May 4th, 2003, 09:12 PM
This is my best guess of where this info belongs. Read it, love it, live it.
Identity theft is easy at best, scary statement huh? Your
identity is about as safe as an unpatched box, and ironically you are
all probably an <any key> windows user. Identity theft in the United
States is where my knowledge lies. Take what you wish from this
tutorial, discard the rest. I can not make you do any of what lies
herein , but you should at least know the risk. This tutorial is for
educational purposes only. This tutorial is not a how to, so do not
reply asking for more info on how to. I do not take responsibility for
anybody who uses the few scenarios outlined in this tutorial. This is
a touchy subject that nobody seems to talk about, until it happens to
them. On that note let the tutorial begin.
First off your social security number is the most important piece
of information you have. It is an Admin Password for your life. Fact,
with a social security number and Date of Birth I own you, screw your
box. You thought you we're uber1337 cause you can protect your
network. What about your good name, your credit cards, bank accounts,
your personal property, and more importantly your freedom?
Fact, identities are easier to hack than computers. Social
engineering is a scary thing, but it is real, and it is here to stay.
Most of you have probably been the victim of a clever engineer yet do
not even know it. You are probably sitting there right now saying this
can't happen to me, so I'll give you a few scenarios.
1:\>You are at home paying your bills via snail mail as do most of us.
You then discard the part of the statement you do not return with the
payment, which ends up in the trash. The trash ends up in front of
your house. Can we say "dumpster diving"? Fact this is legal in most
states unless otherwise posted. All I'd have to say is thought I had
accidentally discarded something into the dumpster, If I was for some
reason caught by the police. On top of that 95% of them are going to
believe the story because I am in a phreaking dumpster. Now I do this
twice a week in local apartments, and twice a week I steal whole bags
of trash from neighborhoods, and build "cases". I would discover a
gold mine of information that can and will be used for fraudulent
purposes. The biggest are your name, address, phone number, utility
account numbers, credit card numbers, and yes even your Social
Security number. You might be surprised in the frequency at which mail
arrives with your social security number on it.
2:\>You pay for a service rendered with a check. The clerk asks to see
your id to verify billing address, phone number, and yes social
security number on your id. You trust everyone don't you. We'll you
shouldn't. Don't trust anyone, PERIOD. Why? Because they maybe
careless with the information you have in trusted in them. At that
rate you might as we'll greet people with a hand shake and then give
then your wallet or purse. Know what is going to happen to your
information before you give it to anybody, PERIOD. You can protect
yourself, definitely more than you do now, I guarantee it.
3:\>You are on the internet, and you get an email saying you need to
update your info for paypal, ebay, hotmail, or any number of things.
Cookies, passwords and accounts can all be stolen. So you and I may
not fill these forms out. But, what about that person in your life
that feels it is an important and VALID request, and since they
already give this info to damn near everyone what harm is there in one
4:\>This one I will speak briefly about. I decide you are very
wealthy. Dr, Dentist, Banker, whatever. All I need is your name. I can
do like 50 searches on the net, all legal. Which will give me your
social security number, date of birth. I do have to pay a pretty penny
for this info, but it can be obtained by anybody willing to pay for
it. If Iíve already noted you to be wealthy, what is 159.95$ "starting
price" when you own a 500,000$ house, and a car for everyday of the
week. These reports, where legal, often list property, bank accounts,
and info on your family, children, and often even the hierarchy of
your family tree. Who's 1337 now?
5:\>This one can be applied in many manners. I steal your identity
with one of the aforementioned methods. I purchase a gun, in your
name, with your money. Then I rent a car and drive to the house of my
victim, carry out the murder, and take a cab out. Leaving the gun in
the car "you" rented. Even if your name is cleared "quickly" you will
still be picked up. You will still be harassed. The evidence soon to
be gathered has your "identity" all over it. See my point? This all
happens while the real thief/murder is free. Yes it has happened, and
it will happen again.
People walk around with less security on their identity than they
do with their email. PERIOD. What kind of login/passwd is
somedude69/somedude69 anyway. Your identity is no more secure than
that cordless phone you use, or for that matter the mail box in front
of your house.
Fact, The average theft is not noticed until 14 months later. 14
MONTHS is a lot of damage on your credit report.
Fact, It costs the average victim more than $1,000 to cope with the
damage from identity theft. You've already been victimized, yet you
get to pay MORE OF YOUR HARD EARNED MONEY?
"ID thieves stole nearly $100 million from financial institutions
last year, or an average of $6,767 per victim."
-Federal Trade Commission
"The U.S. Federal Trade Commission says that identity theft is
its number one source of consumer complaints - 42 percent of all
complaints, in 2001."
" Every 79 seconds, a thief steals someone's identity, opens
accounts in the victim's name and goes on a buying spree."
That was 2001 what are the figures now?
"A recent report on identity theft warned that there is likely to
be "mass victimization" of consumers within the next two years. The
report said consumers should be extra careful to monitor all their
financial transactions for unexplained account activity, withdrawals,
or fund transfers."
-The Gartner Group, a technology research group
"The July 2000 issue of Consumer Reports cited a study where more than
50% of the credit reports checked contained errors. There are two main
reasons errors may appear on your credit report. One is when you have
been mistaken for another person with a similar name and their
information ends up in your file. The other more serious cause of
error is fraud. Someone may have intentionally gained access to your
personal information and obtained credit in your name. Instances of
identity theft are increasing."
"Credit card fraud hit 1 in 20 users and identity theft hit 1 in 50
during past year, study shows : One in every 20 consumers has been the
victim of credit card fraud in the past 12 months, according to a
study to be released Monday. The same study reveals that 1 in 50
consumers has suffered identity theft. The survey, conducted by
Gartner Inc., also indicates consumers are so concerned about the
problem that they are calling for changes in the way electronic
transactions are performed."
I don't remember where I got the two previous quotes. Unfortunately
they are true.
A:\>Take all of your legal documents and put them into a lock box,
safety deposit box, legal envelope, and leave them at home. These
documents include: Drivers license, social security cards, checks,
credit cards, passports, military id's, magnetic swipe cards from your
employer, green cards, student visa's, birth certificates, ect. You've
done 100% of the work for the thief if you lose your wallet or purse,
or even worse have either stolen from you.
B:\>If your ssn is on your Id. Have it taken off. Average cost to have
an Id replaced by the issuing agency is 6$. I already mentioned the
cost of the theft. If you do not change this you've done 100% of the
work for the thief, if and when they get a hold of your ID.
C:\>Do not throw away bills, shred them, burn them, bury them, take a
marker to them, the choice is yours. You could even keep them. Don't
let me get them, you'll be sorry. I promise.
D:\>Do not setup accounts for new utilities over the phone if
possible. Your cordless, and cellular phone calls can be monitored.
Devices that can listen to both forms of calls can be easily, and
legally purchased. They are not sold for the mentioned methods, but
are capable of doing so. Go to a local office, and hand fill out the
applicable forms. Also when these accounts are setup, see if the
company has a special request option available. If they do, request
that all account info, including changes of service are done so in
E:\>Do not give your information to any unsolicited caller. If you are
contacted by somebody who "supposedly" works for such and such, they
will already have your information. If you do contact a company and
the operator asks for information specifically social and date of
birth, ask if they have an automated response system for these
questions. Many do, and they consist only of DTMF's over the line,
because the average thief is not prepared for that type of transfer of
F:\>You move into a new apartment. Your mail is in a central location
for ease of the postal employees. They are all locked, safe right? No,
not at all. I am an Identity thief, I move and hide frequently, using
apartments as bases for operation. I get evicted cause I'm not paying
the rent for somebody else. But I keep the keys for both the apartment
and the mail. Do you think they change those by default? No, too
expensive to change the locks every time somebody leaves. So request
they change both before you move in. Even at that rate most boxes are
printed in the 1000 cycle range. The boxes are all the same brand. Go
ahead see if your key will open up a neighbors mailbox. You might be
surprised at what you find. Heaven forbid these criminals get a hold
of the master locks the post office uses. My best advice, If you think
you are at high risk for any of this, get a P.O. Box, you will pay for
it, but if you don't what might the cost be?
G:\>This countermeasure is at your discretion. I suggest using it. Do
not allow auto complete in windows, turn that **** off, PERIOD. Not
only are you probably keeping lots of personal info on your pc you
probably allow the pc to remember your passwords and logins also.
Don't do this either. Fact, I steal your ebay account, sell a hot
ticket item. Tickets to the super bowl average sale price 2000$. I
only accept payment via paypal. If I have your ebay most likely I own
your paypal. If not, I own the ebay and may set up paypal. Either way,
paypal will send a check in about one week to a unverified member.
Point you ask. I sell those tickets. Have the check sent to me, you
won't notice it until it's too late. I have the money and now you get
to produce super bowl tickets, or have your ebay and paypal tarnished
due to identity theft.
I:\>This is my favorite countermeasure. If you, as do I, you write
lots of checks. Carry around an ink pad with you. Stamp your thumb
print on every check you write. Use a special ink color of ink when
writing your checks. Smear the date for example, or signature, or
both. Don't make them illegible, just a light smear enough to foil
check washing methods, and electronic reproductions of your signature.
Print on your check SEE ID FOR FURTHER IDENTIFICATION.
J:\>This one is what I strongly suggest to all of you. Call, write,
bug, bother, annoy, your local congress person. Let them know you
demand better laws. You may already be a victim but just don't know it
yet. Write up a page, based on 50 different scripts, one for each
state, and you could even submit them electronically in the masses.
K:\>Last but not least check your credit record at least once a year.
Look for things out of line, if you look in the right places you can
get these reports for free.
Things to look for when protecting your identity.
Your monthly bill for your credit card doesn't come any more. Or you
seem to be missing mail.
You receive a call or letter saying you've been approved or denied for
an account or card you never asked for.
A collection agency calls wanting their money for services or products
you never received. You think they've just got the wrong John Doe, and
do nothing, then the problem only gets worse.
Human nature is based upon repetition, and trust. Those are your two
biggest flaws, if you have these built into your day to day life, you
may already be a victim.
Already A Victim
I would say it is a must that you contact these three major credit
bureaus, when you discover your identity has been stolen. You must
request that a "fraud alert" be placed on your account. This places a
sort of hold on any new approvals for new accounts in your name.
these three are as follows:
P.O. Box 740241
P.O. Box 2104
760 Sproul Road
P.O. Box 390
Springfield, PA 19064-0390
The aforementioned numbers are to the best of my knowledge direct
The rest of these links are numerouse people to contact if you have
been victimized. I strongly urge you to contact all of them at least
Ten easy steps if you feel you have been a victim.
this link will take you to a list of states, so you may see what your
state is doing to protect you, if anything at all.
this link however kind of redundant, will take you to a list of state
contacts. A much more user friendly listing, but it does contain some
more info also. Including local attorney's, congress, and governor
contacts for the state accordingly.
Non-Profit Organizations that will be glad to assist are as follows:
Privacy Rights *************
3100 5th Avenue, Suite B
San Diego, CA 92103
Identity Theft Resource Center
P.O. Box 26833
San Diego, CA 92196
Federal Government Agencies however powerful, are often the least
helpful. The power lies in the people. See that your congress person
s/he, is fighting for stiffer punishments for convicted offenders, and
stronger protection for you the consumer.
Federal Bureau of Investigation
Federal Trade Commission
Identity Theft *************
600 Pennsylvania Avenue, N.W.
Washington, DC 20580
Social Security Administration
SSA Fraud Hotline
P.O. Box 17768
Baltimore, MD 21235
U.S. Postal Inspection Service
Your heart was talking, not your mind.
May 4th, 2003, 09:16 PM
dopeydadwarf, This is a nice introduction and nice reference on a hot subject. Thanks.
May 5th, 2003, 04:05 AM
OK, you REALLY know how to make people paranoid!!! Thanks for the info and heads up, I'm gonna take my SIN card the heck outta my wallet right now! Then I'm gonna buy a safe, and a paper shreader, and a tempested moniter, and throw out my cordless phones, and not talk to you! ;-) (BTW, my name is Joe Shmo and I live, umm, in a little box in the middle of the street in front of CSIS headquarters!)
Alcohol & calculus don't mix. Never drink & derive.
May 5th, 2003, 05:50 AM
Words from a loss prevention agent on the subject
Very nice post.
Now let me scare you people a little bit more.
I work as an undercover retail loss prevention agent. We are the guys who catch the shoplifters, purse snatchers, and throw people out of the fitting rooms for haveing sex. In short I deal with the most petty of crimes on a day to day basis. Further more I am your ONLY line of defence aginst credit card fraud.
Let me say that again,
Once a crook gets your personal Information the only thing that can stop this person from destroying your credit is little old me. Wanna know why? Because retail outlets give less then a damn about credit card fraud. Because of the HUGELY inflated prices most mall stores charge for there goods they can write CC fraud off. On average it takes me 40 - 60 hours of research in our local computer system before I can safely say that a CC fraud has occured before the charge back report lands in my office. That means that I can spend a week of time researching a "subject" account and only have enough to say "yup thats most likely a fraud". Needless to say my "boss" would rather have me chaseing INTERNAL Theft (till tappers, and friends who give out "hook ups").
But lets say i decide to say F*** the system and chase a suspected CC fraud. After I have a pretty good suspect account i get to start the real fun.
I have to sit and watch 40 CCTV cams and HOPE that the guy im looking for comes in on my 8 hour shift and trys to buy something with one of the accounts I consider suspect. THEN should that happen I have to contact the "True name victim" (sometimes a guy 2000 miles away that barely speaks english,)on the phone and get confermation that he/she wants this scum bag put in jail before I can even say hello to the crook in question. In short MY HANDS are tied from start to finish by our system of Laws. In 1.5 years of work I have managed to Nail 3 CC frauds for a total value of 120,000 bucks. I assure you people that I only catch the dumbest 1% of these people. Now here is where it gets even better, most salesman (eg circut city, rat shack, sears) Give even less of a damn about you then retail stores do. They LOVE CC frauds. They will sale $4000 to a CC fraud and get paid there comission check before the charge back comes home to roost. And they would NEVER consider working with a CC fraud now would they? Come on these are honest sales people.
Now it gets even better. ALL you need to open a "rapid credit" account is a SS# and a drivers licence. Period. Who gets to check the Drivers licence and make sure its not a fake ID before the account is opened... the salesman. Thats right, the guy who does not make 1 penny unless he sales something, gets to check and make sure that the ID he is given is not a fake. It costs 10$ to get a "novelity" ID in the city I live in and I assure you people that a bouncer at a local bar looks at an ID better then a salesperson. When I DO happen to get an ID which i KNOW is fake guess what, the police will not even RUN the ID to tell me it is a fake unless they arrest the person. Meaning: I HAVE TO ARREST SOMEONE TO MAKE SURE THERE ID IS A FAKE. My company policy will not allow me to arrest someone on those grounds and I AGREE WITH THEM. Should I happen to mistake a fake ID for a real one, guess who gets sued and fired. So pretty much ANY ID is valid as far as retail outlets are concerned.
THE SYSTEM IS COMPLETELY BROKEN!
After my dealing in loss prevention i have closed every CC account I have, and have PURPOSELY paid bills late to lower my credit rateing to where NO ONE will give me credit. I now carry ONE secured credit Card that has a 300$ Limit. THAT IS HOW BAD IT IS PEOPLE! I dont work for the media or the police dept and I have no problem telling it like it is. I deal with this CRAP on a day to day basis and it makes the Hacker/security battle look TAME. The police REFUSE to get involed because of privacy laws, and in fact have there hands tied too.
As it stands right now CC FRAUD/Ident Theft are UNTOUCHABLE CRIMES for anyone that has an IQ of over 110.
The question is not can I get away with it, it is HOW MUCH can i get before i have to get a new identity to destroy. I know this may seem a little crazy but I HAVE SEEN THIS STUFF HAPPEN, and it happens all the time in malls.
YOU PUT YOUR ENTIRE FINACIAL FUTURE AT RISK EVERYTIME SOMEONE SEES YOUR SS NUMBER.
THIS IS A FACT AND I DARE ANYONE TO ARGUE WITH ME ABOUT IT.
HEED this post people, the crooks right now are in control of your money. There are so many ways to get a $$# from someone that it makes me sick, and you can thank your federal gov't for the mess we are in right now. Do everything you can to protect you SS# but understand that you are never going to be safe unless some SERIOUS changes occur. If anyone would like to discuss this further I would love to open the dialouge. firstname.lastname@example.org
Be safe everyone, it is a SCARY situation.
Free Speach is nothing but a giant noose. If you are dumb enough to stick your neck into it, then you had better be prepared for someone else to choke your mouth shut.
May 5th, 2003, 01:28 PM
You are exactly right. More often then not the thief has more rights than the victim.
I did leave one countermeasure out. When you sign your debit cards, and credit cards. Sign them with your signature and also write SEE ID on them. The reason for this is it is easier to clear your name if you have impleminted methods for protecting yourself. Make sense?
Hope everybody enjoyed this tutorial. Look for more in the future.
Your heart was talking, not your mind.
May 25th, 2003, 03:39 AM
Very Interesting Posts here guys.. thought provoking..
Reason: Yesterday someone stole my Identity.. They returned it today
"Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr
May 25th, 2003, 08:12 PM
It is a very easy practice, even easyer when they buy products online. Ive seen credit card bills in excess of 5k because their method of verifacation is a phone number, WHICH YOU CHOOSE, you could choose a pay phone for all they care. Its a horrible system, and its only going to get worse
The Hack Back Revolution
June 4th, 2003, 02:41 AM
And I thought I was paranoid about my network. Now I've got to go get a paper shredder and kill anyone who might have my SSN.
But, joking aside, very informative posts, dopeydadwarf and blunuke420. I'm going to start thinking twice about a lot of things now.
June 4th, 2003, 02:48 AM
thanks for the informative post. i already use all my bills and receipts in the company shredder, sometimes, when i shred, i feel like an anderson
June 7th, 2003, 02:17 AM
D@mn you can get paranoid by this tut , I mean that in a good way . Thankyou, I am now more informed about Identity theft.