Identity Theft Expert Speaker; Is Tracking Your Money Online Too Risky?

Identity Theft Expert Speaker Robert Siciliano www.IDTheftSecurity.com

Is Tracking Your Money Online Too Risky?
Mint, Wesabe Claim Security, Convenience
Charlie Triemert, Staff writer

Tim Johnson, 30, says he wanted to do a better job of organizing his family’s finances.
“I just wanted to see how much money we had. I have a Roth IRA and some investments from my grandparents. My wife and I both have 401(k) from our jobs. My wife has a substantial amount of 401(k) from her previous job, as well.”
Tired of the paper clutter, Johnson went out and purchased a version Intuit’s Quicken for around $50.
“It was a little expensive but it helped us gain a better perspective of our finances,” Johnson said.

With the economy in its current funk, more people are turning to online money management tools. Free financial software sites such as Mint, Moneycenter and Wesabe are enjoying an increase in users.

Mint’s founder and CEO, Aaron Pratzer, says more than 625,000 people currently use his budgeting and money management site.
The biggest obstacle for these free financial sites is assuring users that their information is safe and secure.
“I’ve heard a little bit about free financial software options, but I like knowing our information is safely stored on my computer at home,” Johnson said.

Are They Safe?
“There will always be an opportunity — whether from the inside or the outside — for a hacker to get in,” says Robert Siciliano, chief security analyst for OneYou, a Web site that protects consumers from identity theft.

Before entering any sensitive information onto a site, Siciliano says consumers should understand each site’s policies in the event there is a breach.

“It’s important to know who ultimately is responsible for any security failures and what their policy for retribution is,” he said.
On Mint, you never share your name or Social Security number. Also, there is an option that will send a text message if there is an expensive purchase made on your credit card.

“If anything, Mint will help you keep an eye on suspicious activity,” Pratzer said. Pratzer said that even in the event your account is accessed by someone else, the amount of damage they could inflict is minimal. “You can’t move money from account to account on Mint, so they wouldn’t be able to do much,” Pratzer said.

Siciliano said financial sites — whether they are free or not — are required to have the software and encryption methods to protect users.

“As a consumer, I would try my best to understand their revenue model and how they are paying for all that security,” he said.

Free And Accessible
Besides being free, Pratzer said, the best thing about his site, “is that allows you set a budget.

Moneycenter and Mint both allow users to create categories and subcategories for budgeting. Because all of your bills can be computed, users can set goals and the system will offer ways to help attain them.

One of the best features online financial sites offer is accessibility. With an Internet connection and a browser — or sometimes just a mobile phone — you can access all of your financial data.

Help With Taxes
With all your financial information in one place, filing your taxes is a whole lot easier.
“If you’re traveling to New York for business, Mint allows you print off all your business-related expenses, Pratzer said.
Because each site has their financial tools available online, there’s no downloading or software you have to deal with. You’ll always be dealing with their most updated version.

If you upload your credit card information into Mint.com’s system, it will calculate the amount of interest you’re paying and notify you if could save money with another credit card.

This is also how Mint pays for its services. But Pratzer said the system will give you the best rates results regardless of sponsorship.

Mint allows users to set their retirement goals and offers tools to help them reach it. “It’s sort of an automatic financial advisor,” Pratzer said.

Copyright 2008, Internet Broadcasting. This material may not be published, broadcast, rewritten or redistributed.

The story Is Tracking Your Money Online Too Risky? is provided by LifeWhile.

Identity Theft Expert Speaker ; Regulators:Thanks PCI, but we’ll take it from here

Identity Theft Expert Speaker Robert Siciliano www.IDTheftSecurity.com ; Regulators:Thanks PCI, but we’ll take it from here

Much has been said since PCIs inception. The following article does an excellent job of summarizing the crux of the issue. Unfortunately for the credit card industry and retailers as a whole, PCI is considered (and I believe) a self serving entity to stave off government intervention. Its hard to fathom that the end may be near for PCI due to their self serving image. While significant effort has been made to change the way data is processed, there has been a lack of effort regarding implementing technology’s necessary to identify, authenticate and and make all accountable for the credit they have been authorized.

Government intervention will be a good thing for PCI. Heres why, most government officials know nothing about security. Politicians as a whole are clueless regarding most issues they are confronted with and have staff to brief them on the issues. Key word “BRIEF”. Worse, they interpret everything based on how it can get them re-elected.

This all means that PCI will sit in front of congress answering stupid questions that they have to be prepared to answer. They will have to go beyond the call of duties to satisfy some of the dumbest people on earth. That will require incredible due diligence.

January 9, 2009 – 3:20 P.M.
Regulators:Thanks PCI, but we’ll take it from here
TAGS:data breaches, data security, PCI, regulators, retail security
IT TOPICS:Government & Regulation, Security

The Payment Card Industry Data Security Standard (PCI DSS) being pushed by the major credit card companies has probably done a lot to stave off state and federally mandated controls for protecting customer credit and debit card data up to now. The big question as a new year begins, is for how much longer though?

More than two years after the PCI standard went into broad effect, data breaches involving payment card data continue unabated. Obviously it would have been unrealistic for anyone to have expected them to stop altogether just because of PCI. And it’s impossible to know how many compromises were averted because of the standard.

Even so, the number of data compromises involving payment card data being disclosed by businesses is only increasing, not decreasing. One reason is simply that state breach notification laws are forcing companies to disclose compromises that in the past they might not have. Another is the continuing lack of visible enforcement of PCI which has resulted in an environment where many companies, including large ones, are still not fully compliant with the mandate.

And that’s a problem for those hoping that a private industry initiative such as PCI alone will be enough to keep lawmakers at bay for much longer.

Already Massachusetts and Nevada have passed laws requiring companies to encrypt all sensitive customer data and implement measures for controlling access to it. The Massachusetts law, which seems to have a lot of people anxiously reviewing their security measures, was supposed to have gone into affect Jan 1 but has been pushed back to May 1. Nevada’s law went into effect on October 1.

As far back as May 2007, Minnesota passed a law known as the Plastic Card Security Act. Under the statute, companies that suffer data breaches and are found to have been storing prohibited credit or debit card data on their systems will have to reimburse banks and credit unions for the costs of blocking and reissuing cards. Attempts at passing similar legislation-most of which are sponsored by financial institutions–have so far failed in places such as California, Texas and elsewhere. But all its going to take is for another major retail breach or two for them to be revived.

The security requirements spelled out in these statutes are mostly the same as those mandated under PCI though they cover other data classes as well such as Social Security numbers and bank account information. The key difference is that the mandates in Massachusetts and elsewhere are coming from a government agency and carry the full authority of state law. Companies that suffer data breaches and are found to have been noncompliant with the regulations could find themselves exposed to greater legal and financial issues than the PCI standard generally provides for.

Here again, everything will depend on how vigorously these mandates are enforced. But it probably is going to be a whole lot riskier for companies to simply pretend like they are doing something, as at least a few appear to be doing, with PCI.

Identity Theft Expert Speaker; Why Technology Won’t Prevent Identity Theft

www.IDTheftSecurity.com Why Technology Won’t Prevent Identity Theft http://online.wsj.com/article/SB123125633551557469.html?mod=googlenews_wsj

Identity Theft Expert Speaker; TJX Hacker Sentenced To 30 Years In Turkish Prison

Identity Theft Expert Speaker Robert Siciliano CEO www.IDTheftSecurity.com comments;

WOW WOW WOW!! Ever see the movie “Papillon” with Dustin Hoffman? “Yaz” is screwed. Justice is served. Criminal Hackers, Carders globally are scratching their collective heads. Coordination by authorities cooperating worldwide is truly getting impressive.

It still bothers the heck out of me that the creditors make it so easy for a criminal to use a stolen card number. Over time, up and coming technology’s, if adopted will begin to solve the problem.

TJX Hacker Sentenced To 30 Years In Turkish Prison

Member of wardriving gang gets hard time for allegedly selling hundreds of thousands of stolen credit cards and personal information
Jan 08, 2009 | 01:49 PM

By Kelly Jackson Higgins
DarkReading
A Turkish court has sent one of the TJX hackers to prison for 30 years for his role in a rash of war-driving WiFi hacks on retailers that resulted in the theft of more than 40 million credit and debit cards.

Maksym “Maksik” Yastremskiy, 25, from Ukraine, was allegedly responsible for tens of millions of dollars in data theft worldwide. He’s one of 11 men charged with stealing more than 40 million customer credit and debit card numbers from OfficeMax, Barnes & Noble, Sports Authority, Forever 21, DSW, BJ’s Wholesale Club, and TJX. Yastremskiy was arrested outside of a Turkish nightclub in 2007 during an undercover operation.

The gang, which spanned the U.S., Ukraine, China, and Estonia, reportedly “sniffed” out vulnerable WiFi networks of various stores and installed malware that lifted customers’ data and credit card numbers.

“Thirty years is, of course, a very severe prison sentence for anyone to receive, and one that should give some people reason to reflect,” blogged Graham Cluley, senior technology consultant for Sophos, who also warned cybercriminals that authorities are getting better at cooperating worldwide to catch them. “Stop now. The rewards for cybercrime can sometimes be large, but you are at risk of ruining the rest of your life — and causing years of misery for your family and friends.”

Identity Theft Speaker Expert; Data protection trumps threat pursuit in SMBs’ 2009 security spending

Identity Theft Protection Expert Speaker Robert Siciliano www.IDTheftSecurity.com comments on;

Data protection trumps threat pursuit in SMBs’ 2009 security spending

Lovely. A “full percentage point”. Enterprise networks continue to get harder dropping millions into security. SMBs are investing a full percentage point, which if you didnt already chuckle is like saying “we are doing NOTHING”. If your financial portfolio manager told you “Im going to increase your portfolio a full percentage point” would you keep him? Its just not satisfactory. Criminal Hackers are winning and this is why.

HERE:

By Linda Tucci, Senior News Writer
06 Jan 2009 | SearchCIO-Midmarket.com

IT executives at small and medium-sized businesses (SMBs) will spend a full percentage point more of their IT budgets on security in 2009 than 2008, according to a new study from Forrester Research Inc. The change will result from a shift in security strategy from computer security threat defense to corporate data protection.

Identity Theft Expert Speaker;SENATORS GREGG AND FEINSTEIN INTRODUCE BIPARTISAN MEASURE TO COMBAT IDENTITY THEFT AND PROTECT PRIVACY

Identity Theft Expert Speaker Robert Siciliano www.IDTheftSecurity.com comments

Grandstanding is when politicians get up on a podium and tie in their name with laws that may get them re-elected. This particular piece of legislation has that smell. Identity theft protection and identity theft prevention begins with authentication and finishes with accountability. Putting a band-aid on the issue will not solve the problem. Beef up Real ID and lock down credit as we know it.

Here:

WASHINGTON – Yesterday, U.S. Senators Judd Gregg (R-NH) and Dianne Feinstein (D-CA) introduced bipartisan legislation to curb the growing epidemic of identity theft by making it harder for criminals to steal another person’s Social Security number. The measure, entitled the Protecting the Privacy of Social Security Numbers Act, prohibits the sale or display of Social Security numbers to the general public without an individual’s consent. It also requires government agencies to take steps to protect Social Security numbers from being displayed or accessed. In the past, this bill has been approved by the Senate Judiciary Committee, although the Senate has yet to pass it.

Senator Gregg stated, “As online activity and identity theft continues to increase, Congress must redouble its efforts to guard personal identifying information. An enormous amount of information is tied to a person’s Social Security number, and I’m pleased, once again, to join with Senator Feinstein to help keep it safe from fraud or other harmful uses. Our bipartisan legislation establishes strong, common sense prohibitions on the sale and display of Social Security numbers. This measure will help to protect against identity theft and enhance the privacy of all Americans, and I look forward to working with my Senate colleagues on getting it signed into law this Congress.”

The legislation would:

· Prohibit the sale, purchase or display of a Social Security number by any person without the number holder’s consent.

· Restricts the display of Social Security numbers on public records published on the Internet or in electronic form.

· In limited circumstances (such as for credit checks or law enforcement purposes), the bill would permit legitimate business and government uses of Social Security numbers.

Identity Theft Expert Speaker; Panel proposes expanded privacy in public records

Identity Theft Expert Speaker Robert Siciliano www.IDTheftSecurity.com Comments;

Most of the comments by those polled below are legitimate concerns fraught with desperation and  lack of understanding of the problem.  The proverbial cat is out of the bag. Privacy is dead. Privacy is an illusion. While the masses say they want privacy, the reality is they want cheap goods and convenience. People will give up all their privacy for a free candy bar. While government can and should redact personal data and do what they can to sure up “private information”, the data is already out there. It is up to the individual to understand this and manage their circumstances.

The next generation is growing up via social networks. “Privacy” will be associated with words or phrases such as 8-track tape or “No Doc Mortgage”.

So when someone calls you with your dossier and they use this to extract even more data or to threaten you in some way know what is happening and how. Even if every SSN was redacted, that wouldnt stop identity theft.

HERE;

“Panel proposes expanded privacy in public records”

Iowa governments would have greater authority to black out personal information from public records under proposals recommended by a legislative committee.

Advocates say the proposals would protect citizens from identity theft.

But opponents say the unintended results could be alarming, particularly if the public is unable to differentiate between, for example, a convicted sex offender and another citizen with the same name.

“The public has more to fear from government records containing information about them of which they are unaware than the release of information pertaining to them,” said Bill Monroe, executive director of the Iowa Newspaper Association.

Lawmakers formed the Identity Theft Prevention Study Committee, which met in November, to consider how the release of personal information in Iowa could make residents vulnerable to identity theft.

Public concern heightened this year when privacy advocates complained about a land records site, IowaLandRecords.org. The Social Security numbers of thousands of Iowans from all 99 counties were listed on the site, including those of Gov. Chet Culver and Secretary of State Michael Mauro.

Administrators of the site quickly shut down the ability to view details of the records after the advocates pointed out the problem. The group says removing personal information from all the records – called redaction – will cost the state as much as $2.3 million, which includes $500,000 to update its computer programs.

Culver said in an interview this week that he agrees steps should be taken to redact personal information from public records that can be used to steal Iowans’ identities.

However, he said he was not sure how the state would pay for such efforts. County recorders, for example, have proposed increasing an electronic filing fee from $1 to $3 to pay for the redaction effort.

“I think protecting individuals’ identity is important,” Culver said. “Once it gets to the level of security risk, we should take steps to limit how far we go in terms of disclosing things like Social Security numbers.”

The committee made 11 recommendations, several of which would give governments more power to remove Social Security or bank account numbers.

Sen. Steve Kettering, R-Lake View, a member of the study committee, said there is no simple answer to the problem. Lawmakers must find the appropriate balance between protecting identities and maintaining public records that protect the public through transparent government.

“There isn’t an easy solution, and that’s the hard part,” said Kettering, who noted that detailed records are critical in his profession as president of Farmers State Bank in Lake View.

Open-records advocates generally agree that some sensitive information like credit card numbers should not be released. The problem arises if governments redact information such as dates of birth, addresses or other unique identifiers, said Kathleen Richardson of the Iowa Freedom of Information Council.

Richardson said lawmakers need to establish how frequently identity theft occurs through public records. She believes the problem is rare.

“I think there needs to be a demonstrated need of why we need to vacuum public records,” Richardson said. “We also have to carefully consider what our definition of personal information is and make sure it’s not so broad that it wipes out too much information.”

Sen. Steve Warnstadt, D-Sioux City, said the committee has tried to be sensitive to the concerns brought forward by openrecords advocates when making its recommendations. The recommendations will likely be used to help draft proposals during the 2009 legislative session, which begins Jan. 12.

“The point of this is not to restrict access. The point is to prevent identity theft and personal information from being disclosed from people who don’t have a legitimate reason to have that information,” said Warnstadt, the committee co-chairman.

Robert Siciliano
POB 15145
Boston MA 02215
Ph: 1 888 SICILIANO (888 742-4542)
e-mail: Robert@IDTheftSecurity.com
Web: www.IDTheftSecurity.com
YouTube: www.YouTube.com/stungundotcom
As seen on The Today Show, CBS Early Show, CNN, MSNBC, FOX, CNBC, Inside Edition, Tyra Banks, Sally Jesse, Montel, Maury Povich, Howard Stern, and in USA Today, Forbes, Cosmopolitan, Good Housekeeping, Readers Digest, Consumer Digest, Smart Money, New York Times, NY Post, Boston Globe, Los Angeles Times, Washington Times, Washington Post, Chicago Tribune, Security Management, AP, UPI, Reuters, and Entrepreneur.

Identity Theft Expert Speaker; Health center workers used deceased patient info to apply for loans

Identity Theft Expert Speaker Robert Siciliano www.IDTheftSecurity.com discusses Health center workers used deceased patient info to apply for loans.

Medical identity theft  means lots of things depending on how the person was victimized. Generally something needs to impact the person medical record. In other cases it may impact their health insurance. The thief may gain insurance money, drugs or medical procedures.

Below is a case that resulted in financial identity theft due to health care professionals having access to deceased clients records. The insidiousness of the crime victimizes the family members after their loved-one has departed. Leaving them to clean up the mess. In the case below the perps got greedy and were caught. If they werent so greedy they may have got away with it over an extended period of time.

This case represents a flawed system that relys on Social Security Numbers as identifiers and makes no effort to properly identify and authenticate the borrower.

By Valryn Warren

Staff Writer

Friday, December 26, 2008

ENGLEWOOD — Two Samaritan North Health Center employees indicted on identity theft and money laundering charges used information from deceased patients to apply for online loans, police said Friday, Dec. 26.

Linda McDermott-Dorsey and Lisa Kidd, both of Trotwood, were indicted Dec. 23. McDermott-Dorsey is charged with 11 counts of money laundering and one count of identity theft, Kidd with 19 counts of money laundering and one of identity theft.

Englewood Police Sgt. Mike Lang said Samaritan North Health Center did an internal investigation and then called police, after being contacted by an on-line loan company the women are accused to trying to swindle.

“It was really a case of due diligence by the hospital and online companies monitoring suspicious transactions from the same location,” he said. “When we conducted our investigation, the families of the deceased were unaware that anything like this had happened.”

Lang said the women allegedly obtained a little more than $7,000 using information from 24 people over about a five week period, May-June 2007. They checked newspaper obituaries and used the hospital computer system to gather the personal information of deceased persons who had been Good Samaritan Hospital patients, Lang said.

The money laundering charges stem from online bank accounts opened and used to transfer funds. No court date has been set.

Identity Theft Expert Speaker FTC Issues Report on Social Security Numbers

Identity Theft Expert Speaker Robert Siciliano discusses FTC Issues Report on Social Security Numbers and Identity Theft. Agency Makes Five Recommendations to Reduce Role of SSNs in Identity Theft

All of this below makes total sense. And each recommendation is a step in the right direction to solve the problem. But until all citizens are properly identified and authenticated, the problem wont go away.  Currently there isnt any accountability. With full authentication, accountability becomes possible. Further, the credit bureaus and others relying on readily accessible SSNs are exasperating the problem. Fraud alerts across the board requiring all credit applicants to authenticate will begin to solve the problem. www.IDTheftSecurity.com

HERE:

The Federal Trade Commission issued a report today recommending five measures to help prevent Social Security numbers from being used for identity theft. Principal among the report’s recommendations is that Congress consider taking action to strengthen the procedures that private-sector organizations use to authenticate their customers’ identities.

“Identity theft continues to be a major problem in this country, with victims numbering in the millions each year and out-of-pocket losses (primarily to businesses) in the billions of dollars,” the report states.

The FTC report states that adopting nationwide standards for how businesses and other organizations verify the identity of new and existing customers would make it harder for identity thieves to use SSNs and other stolen information to consummate their fraud.

“The first step in minimizing the role of SSNs in identity theft is to limit the demand for SSNs by making it more difficult for thieves to use them to open new accounts, access existing accounts, or obtain other benefits or services,” the FTC states in the report. Currently, the only private-sector organizations subject to nationwide authentication standards are financial institutions regulated by the federal banking agencies. The FTC’s report recommends that Congress consider establishing similar standards to cover all private-sector entities that maintain consumer accounts. Such standards would require organizations to adopt reasonable procedures for authenticating customers, but also would allow them to adopt a program that is compatible with their size and the nature of their business, the report states.

The FTC report also recommends that steps be taken to reduce the unnecessary display and transmission of SSNs, but noted that such restrictions must be approached carefully. A number of important functions in the U.S. economy depend on use of and access to SSNs, and the report concluded that overly restrictive attempts to limit the availability of SSNs could unintentionally curtail those functions. Finally, the report recommends steps to improve data security, increase outreach to consumers and businesses on the protection of SSNs, and enhance coordination and information-sharing among organizations that routinely use SSNs.

The Commission vote to issue the report was 4-0. The report was developed pursuant to a recommendation of the President’s Identity Theft Task Force, which was established in May 2006 to develop a coordinated plan to prevent identity theft, prosecute identity thieves, and help victims recover from the crime.

The report is based on extensive fact-finding by the FTC and other federal agencies, including public comments and a workshop the FTC conducted on December 10-11, 2007. The workshop provided a forum for public-sector, private-sector, and consumer representatives to discuss the various uses of SSNs by the private sector, the necessity of those uses, alternatives available, the challenges faced by the private sector in moving away from using SSNs, and how SSNs are obtained and used by identity thieves.

The report issued by the FTC today focuses on the use of SSNs in the private sector. The Task Force agencies have undertaken a series of measures to curtail the use of SSNs by federal agencies as well. Information on those efforts can be found in the President’s Identity Theft Task Force Report, http://www.idtheft.gov/reports/IDTReport2008.pdf, issued in September 2008, which summarizes the steps taken to implement the Task Force recommendations.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 1,500 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s Web site provides free information on a variety of consumer topics.

Identity Theft Speaker Expert comments on State of Identity Theft

As an Identity Theft Speaker and Expert on the issue of Identity Theft for over 10 years, Ive seen lots and lots of hullabaloo and misinformation over the issue. Its the end of 2008. Progress has been made to make people aware of the issue of identity theft. However, based on a loosely conducted pole,  consumers are still in the dark as to how to protect themselves. Most dont know the difference between credit monitoring, fraud alerts or credit freezes. Most people think they can protect their social security number by not giving it out. Most people think as long as they are shredding then they are safe. We still have a long way to go.

Robert Siciliano

www.IDTheftSecurity.com