By Paula Carney-Hoffler Dip Law, CIPP/E,CIPM CDPP(IE273)
Abstract
The rapid expansion of digital technologies has led to a significant rise in internet identity theft, affecting individuals, businesses, and government institutions alike. This white paper explores the key issues associated with identity theft in the online realm, examining the tactics used by cybercriminals, the vulnerabilities they exploit, and the far-reaching consequences of such attacks. Additionally, the paper delves into existing legal frameworks, preventive measures, and emerging technological solutions designed to combat identity fraud. By analysing case studies and statistical trends, this paper provides a comprehensive overview of the growing threats posed by identity theft and offers recommendations for enhancing security practices to mitigate risks in an increasingly interconnected world.
Introduction
Identity theft is a term used to categorise offences involving the illicit use of an individual’s personal information for criminal purposes. Identity theft is not a new concept, however today the issues associated to it are more exacerbated due to the level of engagement in this now digital world and our reliance on technology such as the internet to enable us to function in society. The difference between identity theft and its internet counterpart is the ability to access a far larger victim pool to which the illicit act can happen .This essay will look at the issues that internet identity theft poses to an individual and society and the contributing factors in the growth of identity theft which “is as a result of the internet and corresponding unprecedented access it allows to numerous databases where personal information is stored” (Pontell 2002:313).
For clarification: there is a close association between identify theft and identity fraud, the latter being associated to the illicit use of personal data and the former being the acquisition of the personal data to be used in an illicit manner by a perpetrator (opening a bank account in the victim’s name). Due to their close association and the issues created by internet identify theft it is prudent to include both aspects as “the term identity theft and identity fraud are often used interchangeably”(McNally and Newman 2008:1).
Personal information is shared constantly in a digital environment, we use digital devices everyday which are connected to the internet. The ease at which the exchange of information is facilitated provides access to online banking, shopping, the ability to share personal images, videos and interactions within social media and other communication platforms such as email and instant messaging services. Individuals have limited control over these applications and devices where transparency regarding the privacy they offer may be vague which often leaves individuals “with little choice but to participate and little time to systematically process the short term and /or long-term implications of this information exchange”(Walker 2016:1).
Where personal information is intercepted by a perpetrator identity theft can ensue which can lead to financial and personal harm where “victims have difficulty obtaining loans, mortgages, security clearances, promotions and even gaining employment” (Solove 2003:1244). This would be particularly apparent where “true-name fraud occurs when an offender literally assumes another individual’s identity to lead a life parallel to the victims” (McNally and Newman 2008:2)
The perpetrator may then use obtained information to impersonate the victim giving them access to the victim’s bank accounts, social records, medical records, social media accounts and personal data on the internet to which they will use in a fraudulent manner. According to the Credit Industry Fraud Avoidance System’s (CIFAS) Fraudscape 2023 report “86% of identity fraud comes through online channels” (CIFAS 2023:2)
Internet Identity Theft Awareness
Personal information today is exposed at a level that far exceeds what is stored in a wallet that was stolen, bank cards are now stored online, medical insurance data is stored on an App within a database in the cloud, and an entire life can be portrayed in social media platforms “the difference between the identity theft of the past and that of the present identity theft is the way the crime is committed” (Fonesca 2017:2). Whilst laws have been put in place such as the General Data Protection Regulation (GDPR) 2018 to improve the security and protection of personal information, it is however reported that “Europeans report no greater sense of trust online” (Layton and Elaluf-Calderwood 2019:4)
Perpetrators are more sophisticated, using techniques such as the gathering of data disclosed in data breaches (HSE, NHS, Yahoo, Mailchimp) through the unlawful access of companies databases, where vast quantities of personal data can be obtained. More direct engagement with victims is through the use of but not limited to phishing (email scams) smishing (text-based scams) vishing (voice-based scams) hacking (technological codes to access databases), malware (virus deployed to a device) and preying on social networking sites (data disclosures). The objective of these techniques is to obtain access to or to lure the victim into disclosing personal information online that will be used illicitly.
A significant issue of online identity theft is the general awareness of the victim on how to protect themselves online. “Thus, it is important to increase people’s awareness of how to protect themselves in online networks through media education” (Sehgar and Zukarnain 2021:9). The harms associated to “identify theft can be a harrowing experience, and it can be devastating to victims” (Solove 2003:1244) and “victims experience great anxiety, leading to psychological harm in certain cases” (Solove 2003:1244). Identity theft not only creates psychological harm but impacts the overall personal health of the victim.
Personal Health Issues Associated to Internet Identity Theft
Identity theft in any format creates issues and is a health problem and with the rising incidences in identity theft due to the use of the internet there is recognition of the negative physical and emotional health consequences it causes. “1 in 10 identity theft victims were severely distressed as a result of the crime” (Harrell 2019:11) additionally “ the level of victims’ emotional distress was related to the time spent resolving problems” (Harrell 2019:12).
There are also other factors alongside the emotional distress of the victim and that is the ability to engage in personal relationships, work, and school, this is pursuant to the gravity of the crime. The below graph (fig.1) (Harrell 2019:10) explores the various impacts based on the seriousness of the identity theft whereby “8 % of victims of the misuse of personal information to open a new accounts experienced problems with family and friends” (Harrell 2019:10).
Figure 1
There are also additional factors of emotional harm that Randa and Reyns examined in their Analysis of the National Crime Victimisation Survey and that is of various mental health conditions derived from the identity theft (fig.2) “seven specific response items included: worried or anxious, angry, sad or depressed, vulnerable, violated, like you couldn’t trust people” (Randa and Reyns 2019:1295).
Taking the final response “like you couldn’t trust people” (Randa and Reyns 2019:1295) and being aware that “trust is defined here as a willingness to accept vulnerability or risk based on expectations regarding another person’s behaviour” (Bourm 2010:2).It appears that the impact of identity theft creates trust issues for the victim “perceptions of insecurity also result from trust breaches – challenges to individuals’ ability to anticipate the future behaviours of other actors and of systems on whom their financial lives depend” (Brensigner 2023:5)” in general “the misuse of an individual’s personal data may lead her to mistrust other people” (Brensigner 2023:5)
The table below (fig.2) (Randa and Reyns 2019:1295) shows the impacts by the type of identity theft on the victim. Physical health impacts were also recorded where individuals indicated they had experienced “headaches, trouble sleeping, changes in eating or drinking habits, upset stomach, fatigue, high blood pressure, muscle tension or back pain or some other problem” (Randa and Reyns 2019:1295).
Figure 2. Measures
The below interview conducted by Brensigner with an identity theft victim provides a first-hand view of the mental health issues associated with identity theft even where there was no serious tangible impact to the victim’s financial wellbeing. The loss of trust in institutions and the internet left the victim with a feeling of being unsafe and concerned around her future financial security. The victim also expressed that her confidence in a digital life where information exchange is a requirement was impacted.
Interview conducted by Brensigner: Identity Theft, Mistrust, and the Production of Economic Insecurity
“Simone-Originally from California, Simone’s (W, LI) pursuit of a college degree had taken many twists and turns. In 2011, after securing public assistance and her own apartment in New York City, she enrolled in one of the city’s public colleges to finally complete her degree. The following year, while checking her credit report, she noticed that someone in Michigan had attempted to obtain a car loan in her name and been denied by the bank—an outcome Simone attributed to her already bad credit. The experience, she said, “freaked me out.” According to her, she Googled what to do and then called the Federal Trade Commission (FTC) hotline. When she explained that she had no idea how her information got out, the staff person told her that identity theft often happens at colleges because of their use of SSNs.
Simone had already been in what she described as a questionable and abusive romantic relationship with one of the college’s administrators, so the new information made her feel more “sketchy” and “unsafe” there. She began worrying about the school’s hiring procedures and regular requests for SSNs. “It’s not really safe because apparently your Social Security Number, it’s attached to a lot of things. For me, I have food stamps and Medicaid, so it’s attached to all that, not just whether I go to school or not.” Simone’s experience also shook her confidence in the whole of digital life that depended on data exchange. She referenced an article in New York Magazine about how “we’re living in the Matrix.” “It’s kind of like that, you know what I’m saying? You know that you’re not going to put your wallet [down] so that somebody can steal your wallet. But with identity theft, it’s very different. It’s not this physical reality that you’re experiencing.”
In an increasingly virtual world, she sensed that the rules of the game had changed, leaving her wondering how to protect herself financially. Although identity theft did not tangibly impact Simone’s financial resources, it diminished her trust in her college and the Internet—both of which appeared to hold some sway over her financial wellbeing—leaving her feeling more insecure.” (Brensigner 2023:10)
We can also see from the above interview that the victim is perceiving potential harms due to the identity theft where the victim feels that there will be future unknown harms to her information and privacy, as Calo states “ just as a burn is a specific and diagnosable condition, so is privacy harm a distinct injury with particular boundaries and properties” (Calo 2011:28).
Monetary and Reputational Issues of Internet Identity Theft
In the first part of this essay we have reviewed the personal health impacts of identity theft on a victim, however the financial situation a victim suffers can go on for years. Solove states “victims of identity theft are submerged into a bureaucratic hell, where, according to one estimate, they must spend approximately two years and almost 200 hours to decontaminate their dossier” (Solove 2006:515). During this time, the victim may be impeded accessing credit where they appear to have incurred significant direct financial losses as a “result from victims of existing account take-over losing funds from their account”(Betz-Hamiliton 2022:218). Financial loses can also include “utility shut-offs and being forced to file for bankruptcy to clear the financial damage left behind by the identity thief” (Betz-Hamiliton 2022:218)
There is also substantial risk to the reputation of the victim in particular where their identity has been used in criminal activity “the victim would only be aware of what happened when he was called to appear before the judge” (Sehgar and Zukarnain 2021:3).The use of a victim’s identity can cause further issues where “lost employment opportunities can result from a poor credit score” (Betz-Hamiliton 2022:218)
Internet Identity Theft And Further Crimes
“Online identity theft is not a stand-alone crime it leads to the commission of other crimes” (Sehgar and Zukarnain 2021:3) and creates an opportunity for identity fraud. “ID theft is often the first and preparation phase to the second phase” (Hedayati 2012:3).“Accordingly, the major motives of perpetrators for stealing identities are: requirement of further fraud (in most cases),sell the stolen information, hiding the identity” (Hedayati 2012:3). The perpetrator has acquired the personal information, the next step is then to utilise the information for further illicit activities.
Financial institutions that are subject to an act of fraud are often unaware that the perpetrator who is in the process of committing identity fraud is in fact not the victim. The perpetrator will have all the required identifying information to open a new bank account in the name of the victim. Solove states “identity theft occurs because creditor and credit reporting agencies often lack both the means and the incentives to correctly identify the persons who seek credit from them or on whom they report” (Solove 2006:515). According to the Central Bank of Ireland “of the total new accounts opened in the first eight months of 2022, 56% were opened online”. We can surmise that online new account application growth will continue and so too will the opportunity for fraud.
According to the CIFAS’s Fraudscape Report 2023 “77% of false applications came through online channels, there has been an increase in applications coming through combined channels – such as online applications being finalised in branch”. CIFAS also reported that “86% of identity fraud occurs through online channels” and “ this may be a direct result of threat actors trying to circumvent online identity verification controls”(CIFAS 2023)
The Federal Trade Commission Report Social Media : a golden goose for scammers (Fletcher 2023:1) has reported that the majority of fraud loses by contact method came through the use of social media channels.
Figure 3. Federal Trade Commission Report-Social Media: a golden goose for scammers
Identity theft can also lead onto immigration fraud (obtaining a passport) and terrorism. The perpetrator can use the stolen identity to obtain a passport to “cover their felonies and illegal activities” (Hedayati 2012:5). It was noted on a CNN report that Former FBI director Robert Mueller acknowledged that prior to the 911 attacks “some of those behind last week’s terror attacks may have stolen the identification of other people” CNN also reported “and, according to at least one security expert, it may have been relatively easy, based on their level of sophistication” (CNN 2001:1)
Conclusion
Identity theft via the internet or any format is not a “victimless crime” (Button and Lewis and Tapley 2012:1). McNally states, “identity theft is a form of information warfare, both in relation to how it is perpetrated and how information about it has been constructed and disseminated to the masses” (McNally 2012:163). It maybe that internet identity theft is war that we are losing “due to the ongoing expansion of technology where cybercriminals are constantly discovering innovative ways to manipulate computer systems, find vulnerabilities, and spread malicious software to gain access to valuable data” (Fonseca 2017:6).
With the current technological expansion internet identity theft will continue to grow. Sehgar and Zukarnain noted that “online identity theft is a fast-growing cyber-crime in the world” (Sehgar and Zukarnain 2021:1).
Sehgar and Zukarnain also put forward that “the advent of emerging technologies and the lack of people’s knowledge of how to protect their personal information are motivating fraudsters” (Sehgar and Zukarnain 2021:9). Given these assumptions and the current trajectory of technology internet identity theft may become more pervasive and create further unwelcome impacts to the health and safety of individuals, their families, society, and the various organisations to whom individuals share their personal information to.
To reduce the risk of internet identity theft individuals need to understand the potential risks associated with it and take more responsibility for their information through personal awareness as “each activity we engage in results in users leaving traces of themselves like digital footprints”(Holm 2014 :171-172).In the writers opinion the more information shared to the internet without considering the personal risk, the more opportunity there is for identity theft and identity fraud to take place.
Additionally, the responsibility to protect personal information is not just a requirement of the individual. Organisations that process and store personal information such as but not limited to banks, financial services , retail, and social media platforms will need to look at new approaches that keep pace with the technological sophistication of the perpetrators “ as the internet, and what we use it for, evolves every day, so do the tools and techniques used by these hackers and so organisations need to evolve to” (Lee 2019:1). These organisations will need to be more proactive in defending the information they have been entrusted with as “the responsibility of safeguarding the critical infrastructure and protecting people from cybercrime is a shared responsibility for all” (Chakraborty, Biswas, Khan 2023:2).
References
Jordan Brensinger
J.B.
2023
Identity Theft, Mistrust, and the Production of Economic Insecurity
Princeton University
SAGE Publications
Brensinger-ID-Theft-Insecurity-Accepted.pdf (jordanbrensinger.com); accessed 4th Jan 2024
Randy Borum
R.B.
2010
The Science of Interpersonal Trust
University of South Florida
Mental Health Law & Policy Faculty Publications
The Science of Interpersonal Trust (usf.edu); accessed 4th Jan 2024
Roslyn Layton, and Silvia Elaluf-Calderwood
R.L. and S.E-C.
2019
A social economic analysis of the impact of GDPR on security and privacy practices
12th CMI Conference on Cybersecurity and Privacy (CMI)
IEEE
A Social Economic Analysis of the Impact of GDPR on Security and Privacy Practices | IEEE Conference Publication | IEEE Xplore; accessed 15th Jan 2024
Ryan M Calo
R.M.C
2011
The Boundaries of Privacy Harm
Stanford Law School
Indiana Law Journal Vol 86
The Boundaries of Privacy Harm (indiana.edu); accessed 6th Jan 2024
Credit Industry Fraud Avoidance System’s
CIFAS
2023
Fraudscape 2023
London
CIFAS
Fraudscape 2023 – Cifas; accessed 2nd Jan 2024
Daniel Fonseca
D.F.
2017
Identity Theft in a Digital World
Utica College
ProQuest Dissertations Publishing
Identity Theft in a Digital World – ProQuest; accessed 8th Jan 2024
Emma Fletcher
E.F.
2023
Social Media: a golden goose for scammers
Federal Trade Commission
Social media: a golden goose for scammers (ftc.gov); accessed 2nd Jan 2024
Axton Betz-Hamilton
A.B-H.
2022
A comparison of the financial, emotional, and physical consequences of identity theft victimization among familial and non-familial victims
Journal of Financial Counselling and Planning
Springer Publishing Company
A Comparison of the Financial, Emotional, and Physical Consequences of Identity Theft Victimization Among Familial and Non-Familial Victims | Springer Publishing; accessed 4th of Jan 2024
Ali Hedayati
A.H.
2012
An analysis of identity theft: Motives, related frauds, techniques, and prevention
Vancouver Island University
Academic Journals
Contents (academicjournals.org); accessed 8th Jan 2024
Eric Holm
E.H.
2014
Social Networking and identity Theft in the Digital Society
Federation University Australia
The International Journal on Advances in Life Sciences
icds_2014_7_20_10060-libre.pdf (d1wqtxts1xzle7.cloudfront.net); accessed 14th Jan 2024
Laura Lee
L.L.
2019
Cybercrime has evolved: its time cyber security did too
Computer Fraud and Security volume 2019
Science Direct
https://doi.org/10.1016/S1361-3723(19)30063-6; accessed 16th Jan 2024
Central Bank of Ireland
CBI
2022
Central Bank publishes new data on bank account openings and closures
Central Bank of Ireland
Central Bank publishes new data on bank account openings and closures; accessed 12th Jan 2024
Abhilash Chakraborty, Anupam Biswas, and Ajoy Kumar Khan,
C.A, A.B. and A.K.
2023
Artificial intelligence for cybersecurity: Threats, attacks, and mitigation
Artificial Intelligence for Societal Issues Vol 23
Springer International Publishing
Microsoft Word – Springer_Lecture_Notes_in_Computer_Science (1).docx (arxiv.org) ; accessed 15th Jan 2024
Erika Harrell and Lynn Langton
E.H. and L.L.
2019
Victims of Identity Theft, 2012
US Department of Justice
BJS Bulletins
Victims of Identity Theft, 2016 (ojp.gov); accessed 4th Jan 2024
Megan M McNally
M.M.McN
2012
Identity Theft in Today’s World
Praeger
ABC-CLIO, LLC
Megan M McNally and Graham R Newman
M.M.McN and G.R.N
2008
Perspectives on Identity Theft Crime Prevention Studies Volume XXIII
Criminal Justice Press Monsey
Willan Publishing
European Parliament
E.P.
2023
Fighting cybercrime: new EU cybersecurity laws explained
European Parliament
Europarl
Fighting cybercrime: new EU cybersecurity laws explained | News | European Parliament (europa.eu); accessed 15th Jan 2024
Henry Pontell
H.P.
2002
Pleased to Meet You Won’t You Guess My Name?
Adelaide Law Review
Informit
https://search.informit.org/doi/10.3316/informit.248432812998746; accessed 5th Jan 2024
Ryan Randa and Bradford W. Reyns
R.R and B.W.R
2019
The Physical and Emotional Toll of Identity Theft Victimization: A Situational and Demographic Analysis of the National Crime Victimization Survey
Deviant Behaviour
Taylor & Francis Online
https://doi.org/10.1080/01639625.2019.1612980; accessed on 19th Dec 2023
Daniel Sieberg
D.S.
2001
Expert: Hijackers likely skilled with fake IDS
USA
Cable News Network LP
CNN.com – Expert: Hijackers likely skilled with fake IDs – September 21, 2001; accessed on 8th Jan 2024
Daniel J Solove
D.J.S.
2003
Identity Theft, Privacy, and the Architecture of Vulnerability
George Washington University Law School
Hastings Law Journal
SSRN
Identity Theft, Privacy, and the Architecture of Vulnerability by Daniel J. Solove :: SSRN; accessed on 13th Dec 2023
Daniel J Solove
D.J.S.
2005
A Taxonomy of Privacy
George Washington University Law School
University of Pennsylvania Law Review
HeinOnline
A Taxonomy of Privacy 154 University of Pennsylvania Law Review 2005-2006 (heinonline.org); accessed 12th Jan 2023
Kristen L.Walker
K.L.W.
2016
Surrendering information through the looking glass
Journal of Public Policy & Marketing
American Marketing Association
JPPM15020 144..158 (csun.edu); accessed 15th Jan 2024
Sopna Sinnathamby Sehgar and Zuriati Ahmad Zukarnain
S.S.S. and Z.A.Z
2021
Online Identity Theft, Security Issues, and Reputational Damage
University Putra Malaysia
Preprints
https://doi.org/10.20944/preprints202102.0082.v1; accessed 5th Jan 2024