Mobile Data Theft

Technology is the focal point of data breach and workplace identity theft because corporations create, transmit, and store so many pieces of information digitally that it becomes a highly attractive target. This book is not intended to address the complex maze that larger organizations face in protecting their technological and digital assets. Rather, the purpose of this book is to begin to familiarize business employees, executives, and vendors with the various security issues facing them.
The task, then, is to develop a capable team (internal and external) to address these issues. In my experience, the following technology-related issues pose the greatest data-loss threats inside organizations:

• Laptop Theft: According to the Ponemon Institute, 36 percent of reported breaches are due to a lost or stolen laptop.
• Mobile Data Theft: Thumb drives, CDs, DVDs, tape backups, smart phones
• Malware: Software that infects corporate systems, allowing criminals inside these networks
• Hacking: Breaking into your computer system from the outside, using networks, wireless connections, remote access, and your Internet pipeline
• Wireless Theft: Wireless connections to the Internet in airports, hotels, cafes, and conferences
• Insider Theft: When someone in the IT department (or elsewhere) decides to make extra money by selling your data

According to the Ponemon Institute, ‘‘Thirty-six percent of all cases in this year’s study involved lost or stolen laptop computers or other mobile data-bearing devices. Data breaches concerning lost, missing, or stolen laptop computers are more expensive than other incidents. Specifically, in this year’s study, the per-victim cost for a data breach involving a lost or stolen laptop was just under $225, over $30 more than if a laptop or mobile device was not involved.’’ Continue Reading….

The post above is an excerpt from John’s latest book Privacy Means Profit. To learn more and to purchase the book, visit our website www.ThinkLikeASpy.com.

Privacy Means Profit

Prevent Identity Theft and Secure You and Your Bottom Line

This book builds a bridge between good personal privacy habits (protect your wallet, online banking, trash, etc.) with the skills and motivation to protect workplace data (bulletproof your laptop, server, hiring policies, etc.).

In Privacy Means Profit, John Sileo demonstrates how to keep data theft from destroying your bottom line, both personally and professionally. In addition to sharing his gripping tale of losing $300,000 and his business to data breach, John writes about the risks posed by social media, travel theft, workplace identity theft, and how to keep it from happening to you and your business.

Related posts:

1. Data Breach Protection: Laptop Theft Best Practices
2. Data Breach Speaker: Organized Crime + Vendor Error
3. Workplace Identity Theft: Shredding

Protecting Your Children

Acting now on behalf of your child will protect them from consequences common to child victims:

• Starting adulthood with a credit rating low enough to scare away the hungriest of loan sharks
• Being denied a first loan, credit card or apartment rental because of a crime committed 10-15 years earlier (the passage of time makes this crime very hard to clear up)
• Being denied access to college or a new job
• Having a warrant out for her arrest for crimes that she didn’t commit

In the same way that you can’t protect your children from every bruise and scrape, you can’t entirely remove the risk of identity theft. You can, however, prevent or soften the fall if it does happen. Take these steps first:

1. Stop giving out your child’s personal information. Until you are confident that it is absolutely necessary to receive the services desired, withhold their personal information. More than 80% of organizations that ask for your child’s Social Security Number don’t actually need it to establish services. If you must give it, ask them how they will use it, how long they will keep it and how it will be protected while they have it. Vigilance is highly effective. Never carry your child’s SSN with you.
2. Order a free credit report for your child at least once a year. All three major credit reporting bureaus (Equifax, Experian and TransUnion) offer one free credit report per year per individual. Order one for your child at the same time you order yours and review them both for any red flags indicating fraudulent activity. I recommend that you order the first one (Equifax) right now; order a second report (Experian) in 4 more months; order the third report (TransUnion) four months after that and then repeat the process the following year. For a more convenient option, use an identity monitoring services for you and your family.
3. If you find evidence of fraudulent activity, contact the police, the source of the fraud and all three credit bureaus. Filing a police report helps to establish your child’s innocence in an official way. Have the credit bureaus FREEZE your child’s credit for maximum protection. Keep detailed records of all correspondence between yourself, the police, the merchant and the credit bureaus. It will come in handy should you ever find yourself in court, as I did.
4. Educate your children on the importance of protecting their personal information. Teach them about the value of their personal information: their name, address, phone numbers, email address, Social Security Number and any passwords and PIN numbers. Reinforce that they own their private information and that it should not be shared with friends, over the internet or with anyone whom they don’t know or trust. Education is absolutely the best financial gift you will ever give to them. Because you love and protect your children as much as I do, you should start this process immediately.

In the case of child identity theft, an ounce of prevention is worth a lifetime of financial security. Don’t let the center of your universe become just another statistic.

After losing his business to data breach and his reputation to identity theft, John Sileo became America’s leading identity theft expert. He speaks to audiences around the world about protecting personal and professional data. To learn more, visit www.ThinkLikeASpy.com or John’s LinkedIn Profile.

Related posts:

1. Child Identity Theft Expert – Part II
2. Child Identity Theft Expert – Part III
3. Child Identity Theft Expert: A Growing Concern – Part I of 4

If you’re thinking “this couldn’t happen to my child,” think again!

Who Does This?

The identity thief is not always a stranger. In many cases, it’s a relative with bad credit who takes advantage of a child’s pristine credit. Conveniently, these family members generally have access to the information necessary to maximize the fraud with little attention.
This seems absurd, but imagine a parent who is strapped for cash, has a bad credit score and needs to buy groceries. In this case, short-term thinking blinds the relative or friend to long-term consequences. In other instances, the child’s future is not taken into consideration at all.

Frankly, it doesn’t take much to get the crime underway; all a criminal needs is the child’s name and Social Security Number. These pieces of personal information are exposed in a variety of ways:

• When registering for daycare, schools and recreational sports
• On medical, dental and hospital records
• When joining organizations like the Girl Scouts, Boy Scouts, etc.
• When the above information is permanently stored and accessed by volunteers or employees
• When one of the above organizations is breached by a hacker or malicious software
• When an adult befriends your child on a social networking site (MySpace, Facebook) and eventually socially engineers private information out of them

The Three Basic Types of Child Identity Theft

Child Identity theft generally falls into these 3 categories:

1. Financial identity theft occurs when the name and Social Security Number is used to establish new lines of credit.
2. Criminal identity theft happens when the criminal uses the child’s identity to obtain a driver’s license or substitutes the child’s identity if caught in a criminal act.
3. Identity cloning entails using a child’s identity (via information collection or a black market ‘purchase’ of personal information) for financial, criminal and governmental purposes. The most common form of cloned identity theft is committed on behalf of undocumented workers looking for an identity that will keep them working in this country.

For parents, cleaning up the disaster of identity theft for their children is costly and incredibly time consuming. Getting a new Social Security Number is almost impossible, and rarely the best option.

Taking steps right now to protect your child from this horrible crime is one of the greatest investments you will ever make in their financial and emotional future.

Tomorrow, I will cover the steps on How to Protect Your Children from Identity Theft.

Child Identity Theft Speaker John Sileo

Related posts:

1. Child Identity Theft Expert – Part IV Protection
2. Child Identity Theft Expert – Part II
3. Child Identity Theft Expert: A Growing Concern – Part I of 4

For businesses, shredding is low-hanging fruit (one of the easiest sources of data breach to eliminate). But businesses are so often focused on electronic forms of data breach that they fail to heed the following statistics highlighted in a recent Ponemon Institute study conducted for the Alliance for Secure Business Information:

• More than 50 percent of sensitive business data is still stored on paper documents.
• Forty-nine percent of data breaches reported in the survey were the result of paper documents.
• Sixty percent of businesses admitted that they didn’t provide the proper tools (e.g., shredders) to safely discard documents that were no longer needed.
• The average data breach recovery cost according to this survey was $6.3 million.

If you own a business, make sure to destroy sensitive documents prior to discarding them, to decrease your legal liability. Businesses are required to destroy all consumer information before discarding it in the trash. The Fair & Accurate Credit Transaction Act (FACTA) Disposal Rule states that ‘‘any person who maintains or otherwise possesses consumer information for a business purpose’’ must properly destroy the information prior to disposal. FACTA further states that every person and/or business must take ‘‘reasonable measures’’ to protect against unauthorized access to the use of the information in connection with its disposal… Click Here to Continue.

Privacy Means Profit

Prevent Identity Theft and Secure You and Your Bottom Line

This book builds a bridge between good personal privacy habits (protect your wallet, online banking, trash, etc.) with the skills and motivation to protect workplace data (bulletproof your laptop, server, hiring policies, etc.).

In Privacy Means Profit, John Sileo demonstrates how to keep data theft from destroying your bottom line, both personally and professionally. In addition to sharing his gripping tale of losing $300,000 and his business to data breach, John writes about the risks posed by social media, travel theft, workplace identity theft, and how to keep it from happening to you and your business.

Related posts:

1. Document Shredding
2. Workplace Identity Theft Economies of Scale
3. Identity Theft for Businesses: Mobile Data Breach

Privacy Means Profit (Wiley) available in bookstores today!

Here are The Top 5 Reasons You Shouldn’t Buy It:

You love sharing bank account numbers, surfing habits and customer data with cyber thieves over unprotected wireless networks

You never tempt hackers and con artists by using Gmail, Facebook, LinkedIn, Twitter, Google Docs, or other cloud computing platforms to store or communicate private info, personally or professionally.

You bury your head in the sand, insisting that “insider theft” won’t affect your home or business.

You’ve already hardened your laptops and other mobile computing devices in 7 vital ways,  eliminating a major source of both personal and corporate data theft.

You have a “thing” for identity theft recovery costs and would rather invest thousands in recovery than $25 in prevention.

If you want to defend yourself and your business against identity theft, data breach and corporate espionage, then buy a copy of Privacy Means Profit.

Privacy Means Profit

Prevent Identity Theft and Secure You and Your Bottom Line

Privacy Means Profit builds a bridge between good personal privacy habits (protect your wallet, online banking, trash, etc.) with the skills and motivation to protect workplace data (bulletproof your laptop, server, hiring policies, etc.).

In Privacy Means Profit, John Sileo demonstrates how to keep data theft from destroying your bottom line, both personally and professionally. In addition to sharing his gripping tale of losing $300,000 and his business to data breach, John writes about the risks posed by social media, travel theft, workplace identity theft, and how to keep it from happening to you and your business.

Related posts:

1. Top 5 Reasons Corporations Educate Employees on Identity Theft
2. Privacy Means Profit Details Announced
3. Workplace Identity Theft: Shredding

CSIdentity Protector Tri-Bureau

Only 25%  of identity theft can be detected by traditional credit report monitoring, which means that you need a more sophisticated service than the average offering (LifeLock). If you are time starved, convenience based or just simply want a comprehensive way to detect the inappropriate use of your data, you need to enlist an identity monitoring service. It’s similar to having someone monitor your home alarm system.

Here’s a bit of background. Traditional credit monitoring only detects a portion of identity theft. The remaining theft happens on non-credit loan activities (pay-day loans, etc), as part of public records (court cases, real estate transactions, government filings, etc.), over the internet (bought and sold on identity-for-sale sites), or in relation to medical or criminal records. It is important to monitor these forms of potential identity theft as well as your credit file. CSIdentity’s Protector Tri-Bureau product wins the award for Best-in-Class identity monitoring based on 7 criteria:

1. Convenience: It emails me any time a red flag appears, meaning that I don’t have to do any extra work to keep track of my identity;
2. Technical Excellence: The engine under their surveillance hood is superior, providing a deeper scan of risks and therefore a higher chance of detecting fraud;
3. Depth of Monitoring: The service monitors your credit report at all three credit reporting bureaus as well as scanning non-credit loans (pay-day check schemes);
4. Public Document Surveillance: It monitors your public records on the internet (court documents, govt filings, etc.) in case your information is published for any reason by the government;
5. Cyber-threat Detection: It combs the internet for the buying and selling of your individual identity to minimize your data being circulated through carder sites;
6. Restoration Services: It provides IN HOUSE restoration services if your identity is stolen, meaning that you aren’t dealing with a third party in the case of theft;
7. Industry Leadership: The executives at CSIdentity are some of the smartest people I have met, and have a proven track record of being honest, trustworthy thought leaders. I wouldn’t allow them access into my personal data if I didn’t completely trust them.

Here’s how it works. Rather than waste hours monitoring all of the different potential sources of identity theft myself, CSIdentity does it for me, automatically. In addition to 24/7 credit monitoring, pay-day loan fraud, public record monitoring and theft insurance and restoration services, their CyberAgent technology monitors the internet for instances of my identity being bought and sold online. Every month, a report shows up in my email inbox letting me know if there are any areas that I should be concerned about.

If you decide to try out CSIdentity’s Protector Tri-Bureau Monitoring, enter the promotion code CSIDFRIEND at the top of the screen (this gives you a $39 discount). I receive no money if you use this code – it only benefits you.

To reiterate, no matter what Identity Monitoring Service you end up using, they should provide the following tools:
•    3-in-1 Credit Monitoring
•    Court Record Monitoring
•    Public Record Monitoring
•    Non-credit loan monitoring
•    Internet Surveillance
•    Sex Offender Reports
•    Identity Theft Insurance
•    Identity Theft Restoration Services performed in-house

Related posts:

1. LifeLock Identity Monitoring a Fraud?
2. Identity Monitoring: Credit Alerts Not Enough
3. LifeLock’s New Identity (Theft Monitoring)

Every time you establish new credit (e.g., open up a new credit card, store account or bank account, finance a car or home loan, etc.), an entry is created in your credit file which is maintained by companies like Experian, Equifax and TransUnion (listed below). The trouble is, with your name, address and social security number, an identity thief can pretend to be you and can establish credit (i.e., spend your net worth) in your name.

A credit freeze is simply an agreement you make with the three main credit reporting bureaus (Experian, Equifax and TransUnion – listed below) that they won’t allow new accounts (credit card, banking, brokerage, loans, rental agreements, etc.) to be attached to your name/social security number unless you contact the credit bureau, give them a password and allow them to unfreeze or thaw your account for a short period of time. Yes, freezing your credit takes a bit of time (maybe an hour of work), can be a little inconvenient when you want to set up a new account (that said, let’s face it, businesses want to make it as easy as possible to unfreeze your credit because they benefit when you set up new accounts and spend more money) and it can cost a few dollars (generally about $10 to unfreeze, a small price compared to the recovery costs of identity theft). And it is worth it! It’s like putting locks on your doors.

A credit freeze doesn’t affect your existing credit – it doesn’t freeze credit cards, bank accounts or loans you already have. It only freezes access to your account unless someone has a password to get in. It’s like having a PIN number on your ATM card. It also doesn’t lower (or raise) your credit score.

Since all states don’t allow you, by law, to freeze your credit, the three credit reporting bureaus have begun to offer credit freezes on a national basis. This is a major step forward in the prevention of identity theft, even if they are offering it for profit reasons (they make money every time you freeze/unfreeze your credit). If your state does not currently offer credit freezes by law, you can now apply with each credit reporting bureau individually. Regardless of where you live, freeze your credit today.

Equifax Credit Freeze
P.O. Box 105788 Atlanta, Georgia 30348
Toll-Free: 1–800–685–1111

TransUnion Credit Freeze
Fraud Victim Assistance Department P.O. Box 6790 Fullerton, CA 92834
Toll-Free: 1–888–909–8872

Experian Credit Freeze
P.O. Box 9554 Allen, TX 75013
Toll-Free: 1–888–397–3742

John Sileo became America’s leading Identity Theft Speaker Expert after he lost his business and more than $300,000 to identity theft and data breach. His clients include the Department of Defense, Pfizer and the FDIC. To bring John in to protect your next conference audience, contact his office directly on 800.258.8076.

Related posts:

1. Reading Credit Reports
2. Opting Out of Financial Junk Mail
3. Does Your Financial Advisor Protect You from Identity Theft?

In a new LA Times article security researchers Nick DePetrillo and Don Bailey have discovered a seven-digit numerical code that can unlock all kinds of secrets about you.

It’s your phone number.

Using relatively simple and some old-school techniques almost anyone can hack into your smart phone. With the new wave of cellphone applications and a lack in cell phone security, you are leaving your mobile device vulnerable to identity spies and thieves. Anyone, trustworthy or not, can create an iPhone application and with over 250,000 apps people are doing just that. How do you know that the application you are downloading and allowing to access your cellphone  is legitimate? In most cases – you don’t.

Apple says they do certify the security of every application they offer in their app store, but acknowledges that malicious applications have snuck through. The Android Marketplace and Blackberry App World place users in charge of their own security. Some of these malicious apps can track your location, read your text messages, listen to your voicemail and one was able to turn on your microphone to eavesdrop on the user.

Of course all of the application stores will remove false apps when they are aware of them, but it can sometimes be too little to late. When downloading applications do your research. Know which can be trusted and which should be avoided. If an application for a news site or game asks for permission to access your text messages your privacy reflex should go off telling you that they don’t need that information.

Always remember that common sense is your best defense against malicious attacks and identity thieves.

Read the Full LA Times Article.

John Sileo became America’s leading Identity Theft Speaker & Expert after he lost his business and more than $300,000 to identity theft and data breach. His clients include the Department of Defense, Pfizer, the FTC and the FDIC.  To learn more about having him speak at your next meeting or conference, contact him by email or on 800.258.8076.

Related posts:

1. Facebook Launches New Security Feature
2. Security Awareness Program (Lacking)
3. Data Breach Security: TJX is Our Fault!

FTC Red Flags Rule Goes into Effect June 1st, 2010

The FTC  will begin enforcing the Red Flag Rule on June 1st, which states that certain businesses and creditors must help fight identity theft as well as create an identity theft prevention plan. This applies to a very broad class of businesses: those defined as “financial institutions” and those that extend any type of credit to their customers.

In other words, if you don’t receive cash the moment you deliver your product or service to your customer, your business most likely falls under the umbrella of the Red Flags Rule. If you do any billing after the fact (i.e., accounts receivable), you are considered a creditor, and therefore in the group of companies governed by Red Flags.

This includes:

• Any Business that Extends Credit
• All Banks
• Most Brokerage Firms
• Credit Card Companies
• Mortgage Lenders
• Non Traditional lenders (utilities, dealerships, health care providers)

Building an Identity Theft Prevention Plan

According to the FTC, the identity theft prevention plan consists of four main parts:

1. Identification: The plan needs to provide a process to identify patterns, activities or transactions (i.e. red flags, hence the name) that appear to be leading to identity theft.
2. Detection: The plan needs to specifically call out processes and procedures that will be used to detect the previously defined red flags.
3. Response: The plan needs to include a process of responding to red flags as they are detected.
4. Revision: The plan should specify the process the organization will use to periodically update sections 1-3 as the threat landscape changes

The plan must cover how your organization will ensure that any company to which you are outsourcing to will be compliant. Every organization’s senior employees or board of directors must approve the initial plan and train the appropriate employees.

The FTC has also identified five main categories that an organization’s Red Flags might fall under. They are:

1. Alerts, notifications, or warnings from a consumer reporting agency.
2. Suspicious documents.
3. Suspicious personally identifying information (PII).
4. Suspicious activity relating to a covered account.
5. Notices from customers, victims of identity theft, law enforcement authorities, or other entities about possible identity theft in connection with covered accounts.

As with any new plan or program there will be bumps in the road. The FTC won’t be actively auditing organizations, but it will be investigating on the basis of reported issues, and the costs of being found non-compliant can be staggering.  Since most older and more mature organizations already have an Identity Theft Prevention Program in place, it won’t be a huge change. We have already begun to see a connection between the Red Flags Rule and a decrease in the ease with which identities are stolen out of businesses. Hopefully, this trend will continue.

In the meantime, you should get started on designing and implementing your identity theft prevention plan. For help understanding the process and other privacy issues that your and your business face, attend the Privacy Survival Boot Camp for Small Businesses hosted by John Sileo, America’s Top Identity Theft Expert.

_______________________________________________________________________

Bulletproof Your Business Against Data Breach, Identity Theft, and Corporate Espionage

Join John September 17th in Denver, Colorado for his Privacy Survival Boot Camp for Businesses. You will walk away with the Privacy Best Practices Kit:

• John Sileo’s latest book, Privacy Means Profit
• A Sample Privacy Policy to guide you through creating your own
• Guidelines for establishing Social Networking Best Practices
• A Mobile Data Protection Checklist for your laptop, smart phone, etc.
• An Action List for Implementing Red Flags Rule compliance

Seats are going fast so don’t miss this opportunity to learn first-hand how to immediately protect your profits!

Related posts:

1. Identity Theft Speaker: Red Flags Rule How-To Guide
2. Uncovering Business Identity Theft
3. Achilles 3 Fatal Business Mistakes (or How to Protect Your Heel)

Don’t Miss John  as he discusses

Identity Theft and Identity Theft

Prevention on The Bill Handel Show!

Today, February 4, 2010 at 1PM Pacific Time.

Click HERE to Listen Live!

John Sileo became America’s leading Identity Theft Speaker & Expert after he lost his business and more than $300,000 to identity theft and data breach. His clients include the Department of Defense, Pfizer and the FDIC. To learn more about having him speak at your next meeting or conference, contact him by email or on 800.258.8076

Related posts:

1. Business Identity Theft Radio Interview, Part I
2. Business Identity Theft Radio Interview, Part II
3. Identity Theft Speaker