Trust Caller ID, Become a Crime Victim!

Fraud using the telephone is nothing new; it's probably been around as long as there have been telephones. After all, a telephone is merely a communication device and can be used to dupe someone into doing something they shouldn't have.

Saying that, telephone technology, which has grown rapidly in recent years, has given fraudsters a wide array of new tools to use to depart common people and even large businesses from their hard-earned money.

Take caller ID for instance, which is marketed as a means of protecting our privacy. When I say marketed, it's normally sold for a fee so we can see who is calling us. The irony of the situation is that for a fee, just about anyone can make the caller ID appear to whatever number they desire.

The ability to spoof (fake/impersonate) caller ID has been around for a few years. Collection agencies, private investigators and even law enforcement agencies use it to get people to answer their telephone. In these instances, they are normally paying the telecom company for the service. I guess this means the people selling caller ID and the ability to spoof it are making money on both sides of the fence.

While some might argue the semi-legitimate (?) uses are deceptive in themselves, I'm far more concerned when criminals or malicious beings use it to further one of their schemes.

For instance, caller ID spoofing has been used to dispatch a SWAT team to an unsuspecting person's house, and a Pennsylvania man made obscene phone calls to women and made the caller ID appear as if they were coming from within the house. It has also subjected a lot of people to abusive return phone calls when their number was spoofed and angry consumers wanted to complain.

Of even greater concern is when caller ID spoofing is used by "stalkers." In January, Alexis A. Moore did a very well researched post on her blog about this subject. Moore is a "crime victim advocate and expert in cyber stalking, identity theft, traditional stalking, domestic violence and privacy protection," according to her profile on Blogspot.

Before I move forward, please note that it seems to have worked on a 911 dispatch system. In this case, law enforcement – who is known to spoof their numbers – is being victimized by the same technology they use to cloak calls themselves. Please note that if anyone should be able to legally spoof calls, it’s probably law enforcement. Nonetheless, it is ironic.

More and more frequently, caller ID is being used by organized (and maybe some not so organized) criminals to commit fraud.

Last month, spoofing caller ID was reported to be used as a tool by an international credit card fraud ring that was broken up by the NYPD and the Queens District Attorney's office. The ring was using an easily purchased portable spoofing tool, known as a Spoof Card. Spoof Cards can be bought by anyone who has the money to buy them, right over the Internet! Besides spoofing a number, the cards can be used to disguise a person's voice and gender.

The ring, which was described as stretching from New York to Nigeria, obtained cards and activated them using a number they spoofed as legitimately belonging to the intended recipient of the card. Please note, most banks require you to activate a card from a known number when you receive it in the mail. I wonder how many of these same banks are using caller ID spoofing technology in their collections departments.

While the methods used by this group included counterfeiting, mail theft, taking over accounts and fraud applications to get the cards, using a Spoof Card was obviously a pretty successful tool used in furthering the fraud scheme. The victims were from all over North America and the cards were used worldwide. According to the authorities, the financial impact of this activity was estimated at $12 million in the past year alone.

While devices like Spoof Card are an issue, the problem doesn't stop there. Semi-legitimate (?) marketing firms, such as Voice Touch, Inc. and Network Foundations LLC – ones that the FTC shut down last month – were using robocalls with spoofed caller IDs. Of course, there were a lot of complaints that these warranties they were selling (provided by Transcontinental Warranty, Inc.) were virtually useless if you tried to use them, too.

Spoofing caller ID has led to a rash of vishing (phishing by telephone scams), also. Last year in November, I wrote about a call I was getting offering to lower my interest rate. The calls in question were robo-generated and the intent was to get you give up your credit card numbers to a scammer. As of this month, I received another one of these calls. Besides this particular scam, there have been numerous reports of financial institutions having their telephone numbers spoofed in vishing schemes.

Of course, Spoof Card isn't the only spoofing service out there. Some services offer software programs that can be used to spoof calls over a Web interface. One even calls itself PhoneGangster.com.

The services that allow it to be done over a Web interface enable the activity to be performed on a much larger scale. A simple Google search for "caller ID spoofing" brings up all kinds of Adsense ads selling a wide range of caller ID spoofing services. Of course, I shouldn't single out Google or Adsense; my guess is that any search on most commercial browsers will net the same type of advertising.

With VoIP technology in full vogue and services like Skype, the fraudulent use of caller id spoofing services now can feasibly be done across borders. This will make it much more difficult for law enforcement agencies to investigate and prosecute these cases.

In 2007, two bills were sent to the Senate to address caller ID spoofing. Neither was voted on and as a result no effective law has been put into place to address this issue. This year, Senator Bill Nelson (FL) and three co-sponsors introduced another bill (S.30) dubbed "The Truth in Caller ID Act."

In my humble opinion, the need for this legislation is pretty apparent. Laws are designed to protect people and it there are too many good reasons people need to be protected from caller ID spoofing!

The right place to file a complaint about something like this is the Federal Trade Commission. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). There is also a link on the page to file a complaint on an overseas entity.

You can also write your representatives (elected officials) and encourage them to make 2009 the year that they finally pass some legislation on this issue.

0 comments

A Call for Action in Addressing Cyber Security

On Friday, President Obama addressed the nation on the importance of securing cyberspace and the reasons why it could be a danger to both our economy and national security. He also used the term, "weapons of mass disruption" and announced that he will appoint a cyber security czar.

The speech highlighted a 60-day study conducted at his direction, designed to take a look at how vulnerable we are to cyber attacks that could drastically change the whole way we exist.

Is this a far cry from reality? Perhaps not; if you can take command and control of the computer that controls something we use, you can do pretty much anything you want with it. This might be anything from a banking system to the system that controls an electrical grid or a sophisticated weapon. If you really think about, computers control just about everything nowadays.

As I was considering this, it reminded me that there are already millions of computers where some hacker has gained command and control of and formed into a botnet (essentially a supercomputer). All it took to do this was a little social engineering to trick someone into downloading some malicious code on a machine. While some of us might write this off as stupid people doing stupid things, people have even been tricked into doing this at government agencies and Fortune 500 companies. Trust me, not all the people who fall for some of this stuff are stupid. Social engineering is known to cause people to do things they normally would not!

While it takes a little technical sophistication to write malicious code, a person doesn't necessarily have to be a technical whiz to get their hands on it. They can buy it right on the Internet, complete with a do-it-yourself (DIY) kit to execute their intended misdeed. While most of the "misdeeds" seen in the wild have a financial intent, the intent is dictated by the person committing the act. In other words, the intent might be different depending on the person who is executing the deed.

Also mentioned, both in the report and in the speech, was cyber-warfare. For years now, the Chinese have been accused of hacking into government systems, although they always deny it. Also mentioned was an actual use of cyber warfare, or the Russian attack on Georgia that happened in the not very distant past.

Please note that botnets, which I mentioned above, were used to cripple the Georgian infrastructure. The zombie computers used in these botnets didn't come out of Russia, either. Some of them were traced right back to this country. In the current environment, you don't need to be in a physical location to take command and control; it might happen from anywhere.

The report also mentions attacking electrical grids and that the CIA has intelligence that this has already occurred in other countries. Just last month, the Wall Street Journal issued an article stating that Russian and Chinese hackers had mapped the U.S. power grid and left behind software that in theory could be used to attack our electrical grid. The article quoted unnamed officials from within the government. This set off a flurry of articles and in the end, most of the experts concluded that the threat, although real, wasn’t as bad as it was hyped up to be. Nonetheless, hacking certain utilities, such as electricity, water, and sewage could cause a lot of serious problems and there is evidence it has been accomplished in other countries.

While cyber warfare is an ominous subject, the report points out that we have already seen some pretty major events when financial systems were successfully attacked. Examples given were the TJX data breach (45 million payment cards compromised) and the more recent WorldPay payment card breach where a 30 minute exploit netted nine million dollars. This highly coordinated scheme took place all over the United States, Montreal, Moscow, and Hong Kong in a very short time-frame.

There is tangible evidence that so much personal and financial information has been stolen that the laws of supply and demand are driving prices down. Interestingly enough, a lot of this information is traded right over the Internet in anonymous forums using hard to trace forms of payment.

Two recent reports point to this. Symantec released a pretty interesting report on the underground economy and shortly afterwards, Verizon issued another report on the state of personal and financial information being stolen. The Verizon report, pointed out that the 285 million "known" records stolen in 2008 amounted to more than what was recorded in the previous three years. The Symantec report, which breaks down the going prices for information noted that the practice of spoofing (impersonating) financial institutions to steal information grew from 10 percent in 2007 to 29 percent in 2008. The Symantec report stated that 90 percent of the attacks being launched via botnets were designed to steal information and that the number of infected computers had grown 31 percent in 2008 over 2007, also.

Also cited in the report and in the speech was an estimated $1 trillion dollar loss per year in intellectual property. In recent years, the FBI has been busy catching numerous people stealing technology secrets and exporting them out of the country. This brings up another variable in the problem or if a person is given access to a system it is relatively easy to compromise it.

Recently, it was even disclosed that computers in Congress were hacked. It appears that even government intellectual property is being targeted.

When it comes to intellectual property theft, often we do not know what the motive is. Again, the intent is largely dictated by the end user. If you wanted to see a real world example, you might take a look at software piracy. The Business Software Alliance puts worldwide losses at over $50 billion, yearly. If you were to look at counterfeiting in general – which can involve the theft of intellectual property – the International Anticounterfeiting Coalition estimates the losses at $200 to $250 billion just in the U.S., every year.

The report, which is posted on WhiteHouse.gov, also addresses the growing problem of privacy in the digital world. Personal and financial information is worth a lot of money to businesses and criminals alike. Unfortunately, because of this, a lot of people are leery of putting in controls that might make it harder to profit from information. Because of this, a lot of people’s personal and financial information has gone missing.

The American Library Association, the Cato Institute, the Center for Democracy and Technology, Carnegie Mellon University, Consumer Action, the Center on National Security Studies, Cornell University, the Electronic Frontier Foundation, the Electronic Privacy Information Center, George Washington University, Harvard University, Indiana University, Johns Hopkins University, OMB Watch, Ohio State University, the National Security Archive, the University of California-San Diego and the American Civil Liberties Union were all consulted in the initial 60-day report.

While the report isn't clear on how privacy will be dealt with, it nonetheless is calling out that a problem exists. The problem is too much information being stored in too many not very well secured places.

For a real example here, one could refer to the DATALOSSdb Open Security Foundation, which tries to document all the known data breaches. The problem is getting worse all the time, and although some might argue that greater transparency is the reason for this, there are probably many more unknown data breaches that occur out there. After all, it’s unlikely that the hackers or other criminals stealing the information are going to come right out and tell us where they are getting it from. From a business perspective, it isn’t in their best interests.

The real casualties in this part of it are the individual victims, who suffer a lot when their information is used after it stolen. With the sheer amount of victims out there, some could argue we are facing an identity crisis.

To add to the problem, technology is now also being used to produce high-quality counterfeit documents and financial instruments in places, such as garages. This makes the information being stolen all the more dangerous, or easy to abuse.

Another thing the report addresses is the need for education and that laws need to catch up to the technology we are using. An interesting section at the end of the report highlights the history of modern communication technology. There is little doubt that as technology grows at a rapid pace; it is hard for the legal community to keep up with it.

In the end, in my humble opinion, the study is the first step in a positive direction. We have already seen too many examples of the abuse of technology, which has a lot of potential for good, too! The problem is how to deal with those who abuse it. The good news is that a large part of solution can be achieved by using a little more common sense and the clean slate approach (mentioned in the report) will go a long way towards making this a viable effort. In the end, a responsible balance is the key, and this is what it seems the report seems to be calling for.

0 comments

FaceBook Hack Reveals Trend in Targeting Social Networks

Attacking social networking websites is becoming more common all the time. My guess is that they are being leveraged by criminals, who are after the vast amount of personal information people willingly put up on these sites.

For the past couple of weeks, the ongoing attack on FaceBook has figured prominently in the media. The attack isn't much different than some of the other ones we've seen in recent years – which are to take over a user account – and then use it to trick people into falling for a scam. In this instance, a phishy link is being used to direct the effort.

The intended victim receives a communication from someone they know (who has already been compromised), which directs them to a page that appears to be a FaceBook login. They are then prompted to put in their user name and password. If they do, their information is stolen and will be used to trick even more people into doing the same thing.

Stealing stolen user accounts on eBay has been a problem for years. On eBay, it is a means of using an established seller's credentials to trick people into thinking they are dealing with a "trusted seller." The only difference here is that instead of selling bogus or non-existent merchandise, the intent on FaceBook is probably to trick people into giving up personal or financial information.

This information can then be used to commit financial crimes, using the victim’s identity.

I found some information about the FaceBook attack on Symantec's Security Response blog. Thus far, according to the research conducted on this at their lab, no computers have been infected.

According to Marian Meritt at Symantec, the danger of giving up your FaceBook credentials might go beyond having your account compromised. She believes the hackers behind this are looking to compromise other accounts, where you might use the same credentials. I read some other articles on this and thus far this seems to be the consensus of why the attack is occurring, but no one seems to know for sure.

Whether this is the intent, or not – the advice given in the post is something that should be considered when dealing with the multiple accounts a lot of us have.

First and foremost, you should pay attention to the address in the bar at the top of your page. If it is not exactly the address of the legitimate site, you are probably being tricked into thinking that it is. For instance, www.faceboot.com is not www.facebook.com. Even better, if you spot a suspicious link, hover your mouse on it (without clicking on it) and the actual address will appear at the bottom left-hand of the page. Entering the legitimate address in your address bar is always smarter than clicking on a link, too.

Of course, it's also wise to check out the address at the top of the page after arriving at your destination, also. You should also stop and think when something pops up instructing you to enter your user and password information.

Also recommended is to use complex and unique passwords for each of your accounts, maintain an up-to-date browser and operating system and use updated security software from a reliable vendor.

When purchasing security software, ensure you are not buying counterfeit software or being tricked into purchasing scareware. Scareware is bogus security software that normally prompts a user to run a scan of their system, which reflects all kinds of bad things going on. The problem is that the problems normally do not really exist and the protection they are selling doesn't really protect you, either.

So far as buying counterfeit software, it normally doesn't protect you very well and it might even have some malicious code built right into the program.

While the FaceBook attack is the flavor of the week, it’s not the only social networking site that has been targeted in the recent past. Twitter and MySpace have been the targets of recent attacks, too. SC Magazine did a recent article where a security researcher from Websense was quoted as saying they have detected more than 200,000 sites impersonating the above mentioned social networking sites.

Going beyond social networking sites, financial, auction, e-commerce are frequently attacked, too. The common denominator is sites where criminals can harvest information and turn it into money. Please note that people interested in doing a little bit of due diligence on you personally might see what you are putting up on these sites. I’ve recently seen this presented as a “best practice” when doing background checks on people.

The key is to adopt the known best practices if you enjoy using these sites. Another wise thing to do is to be extremely thoughtful about what information you post on them and how it might be used against you.

Anything you post on these sites can and will be used against you if the wrong person gets their hands on it. In the end, being mindful of the information you are posting on a social networking site is probably the best defense you have. After all, you never know who is looking at it!

0 comments

E-Cards with a Dangerous Twist Spotted on the Internet

(Courtesy of Websense)

With the holiday season upon us, spam campaigns of a malicious nature will start springing up bearing yuletide greetings.

Just the other day, Websense sent out an alert that malicious software authors already are using social engineering techniques with a Christmas theme to compromise your home machine. The instance they are reporting uses spam e-mails offering free animated postcards.

Those unfortunate enough to attempt to get free e-cards will download a Trojan. The spam e-mails are spoofed to appear as if they come from postcard.org. The fact that malware (postcard.exe) is being installed on a machine is covered up with a xmas.jpg image.

Quite simply, once installed it allows cyber-scrooges to control your machine and or steal all the personal and financial information off it. The information is then normally used to steal money.

This type of attack is nothing new and seems to surface every year at this time. The next step in these campaigns normally are more personalized spam e-mails designed to do the same thing (download malware). Please note these e-mails are normally spoofed to appear as if they come from a legitimate e-card retailer.

Last year, American Greetings put up a page on their site to educate people how to spot and avoid falling victim to this type of attack. First and foremost, they recommend that if you are suspicious at all to go to the company site and try to pick up the greeting from there. Most (if not all) of the legitimate sites offer this service. The page on their site contains additional ways to identify "e-card garbage" and is well worth a look if you are unfamiliar with how to spot malware attacks using spam e-mails.

American Greeting put up this page after an attack on their brand. In this attack, some of the e-mails appeared to come from a known (trusted) person. My guess is this happened from an already compromised machine, where a spammer gained access to an address book and sent the e-mails out. Some forms of malware do this without any human interface.

I went to the Postcards.org site and thus far they have no warnings about this that I could find.

While the best thing to do is to avoid clicking on spam e-mail containing malware, the second best thing is to employ solid anti-virus software and a firewall from a reputable vendor like Websense, Sunbelt, or Symantec. Most of these vendors are on top of malware being issued in the wild (on the Internet) and they even share information with each other.

0 comments

Wawa gas pumps latest target of payment card skimming devices!

When I'm traveling on business in the Mid Atlantic, Wawa is a great place to stop. They literally provide just about anything a road warrior would desire.

Unfortunately their self service pumps are the latest targets of payment card (credit/debit) skimming devices. Just about any self service machine that accepts payments, or dispenses money (ATM machines) can have a skimming device mounted to it.

CBS 3 Philadephia reports:

With gas prices rising and the state of the economy in disarray, even thieves are resorting to more creative measures. At least two Wawa filling stations in the Philadelphia area have fallen victim to a string of recent credit card skimming scams.

"Just like any identity theft, until you see it on your credit card or bank statements, it's really important to check for any usual transactions," said Ela Voluck of AAA.

Thieves place a device over the card reader and can instantly record the information on the card.

Unfortunately, no pictures of the devices at Wawa seem to be available.

Recently, Redbox, a company that dispenses movies at self-service kiosks were the target of skimming devices. I have to commend them for being transparent and proactive by letting the public see exactly how this occurs.

They provided a warning on their website, along with some interesting pictures.

The only defense a person has is to carefully inspect these devices at self service places, such as the gas pumps at Wawa. Some of them are pretty bad and will literally fall off if handled too roughly.

Here are some pictures of skimming devices:








Skimmers are mounted on ATM machines, or any remote self service device. There are also portable ones that dishonest employees use to skim a card when they take it for payment.

Google has a neat sampling of pictures, which can be seen, here.

0 comments

Send Dad a "Phishy" E-Card for Father's Day

In case you forgot to send a Father's Day card, here are some free ones courtesy of the fine folks at the Federal Trade Commission designed to educate him about phishing, which is a leading cause of identity theft on the Internet.

These were sent to me courtesy of Alvaro Puig from the Federal Trade Commission’s Division of Consumer and Business Education in Washington , D.C.

Please note that most of the consumer awareness materials from the FTC are available in both English and Espanol.

Avaro wrote:

With Father’s Day right around the corner, I wanted to let you know about our Father’s Day phishing e-card. This e-card, which is available at www.ftc.gov/dad (and www.ftc.gov/padre in Spanish) gives “Dear Old Dad” some useful tips on how to recognize and avoid phishing emails and protect his personal information. The e-card also links to our newly released “Phishy” videos that are designed to create awareness of phishing in a humorous way.

The FTC and their government agency partners provide a lot of free educational resources about fraud, phishing and financial misdeeds on the Internet at OnGuardOnline.gov. A lot of these presentations are visual and great tools to learn, or spread the word!

In the war against fraud, there is no more powerful tool than communication. The reason for this is that no matter how good a scam is -- human beings are less likely to fall for it if they are aware of the consequences.

More consumer awareness information can be obtained on the FTC's website and it is available in both English and Espanol.

0 comments

Phishermen stealing food from the mouths of Children

It never ceases to amaze me how cyber criminals seem to have NO conscience, whatsoever.

The FBI and IC3 are reporting that EPPICards, which are set up as debit cards to disburse child support payments are the latest target of the phishermen.

In this instance, they are literally stealing food from the mouths of children.

From the FBI press release:

The FBI and its partner, the Internet Crime Complaint Center (IC3), have received reports of phishing attacks targeting users of EPPICards. The EPPICard is similar to a debit card. EPPICards are issued by a state agency for the purpose of receiving child-support payments. The cards are currently used in 15 states.

Individuals have reported receiving e-mail or text messages indicating a problem with their account. They are directed to follow the link provided in the message to update their account or correct the problem. The link actually directs the individuals to a fraudulent web site where their personal information, such as account number and PIN, is compromised.

My humble guess is that if a parent is being forced to support their children by loading funds on a EPPIcard, the kids in question could really use the money.

If you happen to spot one of these phishing or vishing attempts, please take the time to report it to IC3.

If you want to learn more about phishing and other related Internet scams, the Federal Trade Commission (FTC) recently posted a series of videos on YouTube that can be viewed, here.

Full press release, here.

0 comments

Monthly Spam report reveals how uncertain economic times are fueling new scams!

(Courtesy of Symantec)

With prices rising out-of-control and foreclosure signs being used to market real estate, one might think that scam artists and other less than ethical people would lay off for awhile. Think again, they are out in force and coming up with devious methods to make bad situations, worse.

I follow Symantec's spam report on a monthly basis. If you want to get an idea of what fraud campaigns are being run by cyber criminals, or what new twists to old scams are surfacing - it's a great place to get an overview.

Interestingly enough, the report starts with a comparison of e-mail spam to the lunch meat it is named after:

The harsh economic times can be witnessed from every angle, with the rise not only in email spam, but also the sales of the actual lunchmeat product, Spam. According to NBC’s Brian Williams, the spike in Spam sales is a huge economic indicator of the times, and families trying to do more with less. The exact same could be said for email spam. With spam messages accounting for over 80% of email in May 2008, the economic slowdown and its effects are definitely being targeted by spammers – preying on the hardships of people not only in the United States, but Worldwide.

In the past month, the economic stimilus program and the disasters in China and Myanmar have clogged inboxes with come-ons designed to trick people out of their money, or even worse (if a little malware is dropped) all the personal and financial information off their computer.

The report also highlights a campaign in China, offering fake invoices to avoid paying taxes.

Also noted was a scam to sell tickets to the Championship League Final, which was the biggest football (soccer) event in recent times:

The biggest football game in the European football calendar took place on May 21, 2008 in Moscow. Tickets were in big demand all over Europe for this event, and spammers certainly took notice.

Under the guise of a travel agency, the spammer offered the recipient “a unique opportunity” to acquire tickets for the game. The prospective customer was asked to click on a link to purchase the tickets and provide personal details. The recipient was then instructed to go to a legitimate online payment site to complete the transaction.

When the recipient paid for the tickets using the legitimate online payment site, the spammer requested that they email their name, surname and the unique online payment voucher number to the spammer in order to receive the tickets. The legitimate online payment website for the Champions League Final clearly states that the unique voucher number should never be emailed and only used on secure websites that accept their payments.

Please note that ticket scams are nothing new and the more popular the event is, the more likely spammers (scammers) are going to try to dupe people out of their money in the hopes of securing a ticket.

The June report highlights how spam has become a problem that has become International in nature!

Full June report from Symantec can be accessed, here.

Previous posts I've done on the monthly Spam Report can be seen, here.

0 comments

Chinese Red Cross Site hacked to steal donations!

Whenever a disaster occurs, there are always dishonest people trying to steal the proceeds of charitable contributions.

This is always sad because it takes away from the people, who are in need.

Heike over at the Dark Visitor is reporting that a Red Cross site has been hacked with the intent of "electronically" removing money intended to help the earthquake victims in China:

Verified by the Ministry of Public Security, a section of the official Red Cross website has been illegally hacked. According to the report, criminal elements gained access to the section of the website that held the special accounts for earthquake disaster relief donations.

An individual named Li Bujiu, had opened four fraudulent bank accounts to steal the funding.

Full story with more details from the Dark Visitor Site (Inside the World of Chinese Hackers), here.

Thus far, we haven't seen the flood of phishing, fake charity websites and the like come about as the result of the earthquake in China, or the cyclone in Myanmar reported in the West? Even this story isn't up on Google News yet.

Reuters did recently report that fraud is occurring inside China as a result of the earthquake disaster:

Police issued a warning after a flurry of text messages hit mobile phones, soliciting disaster assistance in emotional appeals, only asking that funds be deposited in private accounts.

The Reuters story -- which does mention that the Red Cross was shut down because of too many vistors (?) and had a page listing bank accounts to contribute to (??) -- can be seen, here.

The story in Reuters references the site, http://www.crcf.org.cn, which as of this writing appears to be up and running.

Not sure why more news on disaster fraud from China isn't being seen? It could be attributed to the "Great Firewall of China," or the fact that hacking and committing fraud carries far more serious consequences in China than it does here in the West.

Generally, if caught, offenses like hacking can mean the death penalty in China. In 2006, China carried out ten times more executions than the next country who still uses captial punishment. Generally, they use one round from an assault rifle (hollow-point) to the back of the head.

Of course, that doesn't mean that there isn't a lot of hacking coming from China. We see stories all the time about Chinese hackers committing corporate and government espionage. The Dark Visitor is an excellent site, run by a former intelligence type, about the mysterious world of hacking in the People's Republic.

I guess the difference on whether you get a bullet in the head, or not depends on whether certain authorities approve of your activity (my opinion). Of course, they are not beyond setting an example from time to time if certain political conditions exist.

Last year, China executed their former food and safety chief (Zheng Xiaoyu) for taking bribes in the wake of all the news stories about defective and dangerous products being exported from China.

With all the humans rights violations, fraud, hacking and deception that occur in the People's Republic, it's amazing that so many companies in the West continue doing business with them.

Sadly enough, some believe this has been at the expense of many people in their own countries. Given the human rights violations, it is also at the expense of a lot of Chinese people, also!

Perhaps, I'm old fashioned, but I sometimes wonder when people will come first?

Sadly enough, greed often gets in the way of this concept.

0 comments

State's top lawman takes a "Don't mess with Texas" approach to fighting identity theft

(Texas Attorney General Greg Abbot)

Texas Attorney General, Greg Abbott, is teaching the business world not to mess with the personal information of Texans.

Using a series of laws that he wrote an essay on, AG Abbot has taken legal action against Radio Shack, CVS Pharmacy and CNG Financial Corporation doing business as as Check and Go and Southwestern & Pacific Specialty Finance for not properly protecting people’s information. His office also has pending action against “Select Physical Therapy Texas Limited Partnership and its parent company, Select Medical Corporation, as well as Minnesota-based LifeTime Fitness for improperly discarding customer records,” according to a press release on his site.

Notably, it didn't take a crack team of computer security geeks to crack these cases. In all of these instances, the investigators used a more old fashioned, but often effective investigative technique called dumpster diving.

Going back to my original premise that there is a lot of unprotected information being compromised too easily, these cases represent how much low hanging fruit is available to identity thieves.

This probably wouldn’t surprise anyone who has taken a look at Attrition.org’s Data Loss Database - Open Source. Fairly frequently, mass amounts of information go missing for not very "technical" reasons.

On Tuesday, the Texas AG site announced a new tool to assist Texans in recovering from becoming an identity theft victim:

The Attorney General’s Identity Theft Victim’s Kit offers a step-by-step priority checklist that victims can use as soon as possible to prevent further damage. Once the identity theft has been confirmed, for example, victims should quickly close all bank, credit, utility and service accounts. Next, victims should contact one of the major credit bureaus and request that fraud alerts or security freezes be placed on their credit reports. This action prevents new accounts from being opened fraudulently under victims’ names.

Also mentioned in the press release is that it still pays to report identity theft to the Federal Trade Commission. They point out that, "many creditors will accept this affidavit on victims’ behalf in lieu of a police report about the crime."

They also point out something that I think is even more important:

A recent trend among identity thieves suggests the criminal may use victims’ personal information to obtain a driver’s license, file for bankruptcy, seek Social Security benefits or apply for a passport. In such cases, the Identity Theft Victim’s Kit instructs victims to immediately contact any government agencies approached by identity thieves.

A lot of people have been led to believe that the final solution to preventing identity theft is to monitor your credit bureau. Unfortunately, a lot of this has been driven via advertising campaigns by some of the pay for protection identity theft services.

Identity theft isn't only a problem in financial crimes. Criminals steal identities to work, obtain government benefits and to commit a wide range of "other than financial crimes."

Critics of the pay for protection industry have often pointed out these paid services, although convenient, accomplish what a person could do free-of-charge, themselves. Since it is an unregulated industry, the services offered varying levels of protection, also.

There are some of these services that are way better than others, and if you decide to go shopping for one, the term "caveat emptor" (buyer beware) is a wise principle to apply.

This site, http://www.texasfightsidtheft.gov/index.shtml, offers one click access to all the steps a person needs to take to recover from becoming an identity theft victim. It also offers a lot of resources that a prudent person can use to prevent identity theft.

After reviewing this site, I noted that it could be used by citizens of just about anyone residing in the United States of America.

In closing, the approach taken by Attorney General Abbott and his office is refreshing and a lot of other elected officials would benefit from studying what I consider a "no nonsense" approach to combating identity theft.

0 comments

Truston ID Theft protection and recovery platform rakes in another award!

It appears that Tom Fragala and the MyTruston team have raked in (yet) another award. This time from the Pacific Coast Business Times as one of the hot start-up companies coming from California's Central Coast.

Tom Fragala, Truston's CEO wrote on his blog, "This recognition comes on the heels of being named a 2008 Hot Company and receiving a technology award from the Info Security Products Guide."

Here is the reason why they were chosen:

Truston's MyTruston® service is the only fully online identity theft recovery system. It is web-based software that can help millions of people easily recover from and prevent identity fraud by supporting virtually any type of ID theft. MyTruston walks consumers step-by-step through the entire prevention or recovery process—dramatically reducing the time, financial cost, and emotional impact. And it can easily be embedded into a partner's own website on a private-label basis.

The press release also contains a comment from Tom Fragala, CEO of Truston:

“The Pacific Coast Business Times recognition of Truston as one of the hottest startups in Central California further validates our innovative products and strategy of offering our services to large partners in the identity theft, direct marketing and financial services markets,” said Tom Fragala, CEO and founder at Truston. “Superior technology and support for partners differentiates Truston from other companies in the identity theft protection market.”

Tom developed Truston based on his own personal experience as an identity theft victim and has spent thousands of hours assisting other victims of identity theft.

Because of this, coupled with the fact that he is selling this technology to large partners, he still takes care of us "little people" by offering a free 45 day trial (no credit card needed) of the Truston platform.

Saying that, I should mention that the platform has always protected people free of cost and only charges for using it to recover after a person is a confirmed identity theft victim. Most companies charge you right from the beginning and will only help you if you were paying at the time of the crime (pardon the pun). Many of them also require that you surrender all your personal details, which they maintain on a database. Information on databases are a favorite place for identity theft thieves to obtain the resources they need to commit their crimes.

There are some, who believe one of the root causes of identity theft is the multi-billion dollar business of buying and selling information, which is normally maintained in databases.

If you are interested in checking out the Truston platform while it is still free, I've provided a link, here.

0 comments

FBI reports scams against senior citizens are growing

(Picture courtesy of the FBI site)

Ran into an interesting communication from the FBI on the growing problem of senior citizens being targeted by scam artists. Of even greater interest -- largely because most senior citizens now use the Internet -- a lot of them are being targeted from foreign lands with the click of a mouse.

The FBI reports:

The threat to seniors is growing…and changing. Baby boomers (born between 1946 and 1964) are now the largest segment of our population—about 78 million people. That means that the number of senior citizens is rising. Many younger boomers also have considerable computer skills, so criminals are modifying their targeting techniques—using not only traditional telephone calls and mass mailings but also online scams like phishing and e-mail spamming.

Most experts agree that senior citizens are targeted because many of them have developed solid financial resources over a lifetime of hard work.

I frequently watch spam trends -- largely because I consider spam the vehicle for most fraud, phishing and financial misdeeds on the Internet -- and I've noted a lot of anti-aging and health products of a dubious nature being pitched. To me, this confirms that the spammers and bot-herders are indeed targeting the elderly.

The current press release has a lot of great information on how to spot fraud and avoid becoming a victim.

Instead of copying them for this post, I would recommend reading the press release.

The press release also points to another excellent page on the FBI site dedicated to educating all of us about fraud against our senior citizens.

Last, but not least if someone thinks they are being targeted by a scam, it's always a good deed to report it. By doing this, it might prevent another human being from a lot of pain and suffering.

Here is the FBI recommendation on how to do this:

Who to call. If you’re a senior citizen who has been victimized by fraud, start by calling your local or state law enforcement agency.

The FBI doesn’t handle isolated individual cases: we get involved only when there are huge dollar losses or if there's evidence of an international crime ring at work. But you can report fraud online to us through our Internet Crime Complaint Center, which is run in concert with the National White Collar Crime Center, and we’ll refer it to the proper authorities.

0 comments

ICE raid nets 49 illegal security guards in Texas

Looks like the folks at ICE have been busy in Texas going after illegal security providers, some of whom, apparently were armed.

Jason Trahan at the Dallas Morning News reports:

A task force led by U.S. Immigration and Customs Enforcement raided more than two dozen mostly Latino night clubs, restaurants, pool halls and other businesses Saturday night, arresting 49 undocumented immigrants employed as security guards, officials said.

All of those arrested work for two local security companies, which authorities declined to identify Sunday.

The investigation into these security guard providers might be ongoing because in Texas, as in most States, security services are a regulated business for which a license must be obtained.

According to the Texas Department of Public Safety:

Under state law, commissioned security officers must successfully complete a 30-hour school. Once the course is completed, commissioned officers must wear a specific uniform indicating the company by whom they are employed while carrying their weapons.

Applicants for licensing or registration by the Private Security Bureau must have undergone a fingerprint-based state and national criminal history check. Applicants who have been convicted of a felony or a Class A misdemeanor cannot be considered for a license for 20 years. Applicants convicted of a Class B misdemeanor can apply for consideration after 5 years. Some Class B misdemeanors, such as first-time DWI, do not disqualify an applicant from receiving a license or application.

Maybe this is why -- despite the lack of official commentary on the matter -- Craig Watkins the Dallas County District Attorney stated:

Hopefully, this operation will help us send a message that we will not tolerate the falsification of documents for undocumented aliens under the guise of providing security.

Counterfeit documents are a huge problem and enable a lot of illegally placed individuals to obtain employment that they would otherwise be barred from. Given that they are easily available, they are a gateway for all kinds of other criminal activity, also.

This isn't the first time, a story has broken, where counterfeit documents allowed people using an unverified or even someone else's identity to perform duties they never should have been able to.

Although a few miles from Dallas, in November, James Slack of the Daily Mail revealed that 5,000 illegal immigrants were working as security guards in some of the United Kingdom's most sensitive buildings.

In January of 2007, the Herald Tribune reported that 40 illegal immigrants were arrested on military bases by ICE. The same story referenced an earlier story, where 60 illegal immigrants were arrested at Fort Bragg, North Carolina, home of the 82nd Airborne Division and Special Operations Units.

Earlier this month, Neville W. Cramer wrote in Today's Facility Manager about the growing problem from a facility management perspective:

While there are a multitude of economic and social issues surrounding the millions of illegal aliens currently in the U.S., two issues should be of specific concern to facility managers (fms). The first is security, and the second is comprehensive immigration reform. Since the latter is currently hung up in Congress, this article will examine security first.

Federal, state, and municipal law enforcement agencies are well aware that some of the largest employers of illegal aliens are directly and peripherally involved in building services and maintenance. Whether it is the cleaning crews, the janitors, the trash removal workers, or the security guards, illegal immigrants make up a significant portion of the workforce.

While this recent event in Dallas highlights the illegal immigration problem from the South -- there are illegal immigrants from other parts of the World working as security guards -- who likely have been planted in facilities or organizations for the purposes of stealing information.

From the Today's Facility article:

For instance, organized criminals from West Africa (Nigeria, Ghana, Sierra Leone, etc.) are now firmly entrenched nationwide in the security guard business. They are usually educated, well mannered men and women who are willing to work weekends and midnight shifts.

Unfortunately, what is not widely known is that “while guarding the henhouse,” many of these contracted security workers are suspected of stealing employee and customer identity data and company proprietary information. In some instances, these guards are using multiple fraudulent identities themselves, making it almost impossible for law enforcement to catch up with them. Fms should be aware of these emerging trends and, along with law enforcement and security professionals, take whatever steps are necessary to mitigate their risks.

The article sums up it's thoughts with the well known fact that the current Employment Eligibility Employment Verification Form (1-9) is woefully inadequate, especially with all the stolen identities and counterfeit documents that are easily obtained, just about anywhere.

Even with no match SSN legislation forthcoming -- which will require social security numbers to match a name -- the system will probably still be manipulated. There is a lot of stolen information out there, which contains both names and social security numbers, already. The groups counterfeiting documents will just have to make sure everything matches.

This is likely to cause an explosion in the number of identity theft cases, which is already a growing problem.

This legislation, which has been held up by a Federal Judge in San Francisco at the behest of the ACLU and other groups, appears to be poised to be enacted in the near-term. Arizona, which has the highest rate of identity theft in the nation, has already enacted a similar law.

Dallas Morning News story, here.

Well written and informative article by Neville W. Cramer, here.

If you want to learn more about the easy availability of counterfeit documents and how they are being dispensed throughout the U.S. (and probably the World) by organized criminal gangs, I recommend going to Suad Leija's Paper Weapons site. The information on this site has been covered extensively by the mainstream media and is likely being used by government entities to discover the full scope of this scary problem.

0 comments

Fine Wine and Identity Theft?

What do fine wine and identity theft have in common? According to the FTC's top cities for identity theft, the answer is Napa, California.

Christopher Null blogged about this on Yahoo:

While you're sipping Chardonnay and enjoying the beauty of the wine country, crooks may be busy swiping your identity. According to a Federal Trade Commission study, Napa, California, earned the title of worst town for identity theft, with over 300 consumer complaints per 100,000 residents in 2007.

Madera, California, (280 complaints per 100,000 residents) and Greeley, Colorado, (228 complaints) followed Napa on the list. On a state level, California (120 complaints) was surpassed by only Arizona, which had the worst per-capita trouble with identity theft (137 complaints).

I decided to go to a more local Northern California source and found that Channel 10 News out of Sacramento/Stockton/Modesto covered the story, also.

Cornell Barnard (News 10) reports:

Stockton ranks number 21 out of 50 on the Federal Trade Commission's list of the worst cities for identity theft complaints.

Stockton Police can't pinpoint why their city ranks so high, but the valley's trade take part of the blame, a constant hunger for cash.

"It's all connected. It's a brutal crime for those victimized," said Stockton Police spokesman Pete Smith.In addition to Stockton, Northern California is well-represented on the FTC list. Napa tops the list of U.S. metropolitan areas for identity theft consumer complaints, logging over 302 complaints for every 100,000 residents during 2007. Nearbly Vallejo and Fairfield rank sixth while the Yuba City area comes in 11th.

Interestingly enough, Vallejo and Fairfield are just over the hill from Napa and one of the entry points for the San Francisco Bay area. Yuba City is roughly just North of the Napa Valley. These cities aren't very far from Stockton, either.

Maybe this means, there is a higher incidence of Identity Theft in Northern California? Napa might be the worst because it is an affluent area and the better a person's credit is -- the more lucrative their identity is to a criminal.

Being a fifth generation, or so Northern California type (a lot of this blog is written from there), I'd like to point out that Northern California also hosts a lot of information to combat the identity theft problem. In fact, some of the best resources to protect and educate people originate from the area.

Sacramento, which didn't make the list is the State Capital. The Office of Privacy Protection is one of the better written information sources to educate people about the problem of identity theft. Please note the information on this site is available in English, Espanol and Chinese.

For the more frugal, this page contains all the information needed to protect a person without paying for one of those services with an alleged $1 million guarantee.

Interestingly enough, the State of California is also known as being pretty proactive when it comes to protecting the rights of victims. Many of the privacy laws enacted in California have had a worldwide impact.

A great place to read more about the problem is a document outlining Governor Schwarzenegger's 2005 Identity Theft Summit. This document includes a lot of perspective from privacy groups, law enforcement and business groups on the problem.

Last, but not least, a University of Berkeley professor, Chris Hoofnagle just issued an interesting paper based off information culled from the FTC about which financial institutions are most prone to making their customers a victim of identity theft. Professor Hoofnagle openly admits that the results might be jaded because they are only from a consumer complaint point of view and that most financial institutions seem to prefer not to release these statistics.

If your a more "visual type," Cornell Barnard's newscast on this story can be seen, here.

If you are one of those more "scholarly types," the full FTC report on this can be viewed, here.

0 comments

Truston and Identity Force team up to provide identity theft protection/recovery services

Truston -- who provides a privacy and user friendly means to protect a person from identity theft -- has announced a partnership with Identity Force.

Truston allows a person to protect themselves without giving up any of the personal information that is normally used by identity thieves to commit a wide assortment of crimes. It also allows a person to protect themselves, as well as, find out if they have anything to be concerned about free-of-charge.

A person is only charged for using the service when they recover from identity theft and then is only charged for however long the process takes. This is a big difference from most identity theft protection/prevention services, who charge a person on a long-term basis regardless of whether or not they have been actually become an identity theft victim.

Many of the identity theft protection services do not cover a person unless they were signed up (and paying) at the time they became a victim.

In addition to this, the monthly charge for using the recovery services is about the same as most of the competition. Because the recovery services are used on an "as needed" basis, the overall cost of using Truston is far less than the competition.

Identity Force provides identity theft protection services to a large number of customers including government agencies, such as the Department of Veterans Affairs, Transportation Security Administration, Federal Emergency Management Agency, National Institutes of Health, U.S. Coast Guard and Department of Education.

Because of this, Truston will now be available to a substantial customer base, many of whom, might not want to provide all their personal information to a third-party. Given that many of these people were referred to Identity Force after a data breach -- where a system was compromised and their information was exposed -- Truston provides an approach that might give them greater piece of mind.

Here is part of the announcement from the press release:

Truston, a provider of award-winning online services for identity theft protection, today announced that it has partnered with Identity Force to provide its customers with Truston's online identity theft recovery and prevention services.

As Truston's web-based platform is designed to be private-labeled by partners, the myTruston features will be offered through the Identity Force member dashboard and completely integrated for a seamless customer experience. Through the use of Truston's application programming interface, the myTruston service is embedded within the Identity Force website, taking on its look-and-feel and not requiring an additional user login.

Recently, Truston was named one of the Hot Companies of 2008 by the Network Products Guide in Silicon Valley.

Tom Fragala, Truston's CEO, was himself an identity theft victim and has spent thousands of hours advocating for victims of this growing crime.

He also does a blog on identity theft, which can be seen, here.

Full press release on the Truston/Identity Force partnership, here.

0 comments

$7 billion rogue trader turns himself in

The $7 billion rogue trader has turned himself in to French authorities.

Nicola Clark of the NY Times just reported:

Jérôme Kerviel, a former trader at Société Générale, surrendered to the police on Saturday as investigators looked into what had caused the bank, one of Europe’s largest, to lose more than $7 billion.

When the story hit the wires, Kerviel's attorney stated that he would be available to speak with judicial authorities.

The $7 billion question for the authorities and the rest of us us:

The bank’s management has come under increasing pressure from French officials to provide a more detailed accounting of how Mr. Kerviel could have racked up such enormous losses by himself, over a year, without raising any red flags among either his supervisors or the bank’s internal auditors.

Many familiar with the situation are speculating that the recent problems with the stock market caused the losses to unexpectedly grow, which led to them becoming transparent.

NY Times story, here.

My original post on this (probably historical case), here.

0 comments

The $7 Billion Fraudster

(Photo courtesy of Zorg at Flickr)

Jerome Kerviel -- who may have cost his employer somewhere around $7 billion -- might prove that no security system is flawless, especially when the person compromising it has been given access to it.

Molly Moore of the Washington Post reports:

For five years, Jérôme Kerviel toiled in the back offices of Societe Generale, learning the intricacies of the six-layer security system that France's second-largest bank used to protect its money, investors and customers from fraud, according to bank officials here.

Kerviel then made an unusual career move. He was promoted to trader -- becoming one of the very employees the security systems are designed to oversee and keep honest.

Of course, no exact details (they seldom are for obvious reasons) are being given as to how Jerome pulled this off, but he is being described as a "computer genius."

I did notice in the Washington Post article that Jerome was keeping two sets of books, which is an age-old method of committing white collar crime. Jerome was also voiding transactions to cover up questionable transactions, which is hardly a new method of fraud, either.

The trader maintained two sets of books, one in which he kept accounts of his successful investments, and a secret parallel book where he was "voiding his losing positions," Bouton said.

"He knew when controls were going to take place," Bouton said, because "over the years he had become an expert in controls." Bouton said Kerviel managed to outmaneuver six levels of controls and firewalls intended to detect and prevent fraud.

Most high tech fraud is based on tried and true (even historical) methods of deception. Too often, organizations rely on computerized detection systems that might be a little too predictable. This is especially true when dealing with someone, who has been given access to them and understands how they work.

All too often, organizations are sold one form of technical protection only to find out that in a given period of time, someone has figured out how to circumvent them. Once this occurs, they need to buy another system, which might be circumvented over time, also.

Human beings are very adept at figuring out how to circumvent (hack) systems. In fact, there seems to be communities of people dedicated to hacking whatever new technology comes out.

If Jerome was able to cost his employer $7 billion dollars, he has set a new record. The person, who set the previous record is mentioned in the Post artice, and even made a quote from prison:

If confirmed, the losses at the bank would be the largest ever caused by an individual trader. They are far higher than the $1.4 billion run up by trader Nick Leeson in the mid-1990s in Singapore. His fraud caused the collapse of the institution where he worked, Britain's 233-year-old Barings Bank.

Leeson, now living in Ireland after serving a prison sentence in Singapore, told the BBC that he was not shocked such a fraud had happened again, but that "the thing that really shocked me was the size of it."

Maybe we shouldn't be so shocked? Perhaps the problem is an over reliance on systems to prevent fraud without enough human interface? Computers only do what they are told to do and it takes a human being to circumvent them.

Technology is a wonderful thing and a great tool, but when it comes to protecting anything, common sense and the human factor need to be considered carefully, also!

The Washington Post article also has some interesting speculation on how this might have had an effect on global markets. The article can be seen, here.

0 comments

It's unlikely the IRS is outsourcing tax preparation services to Russia!

Looks like with the start of tax season, the phishermen are again pretending to be the IRS.

Using a badge of authority in phishing is nothing new. In the past, we've seen the FBI, Interpol, DOJ and a lot of other official agencies spoofed (impersonated) to trick people into giving up their personal and financial details.

Here is a phishmail that got past my spam filter yesterday:

Date: Fri, 11 Jan 2008 16:02:36 -0500

From: "Internal Revenue Service" Add to Address Book Add Mobile Alert

Subject: IRS Annual Calculations - Tax Refund Internal Revenue Service United States Department of the Treasury

Dear Applicant:

After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a tax refund of $270,25.

Please submit the tax refund request and allow us 2 business days in order to
process it.

To access the form for your tax refund, please click here (link removed).

The links on these spam e-mails are designed to entice the unwary to give up their personal and financial details (later used to commit financial crimes)through social engineering techniques (trickery). Just clicking on a link can download malicious software designed to steal information from your computer (which will also be used in financial crimes) or it will turn your computer into a spam spewing zombie.

If you hover (don't click) your mouse on a link and read the address that shows up on the bottom of your screen, it will show the true address. In the above example, it reveals and address of a Russian domain (astrasong.ru).

It's unlikely that the IRS is outsourcing tax preparation services to the Russian Union!

I went to the IRS site and discovered that they just updated their Suspicious e-Mails and Identity Theft page the same day I received this phishmail.

The page has links to all their previous warnings and information on where to report phishing activity involving the IRS. Also included are government educational resources (recommended reading if you haven't seen them before).

0 comments

Democratic fundraiser Norman Hsu sentenced to three years

Norman Hsu, who used to be a major fundraiser for Hillary Clinton and the Democratic party has been sentenced to three years for fraud.

John Coté at SFGate reports:

Disgraced Democratic fundraiser Norman Hsu, who became a prolific political moneyman even as he was a fugitive from justice, was sentenced Friday to three years in state prison in a San Mateo County grand theft case that dates from the early 1990s.

Hsu was sentenced in Redwood City more than 15 years after he skipped out on his original court date and fled to Asia.

And this isn't the end of it:

He will now be transferred to federal custody to face new criminal charges in New York, where he is accused of bilking investors across the country out of at least $20million. Hsu allegedly funneled some of the money to political campaigns, including that of Sen. Hillary Rodham Clinton, while living a lavish lifestyle.

Now here is the kicker (his legal defense):

Hsu's attorneys had sought to have the 1990s case dismissed or to allow Hsu to withdraw his no contest plea, saying his right to a speedy trial had been violated because authorities made little attempt to locate him - even as he attended fundraising events and was photographed with political candidates.

His attorney is planning to appeal this conviction. Hopefully, a judge won't grant him bail again as I would guess he is probably a flight risk.

The good news is that we are starting to see a trend, where money isn't the primary factor dictating who will become the next leader.

SF Gate story by John Coté, here.

0 comments

New IRS rules dictate stricter controls on how personal information is marketed by preparers!

Last year, a large amount of fraud cases were reported when people claimed refund anticipation loans using fraudulent information.

In many instances, these fraudulent returns were filed using the earned income tax credit. The earned income tax credit returns a portion, or all of the taxes people pay, who are below a certain income level when they file their yearly tax return.

While an honorable practice in principle, the credit is targeted by fraudsters, who submit fake W-2 information and claim large refunds that they were not entitled to.

W-2's can be purchased in just about any office supply store, or even over the Internet.

Another growing trend noted -- with all the stolen identities and counterfeit identification out there -- are fraudulent tax returns being filed using other people's information. RAL refunds can net several thousand dollars each, which make them prime targets for financial fraud.

Low income people are also often recruited to go in and get these loans using "made up" information.

Guess who ends up getting caught if the IRS discovers the fraud in most instances? I'll give you a hint, it probably won't be the person who talked them into doing it.

I'm not sure if all the tax refund fraud and reported identity theft last year inspired the recently announced IRS rules, but it's probably a good guess that it had something to do with it.

The IRS is now giving taxpayers more control over their personal and financial information. They are also examining whether certain restrictions should be placed on refund anticipation loans.

The IRS press release states:

Federal law already strictly prohibits the IRS from making disclosures of taxpayer return information within its control to third parties except with taxpayer consent or in circumstances set by Congress. The final rules have no effect on the strict protection of return information in the IRS’s hands and apply only to tax return information held by income tax return preparers.

Among the new rules:

Generally, preparers must obtain taxpayer consent, either by paper or electronically depending on how the return is being filed, before tax return information can be disclosed to any third party or used for any purpose other than filing the return.

If the taxpayer consents to the disclosure and use of his information, the consent must identify the intended purpose of the disclosure, identify the recipients and describe the particular authorized disclosure or use of the information.

Mandatory language informs individual taxpayers that they are not required to sign the consent; that if they sign the consent, federal law may not protect their information from further disclosure; and that if they sign the consent, they can set a time period for the duration of that consent. If taxpayers fail to set a time period, the consent is valid for a maximum of one year.

To prevent consent requests from individual taxpayers from bring buried in fine print, the rules require the paper consent documents to be in 12-point type on 81/2 by 11 inch paper and require electronic consent requests to be in the same type as the Web site’s standard text, all to prevent consent requests from being too difficult to read for individual taxpayers.

If a taxpayer declines to provide consent for an unrelated tax preparation disclosure or use request, the preparer cannot make a similar consent request. The intent is to protect taxpayers from being pressured with repeated consent requests regarding the same issue.

Mandatory consent from taxpayers also is required if the tax information is going to be disclosed to a tax preparer located outside the United States. This provision is intended to ensure taxpayers are informed if their tax information is being sent off-shore for return preparation. The individual taxpayer’s Social Security Number also must be redacted.

The press release also states:

One issue that was raised during the comment period was the use by tax return preparers of tax return information to market Refund Anticipation Loans (RALs) to taxpayers. The issue of marketing RALs and similar products, such as Refund Anticipation Checks and Audit Insurance, was not specifically addressed in the proposed regulations.

The Treasury Department and the IRS are concerned that RALs and similar products may provide preparers with a financial incentive to take improper tax return positions in order to inflate refund claims inappropriately. In order to give the public an opportunity to comment on this issue, the Treasury Department and the IRS are issuing an Advance Notice of Proposed Rulemaking (ANPRM) that announces they are considering a proposal that tax return preparers be prohibited from disclosing or using taxpayer return information for the purpose of selling products such as RALs and similar products.

Last year it came to light that a Jackson Hewitt franchise owner with a lot of branches was being charged by the federal government for enabling this type of fraud. The dollar amount of the fraud was calculated by the government at about $70 million.

Here is the post, I wrote about this particular incident:

Is tax fraud being enabled by too many dishonest preparers?

While the Jackson Hewitt allegations were major news, it probably only accounts for a small portion of the overall fraud committed with tax returns. In previous years, we've even seen prisoners file phony tax returns from behind bars.

Dishonest preparers also sometimes try to get their customers to claim questionable exemptions. This can lead to the customer ending up in a lot of trouble at a later date.

The IRS has a educational document to educate taxpayers about this problem, here.

If you happen to know of anyone committing any of these tax frauds, the IRS has a place where it can be reported, here.

Press release on the new rules and possible restrictions on RAL products, here.

There are articles circulating in the mainstream media with more information on how this might hurt the profitability of the tax preparation industry. I'll include the one from Reuters written by Jonathan Stempel, here.

0 comments