Common menu bar links

Feature Focus: Identity Theft and Identity Fraud in Canada

For the purpose of this Feature Focus, the term identity theft refers to the collection, possession, and trafficking in personal information, which typically takes place independent of, or in preparation for, the commission of identity fraud. Personal information of value to thieves includes: name, address, age, gender, credit card numbers, income, employment, payment and health records. The term identity fraud refers to the use of personal information, without the person’s knowledge or consent, to commit various crimes under their name such as fraud, theft or forgery.

The RCMP Commercial Crime Branch defines identity fraud as the unauthorized acquisition, possession or trafficking of personal information, or, the unauthorized use of information to create a fi ctitious identity or to assume an existing identity in order to obtain fi nancial gain, goods or services, or to conceal criminal activities.

Criminal acts associated with the misuse of another person’s identity information are current offences under the Criminal Code, including impersonation and forgery. However, the collection, possession and trafficking of identity information is not currently against the law and as such, the Canadian government is working on legislation to amend the Criminal Code in the area of identity theft. This new legislation will provide law enforcement and the legal community with new tools to deal with the offences of collection, possession and trafficking of identity information (identity theft).

YVAN DELORME, DIRECTOR, MONTREAL POLICE SERVICE
“Economic crimes such as fraud, debit or credit card cloning and identity theft are costly for society as a whole. Furthermore, with advances in technology, a wealth of economic, personal and corporate data may become available to criminals who have developed the expertise required to make use of it.”

How Personal Information Can Be Stolen
Identity thieves steal personal information in a number of different ways, taking advantage of many everyday transactions that require individuals to share personal information for identification purposes. Two common and simple techniques are mail theft and ‘dumpster diving’. Personal data can be collected by stealing mail from residential mailboxes, whereby a fraudulent change of address can redirect the victim’s mail to another location, facilitating identity theft, while victims are unaware that personal documents are being compromised. Furthermore, recycling bins and dumpsters at home or in the office, containing personal documents that have not been shredded can be targets of dumpster diving. Stolen and lost wallets, credit, and bank cards can provide identification and break-ins in search of personal information in homes or vehicles do occur. Public resources can help thieves to complete personal profiles, including access to public records, newspapers, and phone books. Obituaries and tombstone data can also provide relevant information.

COMMONLY TARGETED DATA NAME, HOME ADDRESS AND PHONE NUMBERS; WORK ADDRESS AND PHONE NUMBER; DATE OF BIRTH, SOCIAL INSURANCE NUMBER; DRIVER’S LICENCE, BANK AND CREDIT CARD ACCOUNT NUMBERS; PASSWORDS, STATEMENTS AND CREDIT REPORTS; TAX RETURNS, GOVERNMENT-ISSUED CHEQUES; AND PASSPORTS

Another illicit technique to collect information consists of posing as someone else in person, on the telephone or online to mislead legitimate businesses and organizations into providing desired information. Moreover, fraudsters will try to obtain information directly from their victims by pretending to be a legitimate representative who has a legal right to the information such as a bank or government official.

Most Canadians, close to 9 in 10, are at least somewhat concerned about falling victim to identity theft.

Source: EKOS Research Associates, 2008

Information technologies that host personal information provide another way for thieves to collect personal information. Information can be extracted from lost or stolen personal electronic devices such as laptops, personal digital assistants (PDAs), and cell phones. Thieves can collect personal information that individuals share voluntarily online, but also use spyware, malware and viruses to hack personal or business computers and databases to retrieve needed information.

Canadians have serious concerns about the safety of their personal information: 2 in 3 worry that it is vulnerable to physical theft and 1 in 2 thinks that it is not adequately protected by computer systems.

Source: EKOS Research Associates, 2008

On a larger scale, technology enables businesses and government to collect and store vast quantities of personal and financial data in databases. Under privacy legislation, government and businesses have to put systems in place to ensure that this information is secure and used only for the purpose for which it was collected. However, security breaches do happen. In some cases, losses of data occur and other times, co-opted employees can steal and sell large files with personal information. Compact computer equipment makes it possible to copy, store, transmit and carry files containing private information without being easily detected.

Other techniques used by criminals to trick people into divulging personal or financial information include: ‘brand spoofing’, wherein fraudulent websites imitate those of legitimate businesses; ‘phishing’, e-mail scams and ‘voice phishing’, which prompts people to call a telephone number set up with a message system that sounds legitimate.

Other sophisticated techniques involve the modification of automated banking machines or point-of-sale terminals to allow criminals to record the debit or credit card numbers by ‘skimming’ this information as it is entered by the cardholder. In some cases, pinhole cameras have been used to capture the personal identification number (PIN) of the victim.

Organized Crime Involvement in Identity Theft & Identify Fraud
Identity theft and identity fraud represent high profit potential for organized crime groups with a relatively low risk of detection and prosecution. While a number of criminal groups in Canada are involved in identity fraud, some individuals with technological and criminal knowledge have also been known to efficiently commit such crimes on their own. Lower-level criminal groups are usually involved in activities related to identity theft, while mid- to higher-level criminal groups are involved in identity fraud.

Groups involved in identity theft and identity fraud are mobile, as they will often reside in one province and work across a number of different provinces, as well as target individuals abroad and in the US. In Canada, these crimes take place in urban and rural areas with the majority of incidents reported in B.C., Ontario and Quebec. Some criminal groups specialize in a particular aspect of identity fraud, such as creating identify profiles, manufacturing fraudulent identification or ‘skimming’ payment card data. Not all stolen data is used for the purpose of identity fraud by those who collect it. Lists of stolen personal information from potential targets can be stored for long periods of time before being shared, exchanged or sold to other groups. Moreover, individuals that offer critical skills to organized crime groups are able to provide methods and technical expertise that facilitate identity fraud.

Organized crime groups use identity theft to further their criminal agenda, for financial gain and to avoid detection by law enforcement. With each piece of personal information collected, organized criminals build stolen identities that are useful to them in a number of different ways. Stolen identities, including a legitimate name and birth date, can be used to apply for fraudulent bank accounts, credit cards, and loan applications. In turn, this fraudulent financial file can support further applications for driver’s licences, social insurance numbers, and other identification documents.

About 1 in 10 Canadians reports having been a victim of identity theft, and an additional 1 in 4 says that they know someone who has had this happen to them.

Source: EKOS Research Associates, 2008

CHIEF RICK HANSON, CALGARY POLICE SERVICE
“The only way we can effectively combat organized crime is with a good understanding of the problem and a commitment to working together to alleviate it. The Calgary Police Service is committed to working with other policing agencies to address this issue in our communities.”

Once assembled, stolen identities provide organized crime groups with a clandestine vehicle to secure goods and services from the legitimate economy and to commit wider crimes such as payment card fraud, cheque fraud, mortgage fraud, insurance fraud, bank fraud, and passport application fraud.

Who Is Affected
The Canadian Anti-fraud Call Centre (CAFCC) reported 10,366 complaints from identity theft and identity fraud victims with losses totalling more than $6 million in 2007 and losses of more than a million dollars in the first quarter of 2008. CAFCC estimates the numbers represent a very small percentage of the actual figures. It is reported that middle-aged Canadians, aged 35 to 54, are the most affected by credit or debit card fraud or theft. Nevertheless, everyone is exposed to the risk of identity theft and identity fraud and every year thousands of Canadians are victimized.

Target Group: Youth and Children
Young people are the most vulnerable targets of identity thieves online. Some use online social networking sites (e.g. Facebook, MySpace) on a daily basis and are part of multiple online communities, where they post detailed personal profiles, sharing a vast amount of personal information. In 2007, the US Federal Trade Commission reported that a growing number of victims are under the age of 18, of which half are under the age of six. Child identity theft can represent a new target group as this type of crime can be undetected for a long period of time.

Victims of identity theft and identity fraud face long-term consequences such as debt and damage to their credit rating and reputation. Once the personal data of an individual is compromised, recovering from identity theft and identity fraud can be a lengthy process. This, in turn, could make it difficult to obtain loans, find employment, and to interact with governmental and private institutions. It can take some time for victims to recognize that their identity is compromised and frauds have been taking place. In addition, the violation of privacy can cause the victim considerable emotional distress. Past victims face a bigger risk of re-victimization, which can be a financial and psychological burden.

3 in 10 Canadians have changed their spending habits over concerns about fraud and theft.

Source: Ipsos Reid, 2007

Apart from financial losses, commercial and financial institutions face increased scrutiny regarding their ability to protect personal information. The trust in businesses and financial institutions can be damaged, which can in turn affect the confidence of consumers and investors in the Canadian economy. Government programs and services can also be affected when illegitimate applicants use false identities to obtain official government documents or benefits.

Case Studies The following two case studies are taken from actual police cases involving identity theft and identity fraud. The names have been changed or omitted to protect the identities of those involved. An individual attempted to purchase $5000 worth of merchandise by applying for an in-store credit card under the name of Joe Smith. He was able to provide store personnel with three pieces of identification which appeared to be valid, including a Canadian passport, a SIN card and business licence. He also made previous attempts to obtain a cellular phone and open a bank account under Joe Smith’s name at a major bank. When police contacted the real Joe Smith, he stated that he had never lost or had stolen any of his identification or credit/debit cards. The suspect was never identified or charged. An individual was stopped after an attempt to cash a fraudulent cheque at a cheque-cashing outlet. On arrest, the individual was in possession of several pieces of photo identification bearing different names, dates of birth and addresses. Subsequent investigation revealed that this individual had been using at least three different identities for several years, had outstanding arrest warrants, and had been arrested and charged under each name. The individual had been using the identity of family members from different jurisdictions and had obtained social assistance under these names. The individual was charged with numerous counts of fraud.

Are you a Victim?

The signs can be many, but typical indicators that your identity is being used include:

A creditor informs you that an application for credit was received with your name and address, which you did not apply for. Telephone calls or letters state that you have been approved or denied by a creditor that you never applied to. You receive credit card statements or other bills in your name, which you did not apply for. You no longer receive credit card statements or you notice that not all of your mail is delivered. A collection agency informs you they are collecting for a defaulted account established with your identity and you never opened the account.

Source: The Canadian Anti-fraud Call Centre

Tips to Minimize the Risk

1 2 3 4 5 6 7 8 9

Before you reveal any personally identifying information, find out how it will be used and if it will be shared. Pay attention to your billing cycles. Follow up with creditors if your bills do not arrive on time. Guard your mail. Deposit outgoing mail in post office collection boxes or at your local post office. Promptly remove mail from your mailbox after delivery. Ensure mail is forwarded or re-routed if you move or change your mailing address. Utilize passwords on your credit card, bank and phone accounts. Avoid using easily available information like your mother’s maiden name, your birth date, the last four digits of your SIN or your phone number. Minimize the identification information and number of cards you carry. Do not give out personal information on the phone, through the mail or over the Internet unless you have initiated the contact or know whom you’re dealing with. Keep items with personal information in a safe place. An identity thief will pick through your garbage or recycling bins. Be sure to tear or shred receipts, copies of credit applications, insurance forms, physician statements and credit offers you get in the mail. Give your SIN only when absolutely necessary. Ask to use other types of identifiers when possible. Do not carry your SIN card; leave it in a secure place.

Source: The Canadian Anti-fraud Call Centre

Conclusion