Tue, July 15, 2008
ID Theft: Now A Wholesale Business?
As I've noted elsewhere, there are some data that suggest that the frequency of ID theft may be on the decline. However, there are also indications that the volume of stolen financial data has swelled to such levels that cybercriminals are dropping their selling prices for stolen data.
InformationWeek recently carried a Reuters report discussing the findings of an Israeli web security firm called Finjan. Based on contact established with groups trading stolen data online, Finjan has found that bank and credit card account information that once sold for $100 now goes for $10 as the market for stolen data becomes more commodity-like. Data that still sells for a premium includes medical information that criminals can use to commit insurance fraud.
Finjan has released its own press summary describing its findings. The company claims that in some quarters, at least, cybercrime has evolved into an organized structure reminiscent of a Mafia operation, with a hierarchy of criminals carrying out different functions. Some of the criminals specialize in stealing data, while others act as “fences” for stolen information. The criminals with whom Finjan’s operatives dealt even offered satisfaction guarantees for credit information that was flagged as stolen when used, promising to supply additional data.
Finjan’s chief technology officer predicts that banks will start to place a greater burden on consumers to practice computer security. Already, many financial institutions are creating layers of security for access to financial accounts online, so this may not be so far-fetched.
Currently, I’m still of the opinion that the best way to protect against identity theft is to use common sense; moreover, it’s impossible, short of closing all your financial accounts, to guarantee that your information will never be compromised. The greatest volume of identity information loss seems to be coming from security breaches at financial institutions and retailers, and consumers have no way of preventing that.
If you are truly concerned about ID theft, I think your best best is still an ID theft freeze. It will make opening new accounts a hassle, but it seems to be the strongest (and least expensive) protection against identity theft that is available right now.