1. 1 Office of the Attorney General Commonwealth of Virginia Identity Theft

2. 2 Outline Computer Crime Section Computer Crime Section ID Theft Statistics ID Theft Statistics ID Theft Laws ID Theft Laws ID Theft Trends ID Theft Trends ID Theft Tips ID Theft Tips Resources / Contact Info Resources / Contact Info

3. 3 Office of the Attorney General’s Computer Crime Section  Formed in July 1999  Investigate & prosecute ID theft, child exploitation, and Computer Crime Act cases  Coordinate Commonwealth’s Internet crime fighting  Assist Law Enforcement Officers & Commonwealth Attorneys  Assist with computer crime and technology legislation

4. 4

5. 5 Identity Theft Statistics Compiled by the Federal Trade Commission (FTC)

6. 6

7. 7

8. 8

9. 9

10. 10

11. 11

12. 12 ID THEFT LAWS

13. 13 Identity Theft Protection Act State Agencies Regulated (2.2-3800) State Agencies Regulated (2.2-3800) “Government Data Collection and Dissemination Practices Act” “Government Data Collection and Dissemination Practices Act” Ensures safeguards for personal privacy by recordkeeping agencies of the Commonwealth and political subdivisions Ensures safeguards for personal privacy by recordkeeping agencies of the Commonwealth and political subdivisions Virginia Code Section 18.2-186.3 Virginia Code Section 18.2-186.3 Felony for acquiring and misusing personal identifying information Felony for acquiring and misusing personal identifying information

14. 14 Identity Theft Virginia Code Section § 18.2-186.3 Virginia Code Section § 18.2-186.3 A. It shall be unlawful for any person, without the authorization or permission of the person or persons who are the subjects of the identifying information, with the intent to defraud, for his own use or the use of a third person, to: A. It shall be unlawful for any person, without the authorization or permission of the person or persons who are the subjects of the identifying information, with the intent to defraud, for his own use or the use of a third person, to: 1. Obtain, record or access identifying information which is not available to the general public that would assist in accessing financial resources, obtaining identification documents, or obtaining benefits of such other person; 2. Obtain goods or services through the use of identifying information of such other person; 3. Obtain identification documents in such other person's name; or 4. Obtain, record or access identifying information while impersonating a law-enforcement officer or an official of the government of the Commonwealth.

15. 15 Identity Theft PENALTIES PENALTIES Class 1 Misdemeanor Class 1 Misdemeanor If over $200, Class 6 Felony If over $200, Class 6 Felony If 50 or more person’s identifying info stolen, then Class 6 Felony If 50 or more person’s identifying info stolen, then Class 6 Felony Class 5 Felony if information is used to commit another crime Class 5 Felony if information is used to commit another crime

16. 16 u Name u Social Security Number u Credit Card Number u DOB u Driver’s License u Passport Number u Fingerprint u Voiceprint u Retina or Iris Image u Electronic ID Number “Personal Identifying Info” includes:

17. 17 Database Breaches Unauthorized acquisition 50 or more persons in same transaction prohibited (18.2-186.3) Unauthorized acquisition 50 or more persons in same transaction prohibited (18.2-186.3) Felony: Up to 10 years Felony: Up to 10 years Response to Choicepoint, Lexis-Nexis, DSW Response to Choicepoint, Lexis-Nexis, DSW

18. 18 Database Breach Cont. 2008 Legislation 2008 Legislation Requires companies to notify AG’s Office and affected Virginia consumers if database of personal info is breached Requires companies to notify AG’s Office and affected Virginia consumers if database of personal info is breached If over 1,000, also must notify credit reporting agencies If over 1,000, also must notify credit reporting agencies “Reasonably harmed” standard triggers notification “Reasonably harmed” standard triggers notification Without “unreasonable delay” Without “unreasonable delay” Must alert law enforcement if would impede criminal investigation Must alert law enforcement if would impede criminal investigation

19. 19 Destruction of Public Records Section 42.1-82 The procedures for the disposal, physical destruction of public records with SS #s by The procedures for the disposal, physical destruction of public records with SS #s by Shredding Shredding Erasing Erasing Otherwise modifying SS #s to make them unreadable or undecipherable by any means. Otherwise modifying SS #s to make them unreadable or undecipherable by any means.

20. 20 Credit Reporting Agencies-Notice of Police Reports Virginia Code § 18.2- 186.3:1--a new section requires consumer reporting agencies, upon notice that a police report has been filed, to note on person’s credit report within 30 days of notice. Virginia Code § 18.2- 186.3:1--a new section requires consumer reporting agencies, upon notice that a police report has been filed, to note on person’s credit report within 30 days of notice.

21. 21 Virginia Computer Crimes Act Computer Crimes Act: Title 18.2-152.1 – 152.15 Computer Crimes Act: Title 18.2-152.1 – 152.15 Computer Crimes Act Definitions Computer Crimes Act Definitions Computer Fraud Computer Fraud SPAM SPAM Computer Trespass Computer Trespass Computer Invasion of Privacy Computer Invasion of Privacy Theft of Computer Services Theft of Computer Services Harassment by Computer Harassment by Computer Using Computer to Gather ID Info (Phishing) Using Computer to Gather ID Info (Phishing)

22. 22 Fishing

23. 23 Virginia Computer Crimes Act - Phishing § 18.2-152.5:1. Using a computer to gather identifying information; penalties. § 18.2-152.5:1. Using a computer to gather identifying information; penalties.18.2-152.5:1 A. It is unlawful for any person…to use a computer to obtain, access, or record, through the use of material artifice, trickery or deception, any identifying information…Any person who violates this section is guilty of a Class 6 felony. A. It is unlawful for any person…to use a computer to obtain, access, or record, through the use of material artifice, trickery or deception, any identifying information…Any person who violates this section is guilty of a Class 6 felony. B. Any person who violates this section and sells or distributes such information to another is guilty of a Class 5 felony. B. Any person who violates this section and sells or distributes such information to another is guilty of a Class 5 felony. C. Any person who violates this section and uses such information in the commission of another crime is guilty of a Class 5 felony C. Any person who violates this section and uses such information in the commission of another crime is guilty of a Class 5 felony

24. 24

25. 25 Virginia Computer Crimes Act Phishing Variations Phishing Variations Banking Trojans Banking Trojans Website Based Website Based “Vishing” “Vishing” VOIP Based VOIP Based Spear Phishing Spear Phishing Individual Targeting Individual Targeting

26. 26 Virginia Computer Crimes Act Pharming Pharming Malicious Viruses Malicious Viruses Spyware Spyware Web Based/Personal Email Use Web Based/Personal Email Use “419” Scams “419” Scams

27. 27 Virginia Computer Crimes Act "Vishing" E-mail Example "Vishing" E-mail Example

28. 28 From: favour dickson [mailto:favourd16@live.fr] Sent: Thursday, January 31, 2008 9:43 AM Subject: ATM, From: favour dickson [mailto:favourd16@live.fr] Sent: Thursday, January 31, 2008 9:43 AM Subject: ATM, ATM, We have been instructed to pay $450,000 to you via ATM Card system. By this method, a domiciliary account will be created in your name and you will be given an account number and a pin code to enable you check and monitor your account online while an ATM CARD will be sent to you to for withdrawal from any ATM centre worldwide. There are 250 banks in the world on the " ATM International Card Operation System" you can withdraw your money from depending on the one you prefer that operates ATM withdrawer system in 149 countries and nearer to you. You are requested to contact our ATM PAYMENT CENTER. Breach in Republic of Benin Cotonou West Africa, contact person Mrs Gladys Offoer on email address gladysoffoer@gmail.com Contact her immediately so that you can be told what is require for the account to be activated as well as delivery of the card to you. Mr.Favou Dickson Director Credit Payment Department. Bell South Associates Inc United state of America ATM, We have been instructed to pay $450,000 to you via ATM Card system. By this method, a domiciliary account will be created in your name and you will be given an account number and a pin code to enable you check and monitor your account online while an ATM CARD will be sent to you to for withdrawal from any ATM centre worldwide. There are 250 banks in the world on the " ATM International Card Operation System" you can withdraw your money from depending on the one you prefer that operates ATM withdrawer system in 149 countries and nearer to you. You are requested to contact our ATM PAYMENT CENTER. Breach in Republic of Benin Cotonou West Africa, contact person Mrs Gladys Offoer on email address gladysoffoer@gmail.com Contact her immediately so that you can be told what is require for the account to be activated as well as delivery of the card to you. Mr.Favou Dickson Director Credit Payment Department. Bell South Associates Inc United state of Americagladysoffoer@gmail.com

29. 29 Common Sources of Identity Theft  Mail theft  Dumpster Diving  Unscrupulous employees  Internet Fraud  Stolen/lost wallet  Medical records with confidential information  Burglary/larceny (residential/auto)  “Friends” and relatives  Phone scams  Shoulder surfing  Unethical use of public documents

30. 30 Who Should Victims Contact? Credit Bureaus Credit Bureaus Federal Trade Commission (FTC) Federal Trade Commission (FTC) Creditors (Card Issuers & Utilities) Creditors (Card Issuers & Utilities) Local Law Enforcement Local Law Enforcement Office of the Attorney General Office of the Attorney General

31. 31 Credit Bureaus Immediately call the fraud units of the three credit reporting companies. Report the theft of credit cards, and the misuse of their account numbers. Request that their credit accounts be flagged Victims should request that a statement be added to their reports, such as: “My identification has been used to apply for fraudulent credit. Contact me at (victim’s telephone number) to verify ALL applications.”

32. 32 Credit Bureaus

33. 33 Creditors Victims should contact all creditors immediately with whom their name has been used fraudulently— by telephone and in writing. They should get replacement cards with new account numbers for their own accounts that have been used fraudulently. They should ask that old accounts be processed as “account closed at consumer’s request.”

34. 34 Victims of unauthorized use of a credit card will be liable for no more than the first $50 of the loss, although this is often waived and the victim will not be required to pay any part of the loss. (15 USC 1643.) Request that credit grantors provide the victim with a copy of all fraudulent credit applications and all statements of incurred charges.

35. 35 The Identity Theft Passport

36. 36 The Identity Theft Passport Two ways will be generated: Filing of Police Report OR Expungement of Record in accordance with § 19.2-392.2 Filing of Police Report OR Expungement of Record in accordance with § 19.2-392.2 The Office of the Attorney General, in cooperation with the State Police, may issue an "Identity Theft Passport" stating that such an order has been submitted. The Office of the Attorney General, in cooperation with the State Police, may issue an "Identity Theft Passport" stating that such an order has been submitted. The Office of the Attorney General may provide access to such information to criminal justice agencies and individuals who have submitted a court order pursuant to this section. The Office of the Attorney General may provide access to such information to criminal justice agencies and individuals who have submitted a court order pursuant to this section.

37. 37

38. 38 Office of the Attorney General of Virginia http://www.vaag.com Internet Crime Complaint Center http://www.ic3.gov Internet Crime Complaint Center http://www.ic3.gov http://www.ic3.gov Federal Trade Commission (FTC) http://www.ftc.gov

39. 39 Questions?

40. 40 Office of the Attorney General Office of the Attorney General Commonwealth of Virginia Commonwealth of Virginia 900 East Main Street 900 East Main Street Richmond, VA 23219 Richmond, VA 23219 Computer Crime Section cybercrime@oag.state.va.us http://VAAG.COM (804) 786-2071