Identity Theft

6 min readJan 10, 2023

Identity theft and cybercrime go hand-in-hand, so we cannot talk about one without the other. This is an area of self protection, organization cybersecurity, and government civil and criminal enforcement.

What is identity theft

Identity theft is a crime defined by various federal and state criminal statutes.

In sum, it is when an offender assumes the identity of an individual to fraudulently obtain goods or services or commit another crime. Put another way, the criminal impersonates the victim in order to steal or commit some other type of crime.

A criminal can assume the identity of a victim (impersonate them) by using some type of personal identifying information of that victim. This personal identifying information (PII) might have a different name, and would be defined by statute, but could include things like name, address, date or birth (DOB), social security number (SSN), credit card number, username and password, financial information, and more.

The credit and personal information economy

Our personal information and credit has value to many, including the credit reporting companies and cybercriminals. An entire industry exists surrounding the lawful collection, storage, and sale of our personal information (for example, the big three credit reporting companies referenced later). Now, an entire industry exists to sell services to protect us from this crime and the improper use of our personal information (those same credit reporting companies and more).

The cybercrime and identity theft economy

There is an economy of cybercrime and identity theft responsible for billions of dollars of theft every year. Unlike the economy in the prior section, this economy is completely illegal.

Nearly every cybercrime involves some form of impersonation, and most ID theft is made possible thanks to cybercrime.

Cybercriminals steal data, including through data breaches. This data is then used to steal identities. Before that, it might be sold and resold, eventually to the criminal who will use it.

The economy relies upon criminals to pay each other, and to be able to successfully launder their ill-gotten gains. These payments are facilitated with virtual currencies and cryptocurrencies, as well as all forms of traditional value transfer.

Organizations and identity theft

Every organization plays a role with identity theft (and cybercrime) and some have legal duties.

Organizations need to make sure they are not used as tools by identity thieves and cybercriminals. Organizations need to ensure these criminals do not take advantage of lax controls in the organization to impersonate victims and commit theft and other crimes. Some of these organization may have legal duties on this, including through the Federal Trade Commission (FTC) Red Flags Rule.

Organizations also need to make sure consumer data they safeguard is protected from cybercriminals, with good cybersecurity. Data breaches provide cybercriminals with fresh supplies of consumer data that can then be used to impersonate others. So organizations need to have a cybersecurity program and reasonable cybersecurity to protect against this.

Organizations can protect themselves with good policies and practices, including use of my Five Components for Policy Work.

Individuals and protecting from identity thieves

Individuals need to protect themselves from becoming victims of identity theft. This protection requires knowledge, awareness, and some work. Consumers have rights that can be exercised for free.

Yes, there is extensive marketing and fear tactics that promise magic solutions and protection with a monthly fee, but this is generally not the case.

My prescription for protection is:

Continually improve your cybersecurity, including with my tips and Four Pillars of Cybersecurity
Obtain free annual credit reports each year from each of the three credit reporting companies
If any credit information is inaccurate, it can be disputed and corrected.
Use your credit card (not debit card) for regular purchases (assuming you are good managing your credit expenditures)
Consider a free credit freeze
Review what information is publicly available about you, and consider steps to remove it
Review and repeat

Individuals and ID theft response

If you are a victim of identity theft there are things you can do and rights you have which do not cost you anything.

Continually improve your cybersecurity
Report to the Federal Trade Commission (FTC)
Report to local law enforcement (law enforcement has jurisdiction to take a report and investigate based upon the location/residence of the victim)
Obtain free credit reports you are entitled to as an ID theft victim
Obtain free annual credit reports each year from each of the three credit reporting companies
Correct any inaccurate information or detected fraud
Consider a free credit freeze
Review what information is publicly available about you, and consider steps to remove it
Take notes
Prepare an accurate summary with all relevant information
Ensure your communications are documented, follow up a phone call with a written communication
Review and repeat

Government and identity theft

Government plays important roles in many areas, including civil consumer protection and criminal enforcement.

Privacy and consumer protection

Government plays an important role in protecting consumer privacy from the information economy, and ensuring consumers are protected from criminal use of their information.

Criminal enforcement

The cybercrime and ID theft economy is extremely profitable and also difficult to investigate and prosecute. But it can be investigated, and more offenders can be brought to justice. Government needs to do more on this front. The cases are challenging but important, and detectives, investigators, and prosecutors can learn how to do them and develop their investigative skills in the process and bring justice to where it needs to go.

Like no other criminal offense, cybercrime and ID theft is lucrative and repeated day after day over many years by criminals who hone their skills with little fear of apprehension. Government needs to change the risk calculus of these offenders. These offenders need to realize that government is trying, and eventually they will get caught.

District Attorney Robert Morgenthau created one of the first Identity Theft Units in the country, recognizing the importance of fighting this crime. Resulting cases soon demonstrated the connection between identity thieves and cybercriminals, and it was amazing what cases the unit was able to bring (including the Western Express case) even with relatively limited resources. Prosecutors need to put in the work to bring the type of cases needed to fight this crime.

Follow the money

Implicit in the above is following the money and slowing the profits that flow to criminals. Criminals commit these crimes because they are profitable, and the chances of apprehension are low.

The Western Express case

I spent many years investigating identity theft, first as a state trooper, then as an assistant district attorney. I investigated one case of a virtual currency exchanger located in Manhattan named Western Express International, Inc. This exchanger facilitated payments between U.S. based identity thieves and cybercriminals from former Soviet countries. During my many years investigating it and it’s customers from around the country and globe, I learned a lot about this space.

Conclusion

Identity theft is a pernicious and prevalent crime, tied to cybercrime, profitable and with low risk for the offenders. Organizations and individuals can play roles to protect themselves and respond to it. Government plays an important role to protect us, and needs to do better.

This article is (of course) not tailored to your circumstances, nor is it legal or consulting advice.

If you are an identity theft victim, see the resources here, and contact me if you need professional assistance.

If your organization needs help with improving its cybersecurity and identity theft protection, feel free to contact me.

Additional reading

This article was originally published on my website at https://johnbandler.com/identity-theft/ where I also include links for additional reading, and it may be more current and with improved formatting.

Posted to Medium on 01/10/2023 based on my earlier article on my website. Last updated here on 01/10/2023.