Identity Theft

Identity theft refers to the criminal act of using another person's name, accounts, or other identifying information without their consent, typically for economic gain. 

It is a serious concern in the realm of cybersecurity and information privacy. As more personal and financial data is stored and transmitted electronically, cybercriminals have many potential avenues for stealing credentials and assuming identities. Preventing and mitigating identity theft is therefore a major priority for individuals, organizations, and governments worldwide.

Key Concepts

Definition

Identity theft involves the unauthorized access and use of someone's personal identifying information to impersonate them and engage in fraudulent activities. The most common types of identity theft are:

• Financial identity theft - Using another person's information to open new accounts, make purchases, or apply for loans and credit cards. This can allow criminals to accrue debt and engage in transactions under the victim's name.
• Medical identity theft - Assuming someone's identity to obtain medical services, prescription drugs, or health insurance claims. This can impact the victim's medical records and insurance rates.
• Criminal identity theft - Impersonating another individual upon arrest. The victim then wrongly receives criminal charges under their name.
• Child identity theft - Stealing a child's Social Security number and other information to apply for government benefits, open accounts, or obtain employment. This often goes undetected for years.
• Synthetic identity theft - Creating a new fake identity from pieces of real identities combined with fictional information. Criminals use these for fraudulent activities that are harder to trace.

Purpose

Identity theft allows perpetrators to illegally access valuable resources like money, medical care, employment, housing, or government benefits that belong to the victim. Motivations include:

• Financial gain - To make purchases, steal funds, or generate revenue using someone else's credentials.
• Evasion - To avoid arrest or prosecution by impersonating someone else.
• Convenience - To expedite processes like obtaining loans or medical treatment under an assumed identity.
• Malice - In some cases, to deliberately cause harm to the victim's finances, reputation, or freedom.

Relevance

Identity theft is highly relevant in cybersecurity given the extent of sensitive personal data now stored online and the prevalence of online transactions. As long as this data can be compromised, the opportunity exists for identity thieves to improperly access accounts and assets.

Major data breaches at banks, retailers, insurance providers, and government agencies have allowed cybercriminals to steal tens of millions of identity credentials. Individuals and organizations must remain vigilant in protecting against unauthorized access to the types of information needed to commit identity theft.

Also Known As

• ID theft
• Identity fraud
• Impersonation fraud

Components/Types

There are a few key components that enable most forms of identity theft:

Personal Identifying Information (PII)

This includes information like names, dates of birth, addresses, and Social Security numbers that can confirm an identity. PII forms the basis for identity theft.

Account Credentials

Usernames, passwords, security questions, and other credentials used to access accounts and services. Identity thieves leverage stolen credentials to impersonate victims online.

Identity Documents

Documents like passports, driver's licenses, insurance cards, and employee ID badges that validate identity. Criminals may steal and alter these documents.

Digital Footprint

The trail of data people generate online via activities like social media, web browsing, and online transactions. Criminals piece together this information to facilitate identity theft.

Importance in Cybersecurity

Identity theft carries major cybersecurity implications:

Security Risks

• Financial loss - Victims may lose funds stolen from accounts, be held liable for fraudulent charges, or experience long-term damage to credit scores and ability to obtain loans.
• Medical fraud - Use of someone's medical identity can lead to inaccuracies in their health records and insurance claims being wrongfully filed under their name.
• Criminal implications - If crimes are committed under a stolen identity, the victim may face unwarranted arrest, prosecution, and even imprisonment.
• Account lockouts - Identity thieves accessing accounts can cause the real account holders to be locked out after failed login attempts. This disrupts access to email, banking, and other services.
• Data contamination - Incorrect data from identity thieves can pollute the victim's credit reports, medical records, and more. This is difficult to fully reverse.
• Blackmail - Criminals may threaten to commit identity theft to extort money from individuals.

Mitigation Strategies

Ways to help deter, detect, and minimize identity theft include:

• Using strong unique passwords for all accounts and enabling multi-factor authentication wherever available.
• Checking bank, credit card, and health insurance statements regularly for any suspicious activity.
• Securing all personal information and identity documents, especially when traveling.
• Promptly reporting any suspected identity theft to financial institutions and monitoring credit reports for signs of fraudulent accounts.
• Freezing credit reports when not actively seeking loans to block criminals from opening new accounts.
• Exercising caution when sharing personal information online or with unknown parties.
• Using identity theft protection services to monitor credit and the dark web for personal information.

Best Practices

For Individuals:

• Shred or destroy physical documents containing personal information before discarding them.
• Use a credit/debit card rather than a check to pay bills in public places. Checks display more identifiable data.
• Maintain careful control over all identity documents like passports when traveling abroad.
• Enroll in credit monitoring services and check reports regularly.

For Organizations:

• Follow identity verification best practices like multi-factor authentication when customers access accounts.
• Use encryption technologies to store personally identifiable information.
• Conduct employee background checks and limit access to sensitive data.
• Deploy intrusion detection systems to identify unauthorized access attempts.
• Establish an incident response plan for handling potential data breaches.

Related Terms

• Social Engineering - Manipulating people into providing personal information or performing actions that enable identity theft or other cybercrimes.
• Phishing - Deceptive emails or websites that mimic trustworthy entities to trick victims into providing account credentials or financial data.
• Multi-Factor Authentication - Requiring multiple forms of verification like passwords and smartphone codes to authenticate users on accounts. This prevents criminals from accessing accounts with stolen passwords alone.

Further Reading

For those interested in learning more about identity theft and cybersecurity strategies against it, these additional resources are recommended:

• Fighting Identity Theft with the Red Flags Rule: A How-To Guide for Business
• Social Security Administration - Identity Theft and Your Social Security Number
• Secrets and Lies: Digital Security in a Networked World. John Wiley & Sons.
• The Guide to Identity Theft Prevention. Entrepreneur Press.
• Global Cyber Alliance - Combatting Identity Theft Toolkit
• Internet Society - Guide to Combating Identity Theft

Key Takeaways

Identity theft involves illegally accessing and misusing someone's personal and account information for criminal gain. It is an increasing threat as more data is stored digitally.  Preventing identity theft requires securing personal information, using strong authentication, monitoring for unauthorized activity, and exercising caution when sharing data. Mitigating identity theft involves early detection, promptly notifying relevant institutions, and correcting tainted records before extensive damage is done.

Organizations must treat customer data with care, use identity verification best practices, and establish breach response plans. Ongoing vigilance, awareness, and proactive defensive measures are key to combating the risk of identity theft in the digital age.