Try our Search!


Simple, Lucrative & Low Tech Fraud
By
Jeff Pasternack
3/21/05

One of the things that's great about writing for fine publications such as this one is that, as a monthly paper, there's very little pressure to produce. One of the not-so-great things is that there is no concept of timeliness in anything one writes insofar as current events are concerned. By the time you read this, you will likely have forgotten these things:

  • ChoicePoint sold an unknown number of identities to an unknown number of criminals, however, for the sake of possibly limiting their liability, the range was reported as being between 140,000 and 500,000 (until they find more people who aren't who they say they are).

  • ChoicePoint also has a biometrics and DNA lab.

  • ChoicePoint's CEO forgot that a similar sort of thing happened to them in 2002.

  • Bank of America lost backup tapes containing financial records of 900,000 or so Federal employees. After an intense investigation lasting a couple of months, the government agreed that the tapes were lost. Nice work.

  • Government agencies and private companies rely on companies like ChoicePoint to provide them with background checks and identity verification services.

So now that you've forgotten all these things, and you certainly forgot that I provided a detailed, step-by-step instruction for how to do what was done in 2003, let's take a look at an intriguing thing or two.

Let's say that I was a person of negotiable moral values. I could go to a local government and, using my real identity, create A1 Medical Collections company and register with the Feds. I go to ChoicePoint.com and establish an account with my real company information, bolstered by the government's tax ID number, etc. I buy your social security number and the rest of your life from ChoicePoint for $42. Having grandiose plans, I also buy five other identities, giving me six in total. Using this information, I set up five other collections companies and six credit card accounts with which to purchase six more ChoicePoint accounts, thus giving me seven accounts in total: one real and six fake. I use these other companies to buy identities off their web site, ensuring safety by connecting to ChoicePoint's site via my laptop and free wireless hotspots. At this point, I can do a few things: sell the identities directly or use them to create personal wealth.

Having an enhanced desire for personal wealth, tens of thousands of dollars are redistributed to me, very quickly. In fact, if I base myself out of Washington D.C. (where I have easy access to 8 states within a few hours) and have a modicum of organizational skills, I bet that I could accrue $1 million within four to six months by capitalizing on:

  • The banking industry's desire to give credit
  • An army of $7-an-hour employees at firms that rent PO boxes
  • Basic disguise skills
  • The over-reliance upon the concept that possessing a social security number is equal to being the personal officially attached to that number

To reach $1 million in revenues, I need to find 80 people with good credit ratings and who can support adding another $12,500 to their credit lines on three credit cards within 30 days. So I'd need to buy, what, 800 identities at $42 each? $33,600 investment for a return of $1 million? And if I'm willing to take on a bit more risk and don't have the $33,600 up front, then I can spread it out over a few more months and regions and buy new identities with the revenues from the old. But it really has to be a quick project.

Paint me purple and call me silly, but the only reason ChoicePoint became wise to the guy they caught was because he was having records faxxed to him at a commercial copy store. Hard to believe, eh? If he'd been any good with a computer, he'd have used a wireless hotspot and set up a free account with eFax.

All of this starts and ends with the insecure social security number. I can use mine to buy yours, then use yours to create a company. Use my (your) company to buy more social security numbers, set up more companies, buy more social security numbers and use them to obtain credit cards with banks (that verify the social security number) and away we go. I keep poking at this thing because its such a simple, lucrative and low tech fraud. No hacking skills needed.

Legislators are clamoring for stiffer penalties because its all they know how to do. Banks are charging higher rates, as are their insurers. ChoicePoint and the other data brokers are calling for some type of industry oversight. Now there's an idea. I'm not smart enough to know how the oversight thing could work, much less what's being overseen. Using my fraud model, is it the creation of the first company, which is done using a legitimate social security number? Is it the establishment of an account with a data broker by a legitimate startup company? Is it at the point in time when a legitimate company begins requesting information used to track down deadbeats? Could an industry coalition be formed that builds an analytical tool that scans all requests across the data broker and banking networks, using advanced predictive models to filter out requests that are not likely to be fraudulent and then manually process the rest?

Oh, this just in. Victims were given one year of a free credit watch service. Truecredit.com charges $42 or so a year for that service. Is that equal value? Interestingly enough, it is: that's the amount ChoicePoint charges to people who buy identities. Such a shame that victims will likely be marked for the rest of their lives.

Jeff Pasternack is the president of Dynamic Consulting Group and author of the TechnoPeasant Review. If you have questions or comments about this column, please write to him at Jeff@TheDCG.com.

Jeff Pasternack is the president of Dynamic Consulting Group, a franchise partner of 1-800-GOT-JUNK? and author of the TechnoPeasant Review.
If you have questions or comments about this column, please write to him at Jeff@TheDCG.com.