… up. Why? Well, the government has met its own artificial target for the issuing of cards, but as you may have observed when you try to use one of the other smart cards in your possession (eg, your debit card), the cards are not the system.

Britain’s first ID cards cannot be read by any official body because the government has not issued a single scanner. Ministers promised to roll out hundreds of electronic readers of biometric details. However, a spokesman for the Home Office admitted last week that no employers, police forces, hospitals or colleges have been given the machine – and there are as yet no plans to issue them.
[From No scanners to read ID cards | Politics | The Observer]

So, in other words, as long as you can make something that looks like a plausible ID card, no problem. If you want to make it plausible, you need to go to the IPS web site to find out what physical features might be required to pass manual inspection. This will direct you to a helpful section on the UK Border Agency web site that describes those features in detail. it also explains how to verify a card that is presented to you…

Sponsors are expected to look at the card carefully. It will show the person’s entitlement to work, study or access public funds. The Guidance on identity cards for foreign nationals shows how you can check a card to ensure it is valid. This will help you to become familiar with its design and recognise the card when you are shown one. It also gives information on the card’s security features, to help you make your checks.

Although you are not legally required to check documents, we recommend that you do so for everyone you wish to employ.
[From UK Border Agency | Checking identity cards for foreign nationals]

The accompanying Guidance explains what a valid card should look like, but also includes some additional helpful steps for employers. These include

Physical checks can also be performed on the card. As it is made entirely from polycarbonate, it will have a distinctive sound when flicked, and the holder’s image will always be in grey-scale. The card should not be bent or folded, as this is likely to cause it to break. Contact with water should be avoided to prevent damage to the contact chip.
[From UK Border Agency | Checking identity cards for foreign nationals]

As far as I can see, life just got easier for illegal workers, since all they now have to do is to produce a valid-looking card and they are sorted. If you think that this is a hypothetical problem because no-one in the UK actually accepts these cards as proof of anything, think again.

UK casino operators can accept the Government’s new compulsory identity cards for foreign nationals as proof of ID – provided they meet money laundering regulation requirements, according to the Gambling Commission.
[From Identity Cards Now Welcome At UK Casinos | GamblingCompliance.com]

I’m sure the chance of an illegal immigrant using a forged card to launder money in a casino is so small as to be infestiminal, but nevertheless it does seem slightly odd to not even have plans to issue readers.

Continue reading “Gambling on ID security”

Good vs. bad

1st December 2008by Consult HyperionLeave a comment

[Dave Birch] A thought experiment. Suppose you found a flaw in a widely-used payment scheme, such as EMV. Suppose the flaw had come about because of a mistaken interpretation of a specification and would take some time to fix. Would you keep the flaw secret, and hope that the criminals didn’t find it, or would you tell the banks, or would you tell the banks about the flaw and tell them that the flaw will be made public in six months. I’m genuinely curious: what would you do? I’m sure that the first option is the most wrong: not exploring how to break a payment scheme means that the criminals will break it and you won’t know what to do. Consider the recent example of SIM card cloning in India, which the police apparently had difficulty responding to:

The experts said no one has actually done any research on SIM card cloning because the activity is illegal in the country.

If the good guys can’t even participate, the bad guys will always win.
[From Schneier on Security: The Ill Effects of Banning Security Research]

Bruce is, as is generally the case, right. Banning research means that only the bad guys will do the research. Hoping that the bad guys won’t find the flaw is a ridiculous strategy: it’s much better to come clean, bite the bullet and then fix it. What does “fix” mean though?

Continue reading “Good vs. bad”

Children and identity theft

18th November 2008by Consult HyperionLeave a comment

[Dave Birch] OK, so we know that overall identity theft is falling, but that doesn't mean it is vanishing and nor does it mean that it is falling for all segments of the population. A recent U.S. study about the theft of children's identities illustrates how the subject area is evolving. The issue of identity theft so far as children are concerned is an interesting one.

Rarely do parents or guardians consider the possibility that their child may have a credit history, and thus few will check to see whether their child has a credit report under their name. This can make children easy targets for identity thieves,
[From Debix – Research]

The headline results of this study are as follows:

The study discovered 5% of the children had one or more credit reports using their social security number
3% were found to be actual victims of child identity theft, while 2% were victims of file/credit contamination.
Among the 5%, the children had on average $12,779 in fraudulent or wrongly assigned debt.
While the study found that children were more likely to find problems in their credit histories as they aged, an astonishing 12% of those with problems were age 5 and under.
A handful of cases stand out as especially severe: one child had seven identities listed under his SSN, with several thousand dollars in medical bills, apartment rentals, and credit accounts in collections; another child’s SSN was associated with over $325,000 in debt.
One in four victims in the study had bills or lines of credit in collections or foreclosure, while almost twothirds of these children had fake or wrong names listed under their SSN.
42% of those children with erroneous credit reports only had credit files at one credit bureau, meaning their fraud could have gone unnoticed without checking all three bureaus.

You can see why criminals are going for this mode of attack, because using the SSNs of children must have (on average) a longer time available for abuse before anyone detects fraudulent activity. And remember, behind each of these statistics is a real person left with the mess of cleaning up identity theft.

Police say identity theft is the reason the Internal Revenue Service recently warned a seven-year-old boy from the northwestern Chicago suburb of Carpentersville that he owed back taxes on $60,000. Officers said Friday the second-grader's identity has been in use by someone else since 2001 — not long after his birth. Detectives accused 29-year-old Cirilo Centeno of Streamwood of using the boy's personal information to obtain a truck, three separate jobs, gas and electrical service for his home, a credit card, unemployment benefits and more than $60,000 in pay and services.
[From IRS tells 7-year-old boy he owes back taxes on $60,000 — chicagotribune.com]

A credit card? Unemployment benefits? I don't understand how stealing a seven year-old's identity helps you to obtain either of these, but clearly the government and the banks have some pretty lax "know your customer" procedures if a date of birth in 2001 can get you welfare and a line of credit.

Continue reading “Children and identity theft”

It’s criminal!

17th November 2008by Consult Hyperion1 Comment

[Dave Birch] I went to a seminar on financial crime the other today. Not, as you might think, to look into the possibility of an alternative career if the whole consulting thing doesn’t pan out, but because I’m always looking for ways to help our customers to develop new propositions that have a chance working because they solve genuine problems, perhaps in new and innovative ways. So, I thought, why not brush up on the key financial crimes and get an idea of where some of our clients might useful focus their efforts, while at the same time getting a sense on the priorities of law enforcement agencies, banks, regulators and so on. It turned out that some of it wasn’t particularly relevant because financial crime is a wide-ranging (you might even say “catch all”) term for a pretty diverse set of concerns. There were people at the seminar concerned with armed robbery, anti-money laundering (AML) activity, sanctions-busting and goodness knows what else. To me, this made seminar less useful than it might have been had it been more focused, but I still felt as if I was learning something, but there were to many different concerns being expressed and responded to. The particular issue of payment security was discussed, of course, but for many of the people there it wasn’t as much of a concern (in terms of both financial and reputation loss) as you might think: if your bank has just lost a few billion quid, what’s a few tens of millions in card fraud?

The seminar was held under Chatham House rules — as, indeed, was the seminar that went to at Chatham House last week — so I can’t go into any details on organisational positions, but I will say that I found the strategic perspective limited. One recirculating meme was that of market failure. A couple of people said something like “the market hasn’t produced secure solutions”, which I think is a misunderstanding of what a market is. If banks wanted better security, they would already be paying for it. To some of the participants, particularly from law enforcement, this is evidence of a market failing, where to me it is evidence of a market working. If the law enforcement guys want, for example, better security for payment cards then they need to either transfer more of the cost of failure away from the public purse and on to the industry (which they’ve started to to in the UK by no longer treating card fraud as a crime) or incentivise the desired behaviour.

The Home Office has been accused of failing to take credit card fraud seriously after it was revealed the crime can no longer be reported by victims directly to the police.
[From Police News – Card Fraud ‘Being Decriminalised’]

There were some crimes being discussed, such as mortgage fraud, that are clearly of scale but unquantified. No-one seemed to know how much of it is going on or how it breaks down. Others, such as sanctions-busting, are very important but there is no obvious way that technology can help: if the tanks get loaded onto the ship labelled “Kenya” then dropped off in Sudan instead, I don’t think that better passwords or chip cards will make much difference to be honest.

As to how technology could make a difference, someone asked a representative of the banking sector precisely that question, and we were told to improve the keys on JCBs! Apparently, every time one of these is driven through a bank wall to steal the ATM, the bank loses about a hundred grand on the ATM and the cash inside, together with five times as much to repair the bank branch. Since the incidence of this kind of crime is both seasonal (it rises towards the holiday season) and recession-enhanced, making mechnical diggers harder to steal would make all the difference!

Continue reading “It’s criminal!”