ID Theft: Banks Must Step up FightNew Council Takes ID Theft Awareness to Grassroots
"We have to find some national way to communicate," O'Farrell says.
O'Farrell, a cybercrime and identity-theft expert and consultant for Intersections Inc., says apathy on the part of consumers, law enforcement and business has helped fuel growth of identity theft crimes. "We are seeing an increase in sophisticated malware, yet on the other side, we are seeing law enforcement virtually having to abandon the fight against identity theft," he says. "We are seeing growing apathy among consumers, who feel that zero liability means they have got nothing to lose."
O'Farrell says banking institutions are in a perfect position to not end that apathy but made a positive change. "Virtually every consumer in America has a relationship with a financial institution. They can be the conduit; they can be the messenger; they are that trusted authority."
In this exclusive interview, O'Farrell and Karen Lodrick, an actual victim of identity theft, discuss:
- The unique role the ITC;
- ITC plans for collaboration with local law enforcement; and
- Why financial institutions are the key to winning the fight against identity theft.
Neal O'Farrell is a nationally recognized expert on cybercrime and identity theft. Once described as one of the world's top 20 security experts, O'Farrell was the driving force behind a number of national security awareness initiatives, including Think Security First, a non-profit partnership between Chambers of Commerce and cities across the country to improve cybersecurity education at a community level. Over his 25-year security career, O'Farrell has worked as a security advisor to financial organizations, governments, the military and Fortune 500 firms around the world.
O'Farrell is a board member of the Center for Information Security Awareness and recently created the first course and certificate program to be endorsed by the FBI/InfraGard to provide free security awareness training to the nation's 26 small-business owners and their employees. He also was the first security expert to train an entire police department in identity-theft awareness. The program has since been used by more than 200 police departments and police academies, as well as the FBI, the Department of Motor Vehicles and U.S. Attorney's Office.
Karen Lodrick, is an identity-theft victim turned advocate who has been a creative consultant, speaker, performer and writer for the last 17 years. She graduated from college with the hopes of working as an artist. She moved to San Francisco in 1997 and pursued a career in graphic design. Now she is diligent in providing identity-theft awareness to help those who have been victimized.
Fighting ID Theft via Community OutreachTRACY KITTEN: The Identity Theft Council is a newly created national network of partnerships between local law enforcement, businesses and volunteers that aims to provide local and in-person support for victims of identity theft. The catalyst for the council's creation -- a lack of cross community and education needed to help law enforcement agencies catch and stop perpetrators of identity theft. Today we hear from ITC Founder and Executive Director Neal O'Farrell and Karen Lodrick, a victim turned advocate who is helping get the council off the ground.
Neal, you created the council to address growing concerns among local law enforcement agencies that have struggled to curb and end many of the identity theft cases they investigate. How does the ITC expect to address some of those concerns and communication roadblocks, which have increasingly allowed identity theft to thrive?
NEAL O'FARRELL: I think that the Identity Theft Council was really born out of a sense of frustration between two security veterans. I have been in security now for nearly 30 years, and I was having a conversation with a police officer who had been investigating fraud and identity theft for close to 20 years. We have seen a brewing "perfect storm" in the last couple of years and everyone on the ship seemed to be asleep. So, we tried to figure out ways where we might be able to re-energize awareness about identity theft and bring it down to a real, grassroots community level. We started our area this year in one city, Hayward, Calif., and within weeks it had spread to 15 cities, and within months to close to 40 cities; and culminating last week, we launched a presence in San Francisco, the largest metropolitan area to have its own Identity Theft Council.
KITTEN: It seems like a number of organizations and agencies have already launched efforts to specifically target identity theft. How is the ITC different?
O'FARRELL: We are a community, grassroots initiative. There are lots of great national organizations that have been fighting this battle for, well, more than a decade. But they are the first to admit that they need help. This really is a crime that affects every single one of us, if we are not directly victims. We realize that, similar to a neighborhood watch, we can't really leave it to everyone else to solve this crime. We can't rely on law enforcement to solve it, because they simply don't have the time or resources; and we can't rely on the financial industry, because they are in a similar position.
We really have to address this ourselves and the neighborhood watch model is a perfect model. If we create an organization where people in their own community can help each other, can counsel victims, can provide information or intelligence to law enforcement, and can spread those education and prevention methods, which is the ultimate goal, then we have been successful. What we have done in the (San Francisco) Bay Area we can do in thousands of communities throughout the country; and there has never been a response to identity theft like that.
ID Theft: Spreading the Message and the CouncilKITTEN: The council recently opened, as you mentioned, its San Francisco Identity Theft Sub-Council. What is the overall national goal for the council and in what states and/or cities do you expect to gain a presence first?
O'FARRELL: We started in the Bay Area, which one expert has described as a "black hole for identity theft" and San Francisco has been described as the No. 1 riskiest city in the nation for identity theft, but we have had inquiries now from about a dozen states, from district attorneys, from law enforcement, from Better Business Bureaus; and our goal next is to launch something on the East Coast, probably in Washington, D.C. One of the first things that we realized when we took this on is that this is way bigger than we are, so we approached Intersections in Virginia, a non-profit organization that operates the restitution and restoration services for the Identity Theft Assistance Center. We enlisted their help in sharing the data and knowledge about victim support. And, so, we thought it would only be right to use all the resources now that we have in Washington and make D.C. our next major launch pad for a council on the East Coast.
KITTEN: Can you explain how the council is structured and how it is supported financially?
O'FARRELL: The council truly is an all-volunteer, grassroots community effort. It is only beginning to take shape. We are talking to a number of national sponsors that have shown an interest in helping us out. Right now, we are supported by organizations like Intersections, the Independent Community Bankers of America, the National Council of Better Business Bureaus and local credit union and community banks, which have been a tremendous resource. Those entities are providing facilities where we can train our volunteer counselors, and credit unions are providing counselors that can be trained so they can in turn help local victims; it truly is every element of the community. In the Bay Area, we have more than 50 organizations contributing in some way; but as we grow nationally, we are reaching out to national sponsors who really believe that this is something that can change the identity-theft landscape.
ID Theft Prevention: Marketing Tool for Banks?KITTEN: Now, you have touched on this a little bit, but I am just going to ask you to elaborate. How do you work with businesses, such as financial institutions and local governments or municipalities?
O'FARRELL: With the financial institutions, it is a two-sided coin. First, we invite them to participate -- which means anything from inviting their employees to be trained as counselors so we can send them out into the community to providing facilities where we can host training events and meetings. But we want them to view identity theft awareness as a marketing opportunity. I have also talked about my experience with my own bank. I have been with them for over a decade and they are one of the top three, but I can't remember a single instance in the last 10 years that they have spoken to me about security. I get daily emails from them, I get alerts about bank balances, I get reminders about great offers, but they don't talk to me about identity theft in any way shape or form. I could be forgiven for believing that identity theft doesn't actually exist, that banking choices don't exist. I believe that if the financial institutions talk to their customers a lot more about identity theft everybody wins, so that is what we try to encourage our local credit unions and banking partners to do. We want to get them involved with the community and reach out to their members and to their customers and sell the message to them. It really does work out well, in our experience, for the financial institutions. It makes them look better. And with local municipalities and law enforcement, we partner with them and we encourage them to refer victims to us. We train their law enforcement officers free of charge. We operate seminars on their behalf -- any way that helps them to get the message out into the community without it being an extra burden on them.
ID Theft: A Victim's StoryKITTEN: Now, Karen I would like to bring you into the conversation. You are an actual victim of identity theft. Could you tell us a little bit about your identity-theft experience?
KAREN LODRICK: It was pretty traumatic; you definitely feel violated. It is definitely a horrible crime to go through. It's funny, because they say it is not a violent crime, but when you are going through it, it doesn't feel like it is not violent. You don't feel secure anymore, and the lack of support that I received because of the lack of resources was pretty daunting to me. I was actually shocked that in this day and age there was so little my bank seemed to be able to do for me or that law enforcement seemed to be able to do for me. I kind of took matters into my own hands, because I didn't see this crime ending for me and I didn't want to have to live with eyes in the back of my head for the rest of my life. I started doing my own investigating and ultimately found the criminals who were stealing my identity and was able to stop it.
KITTEN: How was your identity compromised?
LODRICK: It started with stolen mail. They were part of a mail ring here in San Francisco. They used those blank checks that banks like to send out, and then they were able to open all sorts of accounts and start withdrawing money from my account. From there, they got my Social Security number. Once they had my Social Security number, they got all the rest of my information and they were just able to open up anything under my name.
KITTEN: How long did it take for you to realize that your identity had been stolen?
LODRICK: I would say a couple of days, because they withdrew out of my checking account $12,000 within a few days, so it was pretty dramatic to start with. But they kept being able to get money and open up loans and open up different accounts for about six months after that, until I caught them. The clean up lasted another six months, to get everything with my name and identity straight.
KITTEN: You mentioned that you had taken matters into your own hands. What steps did you take to find out whom had compromised your identity?
LODRICK: I did the things you are supposed to do, like get a police report and contacted the phone company. I contacted all of the companies that bill me; I contacted the bank. Everybody knew. With most companies, I would request that an alert to be put on my account. With the bank, I really worked with them because they didn't really seem to have a system in place for a password protect or an alert, and it took about six months. I learned the bank branches don't really talk to one another, so those who stole my identity would just go into a different bank branch and withdraw more money. So then I would go to that bank branch and tell them to put an alert on my account because this is just ridiculous. But, I finally worked with this one bank branch to figure out a universal way to get an alert put on my account, because there are hundreds of bank branches; finally, it seemed to be working. And then I got a phone call from a bank branch manager asking if could come in to come pick up my driver's license, which I had left there. Well, it turned out to be a fake driver's license left by the criminal; the license wasn't mine. The woman who was stealing my identity went in there to actually withdraw more money and the alert came up and she got nervous and left the fake driver's license.
The following day, I went down there to go get the driver's license, because I wanted to give it to the police, and it just so happened that she had the same idea. Waiting for the bank to open, next door at Starbuck's, I saw this woman and my gut told me "That's her." I had seen a surveillance photo and I put two and two together. After chasing her down the streets of San Francisco, I discovered that it was her, with 9-1-1 on the phone, waiting for them to come. The police pulled around the parking lot ,where I was standing, and found her hiding behind the cars.
KITTEN: How did you get involved with the council?
LODRICK: I was getting all of this media attention for capturing this woman, so I started an advocacy group. I had been doing this for a couple of years, just on a personal level helping victims. I felt like there has got to be something we can do; there has got to be something more out there. So, I started doing some research and saw that Neal had founded his organization. He asked if I wanted to start my own organization in San Francisco and it just so happened that he was already in the process of doing that. So, he did the launch, which we did in June, and I jumped onboard with him.
Putting ID Theft Victims FirstKITTEN: What do you see as being the most critical role the council will play over the next 12 months?
LODRICK: Assisting victims. That's the main goal. We want people to know our 800-number and know that we are out there. I would also like to see us helping law enforcement. They just don't have the resources, so if we could provide them with training, for law enforcement officers that are interested in this type of crime, I would love to see us do more of that; just improving overall awareness.
KITTEN: And what about the council's long-range goals? Being a victim of identity-theft yourself, what would you hope the council's priorities would be?
LODRICK: Staying focused on the victim and reaching out to major cities all over the country. Neal had mentioned this kind of neighborhood watch for identity theft; what a great concept and what a great idea. I would love to see it grow nationally.
KITTEN: Neal, could you tell us what your top three objectives for the council are as well as the top three areas of concern you deem most critical for law enforcement and the financial industry?
O'FARRELL: I think Karen hit on a lot of the objectives that we have, but if I were to add some things, I would say we surely need national support. We have a model and a recipe that we now know works. We have had so much community support in the Bay Area, and we need national support to take this model and this recipe to every other community in the country. Secondly, I think we really have to figure out a better way to improve education and awareness among consumers. Their awareness can be the first, best and cheapest line of defense against so many threats, but we are not winning that war. We need to do some more work there. And thirdly, we should look at a national database of victims of compromised identities, because law enforcement and victims waste so much time repeating the same message to credit card companies, to debt collectors, to district attorneys. We have to find some national way, particularly when it comes to Social Security numbers, to spread the word once an identity has been stolen. There is no easy way to put a fraud alert on our Social Security number and we need to figure that out.
Priorities in Fight Against ID TheftKITTEN: Could each of you to list the priorities you see lacking today when it comes to the fight against identity theft.
O'FARRELL: I think the most important thing we have to remember is we have got to get rid of the apathy. There is increasing apathy and indifference; I talked about a "perfect storm" at the start and we are seeing identity theft cases accelerate dramatically. We are seeing an increase in sophisticated malware, yet on the other side, we are seeing law enforcement virtually having to abandon the fight against identity theft. And we are seeing growing apathy among consumers, who feel that zero liability means they have got nothing to lose. We also have to change the attitude of financial institutions. They could be the key to this; virtually every consumer in America has a relationship with a financial institution. They can be the conduit; they can be the messenger; they are that trusted authority. And I think they can benefit tremendously, if they get on the awareness and education side and get a lot more committed. I think it would benefit their bottom lines at a time when they need it most.
KITTEN: And Karen?
LODRICK: I think there is a lack of understanding when it comes to how you can so fooled by these thieves, how easy it is. The smartest people can get fooled and become victims. I would like to see more awareness, more understanding and, definitely, more support and resources for victims. Our hotline number is (888) 771-0767, or they can contact us through our website at www.IdentityTheftCouncil.org.