Introduction

Over the centuries, the term ‘identity theft’ has meant many things. People have pretended to be other when committing crimes to avoid sentencing. Identities have been stolen in order to obtain certain medical care or drugs that would be unavailable otherwise. In this day and age, identity theft has become synonymous with finances. Thieves all over the world are using various methods to gain access to your money; and they’re more successful at it now than ever before. According to a 2013 Javelin report, 13.1 million people in the United States suffered financially because of identity fraud. According to multiple reports, that number is expected to rise in 2014 and beyond.

As we get smarter about how financial identity theft is committed, criminals become smarter about gaining our sensitive information. When we became good about shredding old credits cards and bank statements, they used e-mail and phone schemes to coax us into giving our information to them. Companies invest millions of dollars into new technologies meant to keep criminals out of databases, and criminals simply bypass these obstacles with combinations of cutting-edge and archaic techniques. It’s a vicious cycle that seems to have no end. So how can we as consumers protect ourselves from these identity thieves? Consumers must take a more active role in their financial lives, especially when it comes to online transactions. People often rely on stores and banks to protect their identities online. This is a huge mistake, as 97 percent of companies are getting breached. A problem this widespread is not one that can be taken lightly. And we at SERGS security group want to be one of the extra layers of security you use to protect your financial identity. We cannot guarantee that your information won’t be stolen at some point. No one can. But by monitoring online activity, communicating with financial institutions, and educating clients about fraud we can help limit or eliminate financial damage done by these thieves.

Purpose and Scope
The purpose of the report is to inform young professional seniors in San Francisco State University of the dangers and risks of identity theft before graduating, and how to protect their identity personally and professionally.

Procedures
Primary data was collected by SERGS Security in the form of quantitative surveys as well as qualitative customer feedback reports.
Data was also gathered from secondary sources including:
UTICA
BROWN
Technometrics
FTC
USDOJ

Key Findings

What is Identity Theft
Identity theft is one of the fastest growing crimes in the United States. In 2013, 13.1 million consumers suffered identity fraud – the second highest level on record, and it is increasing year over year (See figure1). There are many definitions of identity theft, however this type of crime typically involves illegally utilizing somebody else’s personal information for both personal and or financial gain.

Figure 1
Identity Theft Forms

Non-Technological Forms

Mail Theft
Under US Code - Section 1708, the opening of mail not directly addressed to you is an unlawful Federal offense, punishable by law, this offense is most commonly referred to as mail theft. The punishment for mail theft can be anywhere from a fine or up to 5 years in federal prison. Unwatched mailboxes are a hotbed for identity thieves to obtain sensitive documentation such as credit card bills, insurance information, utility bills, bank statements, preapproved credit cards, and paystubs, for their own personal gain. “Even if you receive credit card offers which you have not authorized, mail thieves may intercept these mail offers and set up a credit card in your name if they have enough information on you.” Identity theft criminals will often use documentation such as utility bills to re-route your mail so that they may continue to obtain personal identifiable information and financial records. At times, identity theft criminals have been known to re-route your mail without your knowledge or permission by submitting a change of address to the post office.

Dumpster Diving
Similar to identity theft, dumpster diving occurs when someone goes through someone else’s garbage in order to obtain personal identifiable information off items found in the trash. Thieves will often search for sensitive financial records, bills, and insurance information. This has become a much easier crime to commit since trash and recycling cans will sit on the sidewalk the night before their trash pickup. Since the sidewalk is public property, you are not protected when someone goes through your discarded trash.

Subscription Fraud
Subscription fraud happens when someone signs up for service (e.g., a new phone, extra lines) with no intent to pay. Often times this will occur as a result of mail fraud or dumpster diving, after the criminal has already submitted a change of address to the post office and is receiving your mail regularly.

Shoulder Surfing
Shoulder surfing may occur anytime you use a password to access an online account or a device where you are required to enter your PIN number, such as at an ATM. In this case, the identity thief attempts to get close enough to you so that when you enter password information, such as a PIN number, the thief is able to see over your shoulder and document your password or PIN. While this typically occurs in a public setting, where the victim is and their credentials are in plain sight, it may also occur through a video camera set up by the criminal. Under the guise of the victim’s identity, identity theft criminals may use this information to access your personal and financial bank accounts. This is most dangerous when paired with mail theft or wallet snatching.

Stealing Personal Items
One of the more dangerous forms of identity theft comes from purse and wallet snatching. While credit purchases can usually be recovered, debit card purchases are often more difficult since thieves need a PIN number to clear a purchase. If a victim is carrying their social security card in their wallet at the time of theft, recovering ones identity can be quite grueling and extensive.

Social Engineering
According to UTICA, “Social engineering is the practice of someone either in person, over the telephone, or computer, uses means to deceive someone else into divulging sensitive information.” Oftentimes this occurs when the attacker already knows some information about the victim, which they then use to deceive the victim into believing they are legitimate representers of the victims bank, creditor, or insurance provider. Commonly referred to as a “con game,” social engineering is perpetrated by “con-men”. Unlike hackers, who manipulate loopholes within a technological framework, social engineers exploit human interaction within the system. In this case the fraudster pretends to be someone he or she is not, such as the account holder, or a phone repair person, to access a customer's account. Recently, this technique has been used by "pretexters" in some high-profile cases of accessing phone records to spy on fellow board members and reporters.

Technological Forms

Credit Card Theft
Credit card fraud is an element of identity fraud. It can have far reaching effects, since the information on the card can be used to perpetrate other types of identity theft crimes. From using the signature on the back of a card that is stolen, to loaning a credit card to a friend or family member can cause someone to obtain what they need to open another credit card accounts or bank accounts in the victim’s name.

Skimming
This can happen anytime you use your credit or debit card. The theft occurs when the device which reads your credit card information from the magnetic strip on the back of the card records you’re the information the card’s code numbers to another electronic storage device. This enables the criminal to make a copy of your card to make unauthorized purchases. Skimming can occur through a number of different ways, whether it is a recording device set up on an ATM machine or a salesman who secretly swipes your card onto his personal digital card reader.

Pretexting
Pretexting occurs when a thief has done prior research on your personal information, and uses this information to bait you to release more sensitive information, such as a credit card number or Social Security Number. The schemer will call you on the telephone, and lead you to believe they are a business that requires this information. Most people tend to believe them, since they have their name, address, and telephone number.

Man in the Middle Attack
This type of theft involves criminally intercepting communication between two parties and recording the information without the two parties ever knowing about it. The criminal then uses this information to access accounts and possibly steal the user’s identity.

Phishing Schemes
These are the most common types of computer identity theft schemes. In these types of frauds, the thief tricks you into giving your personal identifying information. Criminals are able to do this by installing malicious software or physically stealing personal information off your computer. These types of attacks occur through a number of different mediums including cell phone messages, Internet social networks, emails, text messages, and standard mail.

Malware Based Phishing
This scheme occurs when the thief attaches a harmful computer program made to look helpful onto emails, websites, and other electronic documents on the Internet. This type of computer program is called malware. The malware uses key loggers and screen loggers to record your keyboard strokes and sites that you visit on the Internet. The malware sends the information to the schemer who is located at another location using the Internet. These attacks have been responsible for recent major security breaches at companies such as Home Depot and Target.

Search Engine Phishing
This type of phishing occurs when thieves create websites that contain “too good to be true” offers, services, and other incentives. The website is legitimately indexed into search engines such as yahoo or Google so that during the normal course of searching for products or services individuals can find these offers. Once the individual access the website the user is given incentives and persuaded in such a way that the individual becomes susceptible to give up his or her personal identifying information to take advantage of the offer being given.

Vishing
This scheme is also known as “voice phishing.” It occurs when the thief contacts an individual over the telephone. In this instance, the schemer poses as an individual working for a legitimate organization such as a government agency, a financial institution, a payment services organization, or another well-known company. The goal is to get you to disclose your personal identifying information.

Another tactic used is to make pre-recorded messages urging you to contact a certain phone number. A popular technique in this form of the crime is to pose as a bank alerting the victim to fraudulent charges.

SMiShing
In this scheme, the identity thief sends spam text messages posing as a financial institution or other legitimate entity. The text message has a sense of urgency, and can scare you into thinking there is a serious emergency by leading you to believe you will suffer financial losses or fees if there is no response. This may lead you to disclose personal identifying information by clicking on the link that appears on the text message.

Pharming
This can happen when a hacker tampers with a website host file or domain name system so that URL address requests are rerouted to a fake or spoofed website created by the hacker to capture personal identifying information from victims. The victim then thinks that they are on a trusted website, and are more willing to enter their personal information, such as credit card numbers, social security numbers, and addresses. The hacker then uses that information to commit identity theft.

Home routers are frequently targeted for pharming attacks. The hacker installs a fake version of the router’s firmware that behaves almost identically to the original one. The settings page of the router and firmware appear to be the same as they were before the attack. Especially in home cases, these invasions can be next to impossible to detect and lay dormant until a user enters sensitive information.

Keystroke Logging
Keystroke logging is what identity thieves use to secretly track the keys on your computer keyboard as they are struck. Not a big deal if your daughter is typing a report on Spain, but much more so if you’re typing in passwords, PINs, or other personal information thieves can then use to steal your identity.

What to do to Avoid Being Targeted

“Nothing will guarantee that you will never become an identity theft victim. With the widespread availability of personal information and the increasing exposure from data breaches, the risk is ever-present. But there is much you can do to protect yourself, your family, and your business…Robust prevention activities can limit your chances of becoming a victim of identity theft.” 9

Although there is no guarantee that you will never fall to some sort of identity theft, you can take preventive measures to lower the risk, and to mitigate possible damage before it occurs. Since you now know, why and how identity theft is committed, it is a great time to learn how to lower the chances of becoming prey.

Safeguard Your Information
SSN fraud is extremely dangerous, it serves as the key to all your financial, and personal information, and often it is the beginning point for fraud.

Be vigilant with copies of your SSN, and make sure to destroy them when they have served their purpose. It is in-fact extremely important to shred all sensitive information, as your trash is most likely easily accessible by anyone.

Never carry unnecessary items in your wallet, especially forms of identification. This includes unneeded credit cards.

When asked to provide sensitive information such as the SSN, do not be afraid to question about how, and by whom the information will be used. This includes all of your personal information such as, the date of birth, mother's maiden name, etc.

Cancel unnecessary credit cards, and monitor the rest. This will help you catch fraudulent charges, no matter how small.

Try to stick to a three credit card maximum as it will be easier to monitor.

Let your credit card issuer know when, and where you are traveling.

Do not do the following
Never give out your credit card, or personal information to people who call you, no matter how legitimate they sound.
Never write down the pin numbers on your credit/debit cards.
Never keep your account information in an easily accessible place.
Never carry any “cheat sheets” with your passwords in your wallets.

DO the following
Keep receipts.
Purchase a shredder, and shred all the sensitive materials.
Review financial statements each month, this may help you identify fraud, in a timely manner.
Review your credit reports
You can find a free credit report website on http://www.ftc.gov/, which at the moment is annualcreditreport.com 10
Never give out your credit card information on a free credit report website, you are legally entitled to one free credit report per year.
Purchase a locking mailbox, or retrieve mail as soon as possible after delivery.
You can ask the USPS to hold mail during time away from home, so the mail does not accumulate, they will hold your mail from three, to thirty days, free of charge.
Be cautious of ATM's- some could be defaced (Skimming)
Opt out of sharing your information (FTC) http://www.ftc.gov/ 10
It is important to destroy Hard drives before discarding your electronics, because all of the stored information will be easily accessible by anyone.
Privacy screens will help in dealing with shoulder surfing by making the screen unreadable at certain angles. 12
If you get something that looks like a lottery material from a foreign country through the postal mail, take it to your local postmaster, where they will assess legitimacy of the letter. 9
Internet Safety

Phishing
Install and keep the firewall on your computer updated, it is a very important tool in defending your machine from unauthorized access. 12
Best way to combat phishing is to only open emails, links, and attachments from trusted sources. 11
Pay attention the the website URL, if unsure, you could report suspicious websites, and emails to phishing@visa.com 11

Digital Wallets
Safeguard sensitive data, and know who to call if there are issues, before anything happens.

Online
Keep all your software up to date.
Use pop-up blockers to reduce the chance of clicking a malicious link.
Only download files from trusted sources, and only on trusted machines.
Sign up for email/text alerts from your bank, and keep track of your purchases.
9 http://www.utica.edu/academic/institutes/cimip/idcrimes/prevention.cfm
10 http://www.usa.gov/topics/money/identity-theft/prevention.shtml
11 http://www.visasecuritysense.com/en_US/preventing-fraud.jsp
12 http://www.consumer.ftc.gov/articles/0060-10-ways-avoid-fraud

Steps to Take if You have Been Victimized
Even if you are very careful about your personal and financial information you still can become a victim. But if you are diligent about checking your banking accounts, monthly bills, and review your credit report periodically, you will detect identity theft early. Early detection makes the process of correcting accounts and credit problems much easier.
The steps you will need to take to recover from identity theft depend on the type of fraud that occurred to you. For example if you notice in your monthly statements an error on an existing credit card, monthly bill or financial account. The following steps should be taken if you discover that your identity has been stolen:
1- Act immediately if you notice any error in your statements and call companies with affected accounts.
2- If you have been victimized, close compromised accounts.
3- If you review your monthly statement and find an item you wish to dispute, call the credit card company immediately.
4- Contact the fraud departments of the three major credit bureaus and place a fraud alert in your file as well as a credit freeze. If you think someone has misused your personal or financial information, call one of these companies and ask them to put an initial fraud alert on your credit report. Here are the three major companies: a- Equifax b- Experian c- TransUnion Placing a fraud alert is free. The initial fraud alert stays on your credit report for 90 days. You must provide proof of your identity. The company you call must tell the other companies about your alert. (FTC)
5- Order copies of your credit report. Get your credit report and check for inquiries that you do not recognize and any new accounts opened in your name. Because new accounts may take up to six months to show up on the report, continue to monitor your credit report. Get the 3-in-1 Credit Report and see your credit history as reported by the three major nationwide credit reporting companies that I mentioned above.
6- Report the crime to the police or sheriff's department that has jurisdiction in your case and request a police report. Though the authorities are often unable to assist you, a police report may be necessary to help convince creditors that someone else has opened an account in your name.
7- Submit an Identity Theft Report with the Federal Trade Commission, which is charged with handling most identity theft complaints (FTC). Call the FTC's identity theft and file a complaint. The FTC does not resolve individual consumer problems itself, but your complaint may lead to law enforcement action.
8- Document the events and your actions in writing and keep the records in a safe place. You should document the time and money you spend relating to the theft. Because recovering from identity theft can be a long and complicated process, it's important to keep a record of all communications. Send all letters by certified mail and keep copies. If you think your case might lead to a lawsuit, keep track of how much time you spend dealing with the problem.(USDOJ)
9- Contact the local post office if you suspect your mail has been redirected do to an identity thief submitting a change of address form.

Steps for Other Types of Fraud That May Occur

Fraud Using your Social Security Number
Contact the Social Security Administration if you suspect your Social Security Number has been used fraudulently. Also, if your Social Security number has been used to commit identity theft, contact the Federal Trade Commission (FTC). You can order a copy of your earnings and benefits statement to check whether someone has used your Social Security number to get a job or to avoid paying taxes.

Fraud Involving Your Driver's License Number
If your driver's license number has been used to open accounts or verify checks, contact your state's Department of Motor Vehicles.

Fraud Involving Your Passport
Notify the U.S. State Department's Passport Services Department of the identity theft so that it can intercept anyone ordering a new passport in your name.

Fraud Involving a Business Scam
If the fraud was perpetrated as part of a business scam, contact the National Fraud Information
Center at 800-876-7060.

Bankruptcy Filed Using Your Name
If someone filed for bankruptcy using your name, write to the U.S. Trustee in the region where the bankruptcy was filed. A listing of the U.S. Trustee Program's Regions can be found at www.usdoj.gov/ust, or look in the blue pages of your phone book under US Government: Bankruptcy Administration. Your letter should describe the situation and provide proof of your identity.

Important Contact Information
There are a number of helpful services to help you respond if you have been a victim of identity theft. Below is a list of resources that we have compiled.
Federal Trade Commission's Identity Theft Hotline
877-IDTHEFT (877-438-4338)

Equifax fraud division
800-525-6285

Experian fraud division
888-397-3742

Trans Union fraud division
800-680-7289

When Contacting the Credit Reporting Agency, You Should Request the Following:
Instruct them to flag your file with a fraud alert including a statement that creditors should get your permission before opening any new accounts in your name.
Ask them for copies of your credit report(s). (Credit bureaus must give you a free copy of your report if it is inaccurate because of suspected fraud. ) Review your reports carefully to make sure no additional fraudulent accounts have been opened in your name or unauthorized changes made to your existing accounts.
NOTE: In order to ensure that you are issued free credit reports, we strongly encourage you to contact the agencies DIRECT LINE. We do not recommend that you order your credit report online.
Be diligent in following up on your accounts. In the months following an incident, order new copies of your reports to verify your corrections and changes, and to make sure no new fraudulent activity has occurred.
If you find that any accounts have been tampered with or opened fraudulently, close them immediately. To ensure that you do not become responsible for any debts or charges, use the ID Theft Affidavit Form developed by the Federal Trade Commission to help make your case with creditors.
Software programs that execute keystroke logging, and then transmit the data to identity thieves for storage, can be downloaded onto your computer through email attachments, links, or fraudulent websites without you knowing they’re there.

Services Offered by SERGS Security Group
It's essential that you use a trusted service for your ID theft protection that stands behind its service with a guarantee or insurance. SERGS Security Group searches multiple records for misuse of your personal data. It will also have convenient, helpful customer service for quick setup and assistance if you need it as well as someone who will work closely with you in the unlikely event that you are victim of identity theft while under our watch. Below are services we provide to our customers:

Security
SERGS Security Group will be able to react quickly to potential threats. We will have means to alert you of any potential issues. We also will post fraud alerts on your credit card as well.

Recovery Assistance
Although it's best to never need recovery assistance, it's essential that you find a service that provides concrete and well-practiced procedures to help minimize damage in the event that someone steals your identity. SERGS Security Group will be able to provide you with the specific steps it takes to freeze your credit cards, alert your banking institutions, notify credit bureaus and so forth.

Information Protection
SERGS Security Group protects more information than others do. While most companies monitor credit reports, we offer additional services to protect other documents and data. Identity theft is more than a financial concern. Criminals can use your personal information to hide their own identity. If this is a concern to you, SERGS Security Group covers criminal and public records.

Help & Support
An identity protection service is only as good as its customer support. SERGS Security Group will have prompt and helpful support that you can reach at any time. Information and education is on our website www.SERGS.com.

Additional Features
SERGS Security Group includes extra features to help you prevent ID theft, such as removing your name from mailing lists. We also offer specialized plans to help you keep your entire family safe from identity theft. SERGS Identity Theft Protection puts your good name under lock and key. If you are concerned about the safety of your identity, join SERGS Identity Theft Protection.

Conclusion
Identity theft crimes can affect individuals where it matters most, disrupting their personal and financial activities. Considering the sensitive nature of these crimes across the globe and the vulnerability of the average person to become a victim, it is of the utmost importance for individuals to protect themselves. Becoming familiar with common methods of identity theft and ways to prevent them can result in massive savings in terms of time and financial resources. Protection from identity fraud can be achieved through a combination of diligent and vigilant maintenance of financial and personal information as well as utilizing the services of a security firm such as SERGS.
At SERGS, we strive to provide our clients with individualized measures to protect and maintain their identity both online and offline. Our global services are provided in an effort to prevent our clients from becoming victims of identity theft as well as provide emergency support for our clients who believe they have been victimized. As technology advances and more personal and financial services are taking place online and through cellular phones, it is increasingly important for individuals to maintain and protect their most valuable assets, their identities. Recommendations The following recommendations have been designed in order to better prepare young professionals to protect their identities and maintain control of their personal and financial information. Protect your online identity: The recent shift of consumer attitudes towards online services as a result of an increase in environmental consciousness, coupled with added convenience and security, allows for online predators to find new prey every day. Users of online services such as social media, online shopping, and banking websites must practice vigilance to ensure that they are not falling victim to the aforementioned techniques of identity theft online. Practice vigilance in filing and disposing of sensitive materials: While many personal services are offered online and the use of physical bills and statements is not as often as it once was, post mail is still widely used for correspondence containing sensitive information. The proper disposal of unnecessary materials containing the name, address or any other sensitive personal information limits an individual’s exposure to identity theft. Keeping organized files for documents pertaining to sensitive information also reduces the chances of personal information falling into the wrong hands. Use a trusted service: Although the risk of being affected by identity theft has been rapidly rising, many individuals cannot find the time or resources to take the necessary measures to protect themselves from being victimized. The process of retrieving one’s identity in the case of a theft can also be very daunting, requiring the victim to overcome numerous bureaucratic hurdles and obstacles involving different financial institutions and government agencies. Through using a trusted security service, individuals can minimize their exposure to risk as well as rest easy knowing that they are protected in the case of their identity being compromised. Services such as those offered by SERGS security group provide clients with cutting edge security measures to protect them from being victimized as well as access to a team of specialists to help retrieve the compromised information.