ID fraud down, says research firm
610632
(InfoWorld) - Despite widespread media coverage of data breaches over the past year, identity fraud is actually dropping in the U.S., Javelin Strategy & Research Inc. reported Thursday. In fact, the cost of identity fraud was down 12 percent from Javelin's 2006 survey, at an estimated US$49.3 billion in losses. The number one source of ID fraud? A lost or stolen credit card. "ID fraud is down," said James VanDyke, Javelin's president and founder. "It hasn't been growing for several years, but we hadn't seen it drop." Nationwide, there were about 500,000 fewer victims, according to this year's survey, VanDyke said. Much of the drop can be attributed to improved antifraud practices on the part of consumers and businesses, he said. "Businesses are doing a better job of not granting new accounts [to criminals]," he said. And consumers are also monitoring their account activity more closely and reporting suspicious transactions to the banks much more quickly. Javelin based its findings on 5,000 telephone interviews with U.S residents conducted over three weeks last October. The survey follows a methodology established by the U.S. Federal Trade Commission, which released a similar study back in 2003. The Javelin research was sponsored by CheckFree Corp., Visa USA Inc. and Wells Fargo & Co. The survey's findings are at odds with those of research firm Gartner Inc., which has reported that ID theft is on the rise. But VanDyke says that this is because Javelin's numbers include responses from a wider range of people, including those who lack Internet access. "Thirty percent of people in the U.S. are not on the Internet, and those people have a vastly different way of managing their finances," he said. According to Javelin, there are also important differences between the way rich and poor people react to ID theft, something that VanDyke describes as a "fraud detection digital divide." "The low-income people essentially run away from purchases and they run away from the Internet," Van Dyke said. Affluent people, on the other hand, tend to embrace the Internet as a way to avoid having sensitive data stolen from the mail, and to keep tabs on their account activity, he said. Mail theft accounted for about 9 percent of all ID compromises. That's more victims than data breaches and phishing combined, according to Javelin's numbers. Javelin also found that young adults between the ages of 18 and 24 were at greater risk of ID theft, with more than 5 percent of respondents having been victimized. "They're being haphazard and as a result, they're being victimized," VanDyke said. "They're not protecting their PCs with antivirus software and firewalls.
13260
Criminals are not the only ones profiting from identity theft; financial institutions are making money, too.
101788
MIT researchers develop an authentication system that's not so easily revealed to prying eyes.
196938
Americans lost about $49.3 billion in 2006 to criminals who stole their identities, an 11.5 percent decline that may reflect increased vigilance among consumers and businesses, a study released on Thursday shows.
139875
Company says breach last week by hackers likely had no impact on customers, but it continues to investigate the incident.
521544
A Web site commissioned by the U.S. Transportation Security Administration (TSA) to help travelers whose names were erroneously listed on airline watch lists originally had multiple security problems that could lead to identity theft, says a congressional report released Friday.In addition, the TSA awarded the $48,816 contract for the Traveler Redress Web site based on a request for quotes with requirements that only one Web design firm could meet, says the report, released by the House of Representatives Committee on Oversight and Government Reform. The TSA&#39;s technical lead and author of a request for comments for the project was a longtime friend of the owner of Desyne Web Services and had briefly worked for the Virginia firm, the report says.&quot;This redress Web site had multiple security vulnerabilities: It was not hosted on a government domain, its homepage was not encrypted, one of its data submission pages was not encrypted, and its encrypted pages were not properly certified,&quot; the report says. &quot;These deficiencies exposed thousands of American travelers to potential identity theft.&quot;The TSA press office did not immediately respond to a request for comments on the House report. A receptionist at Desyne said the appropriate person for commenting was not available.The redress Web site went live in October 2006, and blogger Christopher Soghoian, a graduate student in informatics at Indiana University, pointed out security problems there last February. The TSA took the Desyne Web site down that month and now hosts a traveler redress form on its own Web site.&quot;This begs the question: Who are these guys, why don&#39;t they know how to use SSL, and how were they awarded this sweet contract?&quot; Soghoian wrote in February 2006. &quot;Why can&#39;t TSA do a simple form submission themselves?&quot;One of the biggest concerns raised by Soghoian and the House report is that the Desyne Web site did not use SSL encryption on its home page or on its submissions page. Travelers were asked to submit personal information, such as their Social Security numbers and birth dates. The site was not hosted on a government domain, meaning visitors &quot;lost any assurance they were visiting a legitimate government Web site,&quot; the House report says.The House report was also critical of Desyne&#39;s &quot;no-bid&quot; contract to operate the redress Web site. Desyne had done work for TSA since 2004, and as of late 2007, it continued to host the TSA&#39;s Web site where travelers could file claims for damaged property. The TSA&#39;s April 2006 request for quotes for the redress site said the design had to be consistent with the claims management site, and it had to be hosted on the same server that hosted the claims management site, the House report says.As of September, Desyne continued to operate Web sites for TSA, and the company has received more than $500,000 in business from the agency since 2004, the report says. &quot;TSA did not take action ... to sanction Desyne for poor performance,&quot; the report says.
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
496345
Federal regulators warn that the  Internet is the thriving frontier for identity theft, but 72  percent of the thefts of personal information for scams last  year was done offline, a new report says.
321693
Beaverton-based Digimarc Corp. and the federal government have entered into an ID authentication pilot project the company said is worth about $1 million.
603480
Keeping in mind the above research, the genetic profiles held by police for criminal investigations cannot always be considered sophisticated since there are chances of false identification, at least one in a billion.
505541
InfoWorld - Identity theft remained top of mind among U.S. consumers last year, but complaints about Internet auction fraud dropped noticeably, according to data released Wednesday by the U.S. Federal Trade Commission (FTC).
604015
Personal identity has taken on a new  meaning in the digital age, where basic facts like your name,  address or age are far less important to some people than the  collected records of what you were looking at online.
502674
U.S. immigration agents investigated only 139 suspected fraud cases referred by the main anti-fraud unit of U.S. Citizenship and Immigration Services last year, or less than 1 percent of 1 percent of about 6 million applications for citizenship, green cards and other benefits, federal investigators...
549303
Fraud Sciences, a private company, has developed technology designed to differentiate between real and fraudulent transactions.
82436
Most Britons are taking precautions against identity fraud, a new survey has found.
133324
While high-profile data breaches are common, there is no evidence of a surge in identity theft or financial fraud as a result.
371378
Following a lawsuit threat, a security researcher goes ahead with a presentation on vulnerabilities in RFID access cards-- but doesn't demonstrate problems with HID Global's system. By Kim Zetter.