Identity Theft Articles and News

June 15, 2010: Phony Bank of America Email:

A carefully crafted email purporting to be from BofA states

"Dear Bank of America Customer,
A scheduled maintenance has just been completed on the Bank of America system in order to improve our online banking security system to help you prevent identity theft and un-authorized access to your account. In order to keep your account active and protected, you will be required to immediately login to your account by clicking on the "Login to Bank of America" link stated below:"

I was suspicious because I had recently closed my BofA account. But everything about this email looked legitimate except for the address (URL) in the login links. When I put my cursor over each link, it showed the actual URL as something entirely different from the BofA web site address. This is just a reminder not to click on any links in an email unless you first check to see what the URL address is and compare it to the web site address of the sender when that's applicable.

May 1, 2010: The Digital Copier Identity Theft Problem:

A CBS video pointed out that most of the digital copiers built since about 2002 have disk drives that store copies of the documents in order to increase print productivity. But if the owner of the copier isn't willing to pay for an additional component to protect the data from being used by anyone other than an authorized person, the data can be retrieved by anyone familiar with the use of hard drives in copiers. Used copiers that are reconditioned and re-sold can be a substantial source of very private information such as tax returns, medical information, confidential legal information and sensitive company information. It seems that public copiers are among the highest risk copiers. For more information see Computerworld

April 1, 2010: Using Personal vs. Business Accounts for Online Banking:

Banks with outdated security systems plus banking laws that don't protect commercial accounts for Internet fraud leave small businesses vulnerable to computer hackers. Kathy Kristof suggests in the LA Times that small businesses should ignore the traditional advice to have separate bank accounts for their businesses. One reason is that personal accounts are protected but commercial accounts are not. The second reason is that security systems in some banks are outdated and don't provide enough protection from hackers. As I've mentioned in previous issues of the IWPMonitor, even if the bank has great computer security, your small business computer probably isn't well protected. And, as pointed out by Kristof, new types of more sophisticated phishing by email are targeted to the victim by name and often appear to be from someone the victim knows.

But banks won't allow a partnership, corporation or LLC to use a personal bank account even if the business is just a small one or two person business operating out of a home. And it really is not a good idea to mix personal bank transactions with a business other than a sole proprietorship. (Even then it creates accounting problems.) A solution used by some businesses is to have a separate computer that is used only for online banking and is not used to receive or send any email or to visit any web sites. So unless online banking is essential for your business, the simple solution is to avoid using it. Otherwise, spend a few hundred bucks to get a separate computer to use only for that purpose. For extra protection, get a router to connect to your Internet provider and then subscribe to a full scale Internet protection software package. For some helpful tips on data security see Data Security Made Simpler.

March 15, 2010: Facebook Security Risks:

An extensive article on computer crime in the 3/4/10 issue of USA Today explains how cyber crooks are now targeting social networking sites to gain access to personal information that is then used to trick people into downloading a file or clicking on a link that contains a program that gives control of a user's computer to a cyber crook. By gathering personal information from Facebook and other social networking sites, the bad guys send emails to "friends" with personal information that the recipient believes is coming from a relative, friend or colleague. If the friend is using a computer at work, when s/he clicks on a link or opens a file, the bad guys gain access to the company computer. Once they gain access to the computer, they can install a keystroke logger that makes a copy of every keystroke made on every computer on the network. Specialized software is then used to identify user IDs and passwords.

The risk of keystroke loggers is the reason I refuse to use any kind of online banking. The bank computers may be highly secure, but I use the Internet so much that I realize I'm not immune from getting tricked into clicking on a link that appears to have been sent to me by someone I know. The folks at Apple tell me that they rarely have any security breaches in their operating system. The reasons given are that the Apple/Macintosh computers are based on the Unix operating system which has much better security than the operating system used by most PCs. Another reason is that the Microsoft operating system is used by a lot more people than the Apple system and is therefore far more attractive to cyber crooks. Even so, that doesn't prevent me from downloading a program or a file that could compromise my computer security.

One of the points mentioned in the articles referred to below is that a lot of people use the same social networking site for both personal and business communications. That's not a good idea. I'm using Facebook purely for family and very close friends. I use Linkedin for professionals that I know, but I don't attempt to compete with anyone to accumulate a large number of contacts that I don't know. If I don't know someone who wants to connect with either my Facebook or Linkedin account, I ignore the request.

Facebook has a security page that provides up to date information about various ways that cyber crooks are trying to trick users into downloading malicious files. If you use Facebook, you can avoid a lot of potential problems by checking this page from time to time. (http://www.facebook.com/security)

An article about security tips for Twitter users is available at Twitter Security Do's and Dont's. For another article about Twitter's security problems see "Lessons from Twitter's Security Breach.

Although Linkedin was not mentioned in the USA Today article, they do have a web page with security tips. Here are a few more web pages with useful information about social networking security.

Seven Deadly Sins of Social Networking Users

Social Networks' Security Risks

Ten Social Networking Security Trends

January 1, 2010: FBAR Form is an Identity Theft Magnet:

If you haven't noticed, the Foreign Bank Account Report Form (FBAR) is an invitation to identity theft.

You are required to disclose your Social Security number, birth date, address and the location and account number of ALL your foreign financial accounts if the total of all accounts combined exceeds $10,000. The IRS is taking an extremely broad interpretation of what must be reported. And here's why it's an invitation to identity theft. Unlike tax return information that is subject to substantial restrictions on disclosure by the IRS, the FBAR form is intended to be available to all levels of law enforcement. A crook has to bribe someone in the IRS to secure copies of a tax return. And every IRS employee knows that such disclosures would lead to both termination and incarceration. But anyone who is interested could persuade an employee of a small police department or sheriff's office to request a FBAR form.

If you have more than $10,000 of financial accounts outside the U.S. at any time during the year, you are required to report ALL of your foreign accounts, including those under $10,000. The reeport requires you to provide you name, address and birth date, as well as the name, address, account number and maximum balance for each foreign account. The information in this report would be a treasure trover for an identity thief.

So if you are concerned about identity theft, you might want to avoid having financial assets outside the U.S.

Copyright, 2010, Vernon K. Jacobs