1 1 Impact of Identity Theft on Commercial Card Programs and How to Protect Your Organization Breakout Session # 511 Name: Bruce E. Sullivan, VP/Head Government Services, Visa, Inc. Date: Tuesday, July 20, 2010 Time: 2:30pm–3:45pm Who’s in Your Wallet? Putting a Face on Identity Theft!

Albert Gonzalez May 2008 – 40 million cards – 130 million cards http ://

Identity Theft vs Identity Fraud True identity theft is the exposure of personal information and typically happens when your personal information is taken by another individual without your explicit permission. Identity fraud is the actual misuse of information for financial gain and occurs when criminals take illegally obtained personal information and make fraudulent purchases or withdrawals, create false accounts or modify existing ones, and/or attempt to obtain services such as employment or health care Identity Fraud Survey Report, Javelin Strategy & Research, February 2009

 Account take-over - Compromise of existing account information  Establishing new accounts - Use of your personal information to open new accounts What is Identity Fraud?

Identity Fraud  11 Million Americans (increase of 25%)  $54 Billion in losses (increase of 12.5%)  $373 out of pocket losses)  21 hours of your time to resolve (decrease by 33%)  43% caused by lost wallet, checkbook, cards  13% of victims identified friends, family, employees as perpetrator (50% of theft where victims knew who) Identity Fraud Survey Report, Javelin Strategy & Research, February 2009

What is Identity Fraud?  Use of your personal identifying information – it’s not always about money  It occurs when someone steals your personal information e.g., credit card or Social Security number, drivers license – and uses it fraudulently  It can cost you time and money  It can destroy your credit and ruin your good name

Are you at Risk?  How many people have their Social Security Card with them?  How many placed checks in the mail prior to this trip?  How many people have 4 or more credit/store cards?  How many people do their banking on-line?  How many people have turned off their paper statements?  How many people have reviewed their credit report in the last 6 months?

What can you do?  DETER Deter identity thieves by safeguarding your information  DETECT Detect suspicious activity by routinely monitoring your financial accounts and billing statements  DEFEND Defend against identity theft as soon as you suspect a problem

Where do thieves get your information? Identity thieves may:  Go through your trash or “dumpster dive”  Steal your wallet or purse  Steal your mail and/or submit a change of address form for your mail

Identity thieves may:  Steal personnel records from their employers  Obtain personal information from your computer - Virus’, file sharing, spyware  Use “phishing” or fake s to get you to provide personal information Where do thieves get your information?

2008 Spam volumes peaked at over 150 billion messages per day. Attack spam peaked at 33% of all spam (50 billion/day at peak!) Literally millions of legitimate Websites are now hosting malicious code (i.e., MySpace, Facebook, Bebo) Use “phishing” or virus’ to get your personal information *Marshal8e6 Security Threats: and Web Threats By Marshal8e6 TRACELabs January 2009 Where do thieves get your information?

A Secure Way to Receive Your Tax Refund After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $ Please submit the tax refund request and allow us 3-9 days in order to process it. A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline. To access the form for your tax refund, please click here Note: For security reasons, we will record your ip-address, the date and time. Deliberate wrong inputs are criminally pursued and indicated.click here Regards, Internal Revenue Service Copyright 2008, Internal Revenue Service

Beware of s Malicious Spam Using Dramatic Subjects to Lure Victims Serena Williams threatens Judge Michael Jackson is Alive Clinton says Hilary cheated on me Olsen twins caught nude on camera Playboy party invite Man goes berserk in office Brad Pitt strips naked for Playgirl Homeless man wins lottery

Identity thieves may:  They get your information from the businesses in a practice known as “business record theft” (customer, employee, patient or student; bribing an employee who has access to your files; or “hacking” into electronic files). Where do thieves get your information?

They get your information from businesses “hacking” into electronic files. DAILY BRIEFING May 1, 2006 Hackers access personal information on TRICARE servers By Daniel Pulliam Hackers gained access to the Pentagon's health insurance information systems, compromising the personal information of more than 14,000 people…

 This device can capture over 2500 credit card account numbers, expiration dates and CVV codes in the palm of your hand.  The unit can operate continuously for 40 hours on a single 3V battery (6000 swipes).  Skimmed data can be downloaded to any PC with software provided.  At a moment’s notice, or the moment of arrest, the contents can be deleted with the press of a button to avoid prosecution.  Cost = $500 And An Old Favorite – “The Skimmer”

False fronts on ATM terminals with built in magnetic stripe readers. Hidden camera captures PIN and transmits the information to a nearby crook Increasingly common They skim or otherwise obtain your card information

Sniffing devices installed in ATMs are another example of how a fraudster can compromise the ATM or Debit card PIN. In this example, the PIN and magnetic stripe information are captured before encryption. Recent cases have Bluetooth transmission to remote receiver. ATM – Environment – Cont’d

Offline Versus Online Methods of Access Causes Of Known Theft

DETER identity thieves by safeguarding your information.

 Shred financial documents Before discarding them  Protect your Social Security number  Don’t give out personal information unless you’re sure who you’re dealing with Deter

DETER  Don’t use obvious passwords  Keep your information secure  Use a Firewall, Virus Protection, Anti-Spyware Software  Carry only the identification information and credit and debit cards that you’ll actually need.

To Freeze or not to Freeze DETER

Restricts access to your credit report. Once a consumer initiates a credit freeze with a credit bureau, the freeze prevents the Bureau from releasing a consumer report (i.e., a credit report) about that consumer unless the consumer temporarily lifts or permanently removes the freeze. A credit freeze may help prevent identity thieves from opening new accounts in consumers’ names, because businesses typically will not extend new credit (or provide certain other benefits) without first viewing the consumer’s credit report. Does not affect your credit score. It will not protect you from theft on current accounts – only new ones! Who can Freeze? In some states, anyone can freeze while in other states, only identity theft victims can. Cost? Many states make credit freezes free for identity theft victims, while other consumers pay a fee – typically $10. Placing, temporarily lifting, and removing a credit freeze would mean contacting each of three credit reporting agencies, and paying the fee to each one. What is a credit freeze?

 If you are deployed away from your usual duty station and do not expect to seek new credit while you are deployed, consider placing an “active duty alert” on your credit report. An active duty alert requires creditors to take steps to verify your identity before granting credit in your name.  An active duty alert is effective for one year, unless you ask for it to be removed sooner. If your deployment lasts longer than a year, you may place another alert on your report.  To place an active duty alert, or to have it removed, call the toll-free fraud number of one of the three nationwide consumer reporting companies. (Check under “Defend” in this brochure.) The company you call is required to contact the other two.  The law allows you to use a personal representative to place or remove an alert. Active Duty Alerts:

Are you Safe? Take the Test!

DETECT suspicious activity by routinely monitoring your financial accounts/billing Statements… and credit reports.

DETECT  Be alert – Mail or bills that don’t arrive – Denials of credit for no reason  Inspect your financial statements – Look for charges you didn’t make

DETECT  Inspect your credit report – Law entitles you to one free report a year from each Nationwide credit reporting agencies …if you ask for it Online: by phone: ; or by mail: Annual Credit Report Request Service, P.O. Box , Atlanta, GA

DEFEND against identity theft as soon as you suspect a problem.

DEFEND  Contact Fraud Department of Creditors.  Review reports carefully, looking for fraudulent activity  Close accounts that have been tampered with or opened fraudulently  File a police report  Place a “Fraud Alert” on your credit reports  Contact the Federal Trade Commission

WHERE CAN YOU LEARN MORE? Identity Theft Clearinghouse Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC ftc.gov/idtheft 2009 Identity Fraud Survey Report: Consumer Version Prevent – Detect – Resolve February 2009

Are you a Victim? Professional help available! ID-HOTLINE, victims can receive free and confidential assistance from trained counselors.

Changing Our Bad Habits  Don’t carry your Social Security Card with you – if you must carry a document with it--- be extra cautious!  Don’t use checks - but if you must - deposit them in secure mail boxes …and destroy them properly!  Reduce the number of credit/store cards or secure those you are not using!  Bank on-line! And turn off paper statements!  Properly set front and back firewalls and use anti-virus/spyware – update frequently!  Review your credit report every 4 months!

Stay Vigilant