Here are some of the current schemes you should watch out for

Mike Gillespie
Sun

The Gaelic elder who centuries ago concluded “there’s no greater fraud than a promise not kept,” would stand aghast at the sheer pervasiveness of the problem today. Few segments of society, in fact, have escaped the attention of modern-day scammers — much to the despair of law enforcers trying to bust them.

HERE ARE JUST A FEW OF THE SCAMS AT PLAY IN NEIGHBOURHOODS NEAR YOU:

– APARTMENT SCAMS: Toronto police arrested a 35-year-old man last fall after he rented an apartment in that city, paid the first and last month’s rent then advertised the unit for rent on the Craigslist website, posing as a landlord. By the time the fraud squad caught up with him he had re-rented the unit to at least three different unsuspecting tenants and collected rent and security deposits from each before skipping town.

– TELEMARKETING: One of the largest cross-border telemarketing schemes ever uncovered in Canada was broken up two years ago when Canadian and U.S. investigators moved in on a Montreal-based operation preying mostly on American seniors. The scammers were offering low-interest loans and credit cards in return for a $250 sign-up fee. Police estimate that over a five-year period the scheme bilked victims of more than $43 million.

– E-COMMERCE: The fastest-growing segment of the North American economy has also become one of the biggest feeding grounds for fraudsters. CyberSource, an e-commerce payment management company representing 351 online Canadian and U.S. merchants that recorded more than $53 billion in online sales in 2006, estimates that last year’s losses, when tallied up, will exceed $3.6 billion. Although the percentage of online revenues lost to payment fraud has been declining over the last four years, to 1.4 per cent, CyberSource reports that total losses have been steadily increasing with the highest-risk category still international sales.

– TAX-RETURN FRAUD: Canada‘s Department of Finance was forced to broadcast an e-mail fraud alert just over a year ago when identity-theft scammers began sending out fake tax-refund notices under its letterhead. The official-looking e-mail messages promised refunds within six to nine days after victims returned an attached tax form — in the process compromising their personal and financial information, including credit card and social insurance numbers.

– DEBIT-CARD FRAUD: Escalating levels of fraud involving debit cards has prompted Interac, Canada‘s largest debit card network, to begin embedding computer chips in its cards. The chip cards, which began appearing last October, offer “a new standard in payment security,” promised Interac Association president Mark O’Connell. Such smart-card technology is already being used successfully in France, where debit card fraud has now dropped by eight per cent. Debit card fraud in Canada runs at about $70 million a year, Interac estimates.

– PHISHING ATTACK: Scammers last fall began using the Better Business Bureau’s name to advise companies of alleged complaints against them. Target companies were offered an e-mail hyperlink to download a copy of the complaint. By doing so, the companies exposed themselves to computer viruses that helped channel their confidential business information to scam operators.

– FAKE MONEY ORDERS: Canada Post announced in February it would add a new security feature to its money orders in response to a growing number of money-order frauds both in Canada and the U.S. One scam came to light earlier this year when a suspicious Newfoundland woman called police after receiving three Canada Post money orders for $800 each as payment for a $500 electronic organizer she sold over the Internet to someone in France. As payment, the buyer sent her $2,400 worth of money orders, told her to keep $500 and return the rest. The money orders were fake. The post office’s new anti-fraud device will feature a heat-sensitive security mark that turns white when a finger is placed on it.

– MORTGAGE FRAUD: This form of fraud is rampant, according to people in the real estate industry, and totals about $50 million annually. While mostly a hidden form of fraud (and often never detected), the industry warns it is driving up mortgage insurance rates for everyone. Such fraud comes to light when a homeowner defaults on a mortgage and the lender discovers they’ve been hoodwinked not only about the real value of the house but about the amount of the downpayment and even the homeowner’s employment claims. One study carried out by the B.C. Financial Institutions Commission, an investigative arm of the province’s finance ministry, suggested that from 10 to 15 per cent of all B.C. mortgage loan applications contain so-called “material misrepresentations.”

– INSURANCE FRAUD: The Insurance Bureau of Canada last year awarded its first ever Scam-ademy Award to the perpetrators of an “epic” auto theft scam that stretched from Canada to the Middle East. These “audacious fraud artists,” the bureau said, were not only car thieves but identity thieves as well. They created a string of false identities and fake credit reports, and used them to lease more than 80 high-end cars. The cars were then shipped to buyers in countries throughout the Middle East. “After the cars had sailed away, the gang tried to report some of them stolen in an attempt to collect on the insurance as well,” the bureau reports. The trail of fake paperwork led to seven suspects. Five men are now facing charges, and arrest warrants have been issued for the other two.

© The Vancouver Sun 2008

 

FUTURE ID: Developing digital protocols to protect online security and anonymity

SUZANNE BEAUBIEN
Province

For many people, a typical morning on the computer goes something like this: check e-mail messages, scan Facebook for new friend requests, rearrange the DVD queue on Zip.ca, pay bills, download a couple of songs from iTunes before checking for new job postings.

All these online transactions require signing on, using a password and user name. Some also require additional personal information, such as address and telephone number, or credit card data.

And according to the annual technology predictions report by international business-services giant Deloitte, Internet users should prepare themselves for even more rigorous authentication in 2008 as the ability to be anonymous online declines.

“Over and over, we’re going to see more putting your name down,” says Duncan Stewart, director of research at Deloitte Canada Research and one of the report’s authors.

With users, traders and regulators calling for more widespread authentication of users’ identities to combat malicious use of the Internet by pedophiles, online-auction fraudsters, and defamatory commentators, Duncan says that’s proof the technology is growing up.

“Back in the day, the whole point of the Internet was its anonymity.” Early chatrooms wouldn’t accept real names, he noted.

And now, while you might be able to read your favourite blog without signing on, these days fewer and fewer will let you comment without a user ID. Even some news sites block users without an individual log-in ID.

That means remembering a lot of passwords and filling out a lot of forms. And each time you do that, you could be opening yourself up to fraudsters seeking valuable personal information that can be used to steal your identity — both online and in the real world.

“Most people use a very small number of passwords … that becomes more of a security risk,” says Dick Hardt, CEO of Vancouver-based identity and access management developer Sxip Identity.

Current methods used to authenticate identity are imperfect, says Stewart, who predicts a new industry aimed at authentication will soon emerge to change all that.

“Anytime you make a password that is secure enough, it’s too hard for people to remember, and they write it on a sticky note,” which defeats the purpose, says Stewart. In the future, he predicts, computer users will prove their identities using a single sign-on user profile — complete with photo and voice recognition — and the risk of online identity theft will go down.

But for some privacy advocates, that idea is terrifying.

“Everybody should have the right to be anonymous,” says Richard Rosenberg, president of the Freedom of Information and Privacy Association and a board member of the B.C. Civil Liberties Association.

“It’s one of the most important things, especially in countries where they have political problems, like China,” says Rosenberg, a professor and author who has written about the social impact of computers.

“For people in some places, it’s a question of, ‘How can I carry on a political debate if I’m not anonymous?’”

There’s enormous pressure to develop systems that can identify suspicious behaviour, adds Rosenberg.

However, some industry leaders say you can have it both ways.

“Definitely in some parts of the Internet we want people to be accountable,” says Hardt.

“But there’s no way you’re going to have complete authentication.”

However, authentication protocols currently being developed will allow for both more security and anonymity — at the same time.

Hardt likens the digital credential, called OpenID, to a driver’s licence for the Internet.

With it, computer users can have different online identities and share personal information more easily — but only as much as they want to with each site.

“You can have your online church group and your online gambling group and the two don’t have to know about each other,” explains Hardt.

This digital driver’s licence could also help reduce the risk of data theft by limiting how many companies and organizations store your valuable information.

The concept, developed by Hardt and other industry leaders, is gaining momentum. Last month, Microsoft, Google, Yahoo, IBM, and VeriSign all joined the OpenID Foundation’s board, vowing to make a universal sign-on a reality in the near future.

Suzanne Beaubien
Province

Anyone who has been shocked to find a black mark on their credit report will tell you how hard it can be to get your lending record back in order. And even worse than finding a long-forgotten unpaid bill is stumbling upon a credit card or loan supposedly taken out in your name by someone else.

Calgarian Anna Sommer had that experience last August when she and her husband were negotiating the pre-approval process for a loan with Royal Bank.

“They were reading me the stuff that came up on my credit file,” said Sommer, 27. “And he mentioned this CIBC Visa, but I’ve never had anything to do with CIBC.”

The card had a $15,000 limit, and was carrying about $6,000 in debt. The fact that someone was making payments on it didn’t do much to calm Sommer’s fears about identity theft.

Ontario is leading the way with new legislation that aims to stem such surprises by forcing credit lenders to authenticate the identities of their customers if an alert is placed on their file. Since the new law went into effect on Jan. 1, Equifax Canada Inc. — one of the two major credit-reporting agencies in Canada — has placed over 800 such alerts on Ontarians’ credit files, says John Russo, senior attorney for Equifax.

Consumers across Canada can put similar alerts on their credit files, adds Russo. There are two types: “lost and stolen wallet” alerts and “true fraud victim” alerts. On average, Equifax receives over 1,200 true name fraud alerts every month, while lost and stolen wallet alerts range from 4,000-7,000 each month.

But whether those alerts are effective is debatable, says Andrew Inniss, general manager of Solutions Credit Counselling Service Inc., a debt-management company based in Surrey.

“They’re only as effective as the implementation of them,” says Inniss, noting it’s up to the credit lender to take action on the alerts.

In Sommer’s case, TransUnion investigated and removed the card from her file. While she never found out if it was an error, or if someone had truly stolen her identity, Sommer says she’ll be more careful in the future and will check her “It was a good lesson and it came out as best as it could,” she says.

© The Vancouver Province 2008

 

Cracking computer passwords is easier than you might think

Danny Bradbury
Province

You may think that your online information is safe, but in reality it’s only as safe as the password you use.

That handful of characters is all that stands between an online criminal and the contents of your EBay, Amazon or online banking account. How can you make sure that it doesn’t get compromised?

Short passwords are possibly the worst kind to use, because they are relatively easy to crack in what security experts call a brute force attack. Even the most basic modern desktop computers have enough processing power to guess passwords simply by trying different combinations of letters repeatedly. The fewer letters there are in a word, the more likely it is to be cracked.

Using real words (rather than random collections of letters and numbers that don’t mean anything) is also dangerous. Software exists that uses ‘dictionary attacks’ against passwords, running through hundreds of thousands of words in the English language on the assumption that people want to use a word they will remember. Somehow, ‘8uiklg5ybs’ just doesn’t stick in a person’s memory, whereas the name of their pet does.

“Either make up a scheme to generate good passwords, or use a random password generator,” says Will Whittaker, security expert and organizer of the CanSec West electronic security conference that takes place in Vancouver at the end of March. But don’t be tempted to use that password for everything. If it is compromised, thieves could use it to pilfer everything, including webmail accounts, banking sites, and e-commerce services.

Another option is to use pass phrases rather than passwords. Using a combination of words meaningful only to you (such as a line buried deep in your favourite book, for example, or some other mantra that you keep private) can create a long enough security key to thwart even the most determined attacker.

Such techniques may seem paranoid, but in an age when identity theft is a growing threat, some basic precautions could save you an awfully big headache in the future.

© The Vancouver Province 2008