Frank Abagnale - The Art of the Steal

One straightforward method is “shoulder surfing,” which I told you about earlier with ATM fraud. A thief watches you as you punch in your credit card or calling card number at a pay phone. Or he eavesdrops on your conversation as you give your number to a hotel or merchant. From that one number, he gathers other information about you and is on his way.

Another popular approach is “Dumpster diving.” Crooks root through your garbage cans, trash bins outside stores, or on street corners, or communal Dumpsters. They toss away the chicken bones and old newspapers, and collect credit card statements, bank statements, phone bills, copies of checks, or anything that shows your name and address. These records are gold to an identity thief.

How many times have you gotten a stack of “preapproved” credit cards in the mail and, already being flush with cards, simply tossed the envelopes in the garbage without ripping them up? The identity thief thanks you very much. He goes ahead and attempts to activate the cards, often with success. Some credit card companies require that you activate a new card only from your home phone number, but this precaution hasn’t been universally adopted. A few years ago, federal authorities broke up the Trash Ring, a group that stole more than $10 million in dozens of states, largely by recovering cards and account information from Dumpsters and trash cans.

If you’ve been divorced, the transcript of your case, bulging with financial and credit information that you had to reveal, as well as your Social Security number, is public record. A thief need only stop in at the courthouse and scribble down what he needs.

One recently-arrested identity thief, a low-level employee at a drug company, happened to come across a box of personnel records for three dozen former employees. The box was lying in a storage closet of the company. When you’ve got a criminal mind, a box like that is a bonanza. The thief, along with several accomplices, used the records to get credit cards, buy more than one hundred thousand dollars of goods, and rent three apartments in other people’s names. For a time, they lived a joyous life that was way beyond their own means.

Employees at a New Jersey car dealer used the company access to the three leading credit bureaus—Equifax, TransUnion, and Experian—to find strangers with good credit histories, some of them living as far away as Alaska, and then opened up credit card accounts in their names.

A group of Nigerians established themselves in the industrial cleaning business. They had trucks. They had uniforms. They had cleaning supplies. In due course, they had customers. They would come into the company offices at night and clean the place. And they did a beautiful job. But they cleaned the offices of more than grime. They knew how to get at personnel records and would copy Social Security numbers and whatever other useful information they found and steal identities.

And there are endless come-ons that thieves use to sucker people into unwittingly divulging personal information. Not long ago, some fairly provocative flyers suddenly popped up in scores of black communities throughout the South and Midwest. They were stacked on tables in churches, stuck in windshield wipers of parked cars, and tacked to the bulletin boards of senior citizen centers and nursing homes. The headline on them read: “Apply for Newly Approved Slave Reparations! Claim $5,000 in Social Security Reimbursements!” The body of the flyers said that blacks born before 1928 could be eligible for slave reparations under the “Slave Reparation Act.” Those born between 1917 and 1926 could apply for Social Security disbursements because of a “fix” made in the Social Security system.

Obviously, a burst of good fortune like this was something that would pique a person’s interest, and it seemed plausible. There had been a lot of talk and press about proposed legislation that would pay reparations to black people. But the whole thing was nothing more than a trap set by a ring of identity thieves.

In the Atlanta metropolitan area, a man posing as a jury administrator from the local court system would call people, mostly the wealthy and business owners, and say, “You’ve forgotten to respond to a summons for jury duty and face a penalty. I can straighten it out right now for you, if you just give me some basic information.” Assuming they had overlooked the summons, or it had gotten lost in the mail, the victims would unquestioningly provide their birth dates, mother’s maiden name, and Social Security numbers.

Thieves are not at all squeamish about stealing the identity of someone that recently died and resurrecting him for the purpose of spending money. This works because credit bureaus usually don’t learn about someone’s death for six to twelve months. A common place to locate the personal information necessary here is an obituary. People fail to realize the abundance of material contained in an obituary, particularly that all-important mother’s maiden name so universally used for identification means.

One pair of identity thieves stole hundreds of thousands of dollars from some two-dozen victims in seven states. Most of them were selected out of “Who’s Who in America,” which in its biographies of prominent Americans gives birth date, place of birth, mother’s maiden name, and home address, sufficient information for them to request birth certificates and establish credit.

Recently, there was a run of identity thefts involving admirals of the U.S. Navy. One admiral complained that he had been a victim, then another admiral and another—ultimately seven in all. It happens that the thieves were digging out personal information on them from the Congressional Record. It routinely lists all the data a criminal needs to become a military officer.

One woman had her identity stolen by her boss. She was hired by the owner of a magazine publisher, and, in filling out her employment application, divulged the usual supply of personal information. Little did she know that her employer had ruined her own credit in the past and couldn’t even get a credit card. Within months of the woman being hired, her boss took out a card in her name and began using it. Who would suspect their boss? But literally anyone can be after your identity.

Years ago, I predicted that once there was a shake-out among all the dot-com startups, criminals would step in and offer to buy up the assets of failed e-commerce companies. Why would they? To get their databases, rich with personal information on customers, including credit card numbers. I bet it’s already happened. When it was functioning, the retailer Toysmart.com assured its customers that their personal information would never be shared with anyone. When it went bankrupt in May 2000, that promise went out the window. It took out ads offering to sell its database. Fortunately, a subsidiary of Walt Disney agreed to pay it fifty-thousand dollars to destroy the information before it got into the wrong hands.

NUMBERS FOR SALE

The Internet has become the equivalent of an electronic shopping mall for identity thieves. Endless websites have sprung up that sell personal information. One site, docusearch.com, will retrieve a person’s Social Security number for a mere forty-nine dollars. How long will it take? One day.

It’s all perfectly legal. They buy this information from the nineteen states that use the Social Security number for the driver’s license number. They’ll go to a driver’s license bureau and ask, how many Social Security numbers do you have? They’re told, 1.3 million. Okay, can we buy them for $8 a number? They’ll approach one of the major health insurers, with millions of numbers, and again buy them for $8 apiece. They buy numbers from collection agencies and credit bureaus, and they resell the information for $49 a number. The only thing you have to type in is the person’s name and the last-known state you believe he or she lived in, and within seconds, up comes the Social Security number. I’ve gone online a number of times to test it out and they’ve never not had the number. Try it yourself.