In broad terms — including a thief's use of existing credit card, bank, or other accounts — the number of identity fraud victims in the United States ranges 9-10 million per year, or roughly 4% of the US adult population. The average annual theft per stolen identity was estimated at $6,383 in 2006, up approximately 22% from $5,248 in 2003; an increase in estimated total theft from $53.2 billion in 2003 to $56.6 billion in 2006. About three million Americans each year fall victim to the worst kind of identity fraud: new account fraud. Names, Social Security numbers, dates of birth, and other data are acquired fraudulently from the issuing organization, or from the victim then these data are used to create fraudulent identity documents. In turn, these are presented to other organizations as evidence of identity, used to open new lines of credit, secure loans, “flip” property, or otherwise turn a profit in a victim's name. This is much more time consuming — and typically more costly — to repair than fraudulent use of existing accounts. This research borrows from well-established theoretical backgrounds, in an effort to answer the question – what is it that makes identity documents credible? Most importantly, identification of the components of credibility draws upon personal construct psychology, the underpinning for the repertory grid technique, a form of structured interviewing that arrives at a description of the interviewee’s constructs on a given topic, such as credibility of identity documents. This represents substantial contribution to theory, being the first research to use the repertory grid technique to elicit from experts, their mental constructs used to evaluate credibility of different types of identity documents reviewed in the course of opening new accounts. The research identified twenty-one characteristics, different ones of which are present on different types of identity documents. Expert evaluations of these documents in different scenarios suggest that visual characteristics are most important for a physical document, while authenticated personal data are most important for a digital document.

This thesis reviews different types of identity theft and conducts and in-depth review of the threats to our personally identifiable information (PII). There has been an alarming increase in the availability of industry applications that aggregate our PII with the promise of convenience. This paper deeply explores three data aggregators: Google Mobile Wallet, COIN and PayPal Beacon, to understand what they are, potential security implications and how widespread data aggregation may alter the identity landscape as a whole. Discussion of common technologies leveraged by these data aggregators help illustrate the vulnerability of the data consumers are willingly sharing. In an attempt to better understand the crimes that steal and fraudulently use PII, this thesis introduces the ITAP, the Identity Theft Assessment and Prediction tool to illustrate why it is important to study theft and fraud as a business process. The paper presents a small, independent study conducted to emphasize the validly of both the business process ideology and usefulness of the results. Closing thoughts are presented to speculate what the future of identity could look like and how consumers may need to use the information gathered from tools such as the ITAP to shape best practices. The goal is to be two steps ahead instead of one step behind. / text

The purpose of this thesis was to research the systems issues surrounding identity fraud in New Zealand. There is only limited published research on the topic, either at an academic or industry level. The New Zealand Government has been conducting work in identity fraud in recent times but New Zealand appears to be lagging behind other similar westernised countries in terms of developing specific identity fraud policy or legislative provisions. The research showed that New Zealand does have serious problems in its systems, which in some cases facilitate identity fraud. There is a lack of synchronicity between New Zealand Government systems which undermines a whole of government approach to minimising the risk of identity fraud. Issues in the private sector with identity fraud are just as serious, with financial advantage being one of the main reasons that identity fraud is committed. However, the lack of information sharing between the public and private sectors does not help stem the flow of identity fraud that is currently occurring. Finding policy solutions to combat identity fraud is far from being simplistic. Public policy in this area is fraught with social, political and financial implications. Identity fraud is committed with speed while public policy faces a slow battle with red tape. Nonetheless, the New Zealand Government does not even appear to categorically know what is happening on its own door step with respect to identity fraud. There are no statistics on identity fraud and no concrete figures as to the cost of identity fraud to New Zealand. To compound problems, identity fraud is not even an official offence classification so even when it is occurring, it is not always being recorded. The damage resulting from identity fraud can be catastrophic. Identity fraud is a breeder crime for other offences. It can enable an act of terrorism to occur, women and children to be trafficked, and organisations and individuals to suffer serious financial loss. In New Zealand however, the benefits of identity fraud can be great while the deterrents are weak. New Zealand faces potential harm to its international reputation if its systems are not strengthened to fight identity fraud. In order for this to occur, New Zealand needs to develop a specific identity fraud policy so that it has the basic knowledge in place to allocate the necessary resources to this problem.

The purpose of this thesis was to research the systems issues surrounding identity fraud in New Zealand. There is only limited published research on the topic, either at an academic or industry level. The New Zealand Government has been conducting work in identity fraud in recent times but New Zealand appears to be lagging behind other similar westernised countries in terms of developing specific identity fraud policy or legislative provisions. The research showed that New Zealand does have serious problems in its systems, which in some cases facilitate identity fraud. There is a lack of synchronicity between New Zealand Government systems which undermines a whole of government approach to minimising the risk of identity fraud. Issues in the private sector with identity fraud are just as serious, with financial advantage being one of the main reasons that identity fraud is committed. However, the lack of information sharing between the public and private sectors does not help stem the flow of identity fraud that is currently occurring. Finding policy solutions to combat identity fraud is far from being simplistic. Public policy in this area is fraught with social, political and financial implications. Identity fraud is committed with speed while public policy faces a slow battle with red tape. Nonetheless, the New Zealand Government does not even appear to categorically know what is happening on its own door step with respect to identity fraud. There are no statistics on identity fraud and no concrete figures as to the cost of identity fraud to New Zealand. To compound problems, identity fraud is not even an official offence classification so even when it is occurring, it is not always being recorded. The damage resulting from identity fraud can be catastrophic. Identity fraud is a breeder crime for other offences. It can enable an act of terrorism to occur, women and children to be trafficked, and organisations and individuals to suffer serious financial loss. In New Zealand however, the benefits of identity fraud can be great while the deterrents are weak. New Zealand faces potential harm to its international reputation if its systems are not strengthened to fight identity fraud. In order for this to occur, New Zealand needs to develop a specific identity fraud policy so that it has the basic knowledge in place to allocate the necessary resources to this problem.

>Magister Scientiae - MSc / The recent years have seen an increase in the number of users accessing online services using communication devices such as computers, mobile phones and cards based credentials such as credit cards. This has prompted most governments and business organizations to change the way they do business and manage their identity information. The coming of the online services has however made most Internet users vulnerable to identity fraud and theft. This has resulted in a subsequent increase in the number of reported cases of identity theft and fraud, which is on the increase and costing the global industry excessive amounts. Today with more powerful and effective technologies such as artificial intelligence, wireless communication, mobile storage devices and biometrics, it should be possible to come up with a more effective multi-modal authentication system to help reduce the cases of identity fraud and theft. A multi-modal digital identity management system is proposed as a solution for managing digital identity information in an effort to reduce the cases of identity fraud and theft seen on most online services today. The proposed system thus uses technologies such as artificial intelligence and biometrics on the current unsecured networks to maintain the security and privacy of users and service providers in a transparent, reliable and efficient way. In order to be authenticated in the proposed multi-modal authentication system, a user is required to submit more than one credential attribute. An artificial intelligent technology is used to implement a technique of information fusion to combine the user’s credential attributes for optimum recognition. The information fusion engine is then used to implement the required multi-modal authentication system.

Detta examensarbete undersöker riskerna med elektronisk identifiering, mer specifikt säkerhetsrisker kring enheten BankID i Sverige. Idag används BankID i stor utsträckning, men elektronisk identifiering kommer också med vissa risker när det gäller identitetsrelaterade brott. I Sverige var brottstypen som ökade mest det senaste året mätt i anmälda brott, bedrägerier som huvudsakligen begåtts genom informationsteknik. Arbetet syftar därför till att undersöka vilka säkerhetsrisker som finns med den elektroniska identifieringen BankID, och hur Polismyndigheten och Ekobrottsmyndigheten bekämpar brott på detta område. Resultatet visar att den största säkerhetsrisken med BankID är användare/kunder som kan luras. Gärningsmän använder olika metoder för att få tillgång till andra personer BankID. Vad gäller hur Polismyndigheten och Ekobrottsmyndigheten bekämpar brott riktade mot elektronisk identifiering är resultatet delvis bristfälligt på grund av att Ekobrottsmyndigheten inte är representerade. Utifrån polisens perspektiv så undersöker de bedrägeri avseende BankID så som de gör med alla andra brott, men brottet har generellt en lägre prioritet inom myndigheten. Polisen samarbetar med olika aktörer samt bidrar båda till att utveckla produktens säkerhet och informera kunderna om säkerhet och risker avseende BankID. / This thesis investigates the threats against electronical identification, more specifically the danger that comes with the device BankID in Sweden. Today BankID is widely used but electronical identification also comes with certain security risks regarding identity related crimes. In Sweden, the crime type which increased the most last year 2018 measured in reported crimes was fraud mainly committed through information technology. This thesis therefore aim to investigate what the safety risks are using electronical identification, such as BankID and how the police force and Swedish Economic Crime Authority combat cybercrimes in this area. The result show that the main security risk with BankID is the customers that can be deceived. Perpetrators use different methods to get access to another individuals BankID. Regarding how the police force and Swedish Economic Crime Authority combat crimes against electronical identification, the result is partly defective due to that the Swedish Economic Crime Authority not being represented in this thesis. However, from the police perspective, they investigate fraud regarding BankID as all other crimes but it has in general a lower priority within the authority. The police cooperate with different actors and help both with development of the product security and inform customers about safety and risks regarding BankID.

<p>Consumer behaviour has and may increasingly have a vital role to play in protecting personal data. Understanding the behaviours of consumers in preventing identity theft and detecting identity fraud is therefore key to creating programs that minimize exposure and potential loss. In this study, based on the Theory of Planned Behaviour (TPB) and Protection Motivation Theory (PMT), an exploratory study elicited salient beliefs about identity theft prevention and detection behaviours. These beliefs were then used to create a survey to measure the strength of the salient beliefs, attitudes, intentions and behaviours, which was administered online and produced 351 valid responses. Statistical analysis was performed on eight behavioural groups, based primarily on principal component analysis of twelve behaviours. The groups were: using physical security, practicing password security, monitoring bank accounts and credit cards, getting a credit report, checking the land registry, using 'remember my password', clicking on a link in an e-mail, and giving out personal information over the phone. Results showed that beliefs with a significant influence on consumer intentions for a given behavioural group were a mix of beliefs about identity theft in general and beliefs about the behaviours in that group. While attitudes towards behaviours of consumers in any specific group had a significant influence on the intent to perform behaviours peculiar to that group, they had virtually no impact on the intent to perform behaviours in other groups. The intent to perform identity theft prevention and identity fraud detection behaviours uniformly had a statistically significant influence on actual reported behaviour, but much of the variance in behaviour was unexplained. An analysis of qualitative responses showed that gender, language and age all had significant impacts on respondents' likelihood of mentioning specific vulnerabilities, and prevention and detection measures.</p> / Doctor of Philosophy (PhD)

>Magister Scientiae - MSc / The recent years have seen an increase in the number of users accessing online services using communication devices such as computers, mobile phones and cards based credentials such as credit cards. This has prompted most governments and business organizations to change the way they do business and manage their identity information. The coming of the online services has however made most Internet users vulnerable to identity fraud and theft. This has resulted in a subsequent increase in the number of reported cases of identity theft and fraud, which is on the increase and costing the global industry excessive amounts. Today with more powerful and effective technologies such as artificial intelligence, wireless communication, mobile storage devices and biometrics, it should be possible to come up with a more effective multi-modal authentication system to help reduce the cases of identity fraud and theft. A multi-modal digital identity management system IS proposed as a solution for managing digital identity information in an effort to reduce the cases of identity fraud and theft seen on most online services today. The proposed system thus uses technologies such as artificial intelligence and biometrics on the current unsecured networks to maintain the security and privacy of users and service providers in a transparent, reliable and efficient way. In order to be authenticated in the proposed multi-modal authentication system, a user is required to submit more than one credential attribute. An artificial intelligent technology is used to implement a technique of information fusion to combine the user's credential attributes for optimum recognition. The information fusion engine is then used to implement the required multi-modal authentication system.

Medical identity fraud is a byproduct of identity theft; it enables imposters to procure medical treatment, thus defrauding patients, insurers, and government programs through forged prescriptions, falsified medical records, and misuse of victim's health insurance. In 2014, for example, the United States Government lost $14.1 billion in improper payments. The purpose of this multiple case study, grounded by the Health Insurance Portability and Accountability Act as the conceptual framework, was to explore the strategies 5 healthcare leaders used to prevent identity theft and medical identity fraud and thus improve business performance in the state of New York. Data were collected using telephone interviews and open-ended questions. The data were analyzed using Yin's 5 step process. Based on data analysis, 5 themes emerged including: training and education (resulting to sub-themes: train employees, train patients, and educate consumers), technology (which focused on Kiosk, cloud, off-site storage ending with encryption), protective measures, safeguarding personally identifiable information, and insurance. Recommendations calls for leaders of large, medium, and small healthcare organizations and other industries to educate employees and victims of identity theft because the problems resulting from fraud travel beyond the borders of medical facilities: they flow right into consumers' residences. Findings from this study may contribute to social change through improved healthcare services and reduced medical costs, leading to more affordable healthcare.

因為資通訊科技之普及發達，提升經濟、社會活動的便捷性並豐富人們的生活品質，但一面兩刃，它同時也蘊藏了新興犯罪的機會，對經濟、社會活動之正常運作帶來威脅。其中，身分資料偷竊及身分冒用（以下簡稱「身分竊用」），已然成為資訊社會時代嚴重的新興犯罪之一。「身分竊用」一般俗稱為「身分竊盜」，其係由英文原文identity theft直譯而來。其實身分無從竊盜起，英文原文的identity theft其實也是簡稱，完整的意義是identity theft and assumption，係指行為人未經授權擅用他人用已表彰其身分的證明或資訊，從而冒用他人之身分，遂行各式活動。本研究為求接近其實際文意內涵，在本研究中將其譯為「身分竊用」。 同為自由開放和高度科技化之社會，美國法律制度和社會機制環境雖與我多有不同，但其面對相同問題時的所受之影響和相對處理方式，或可為我國在處理同類問題時之參考。美國在身分竊用之相關法律，自從1970年代以降，至少制定20件以上的相關法律。先是從個人金融隱私權的保護著手，如在1970年制定《公平信用報告法》(FCRA)、1974年所制定的《隱私權法》(Privacy Act)。1998年則進一步制定通過《身分竊用嚇阻法》(Identity Theft and Assumption Deterrence Act)，明文規範「身分竊用」為刑事犯罪行為。《身分竊用嚇阻法》最重要價值是確認了身分被竊用的人也是犯罪被害者，相較於之前只有因犯罪者使用身分竊用手法而被詐騙失去財務的人才被認為是受害者 ，有了很大的進步。而之後的法律制定和實務處理即朝向個人資料保護、身分竊用預防和損害抑制，以及執法訴追等方向前進。 本研究以身分識別理論為起點，探討身分竊用在現代資訊社會中之角色和因身分識別資料被竊取冒用所發生之行為對個人社會和經濟的影響，蒐集美國聯邦自1970代迄今所制定和處理身分竊用相關之法律並予以摘錄分類，最後比較兩國對身分竊用問題處理之異同，並嘗試提出借鏡調和應用的建議。本研究蒐集整理，並將其群組為四種類型。分別是：（一）身分竊用罪法群；（二）個人身分證之相關法群；（三）消費者信用報告法群，以及（四）個人資料保護法群。 本研究發現，我國和美國雖然均面臨到身分竊用的問題，但因為國情和制度的不同，所受到的影響程度和所採取對應問題的方式也因此不同。例如：我國和美國在對個人識別號碼的態度和處理不同，美國是盡量打破個人利用單一獨特(unique)號碼進行識別的機制，而我國則是大量的使用。在個人身分證明文件上，我國較為統一，美國則較為分散，迄今尚未有全國統一性的身分識別證。在個人識別資料庫的建置和運用上，我國相對集中，美國重分散。我國對個人資料的保護是遵循歐盟模式，採取從上而下立法的方式。相反的，美國在個人資料保護作為上比較傾向建置一個結合法規、命令和自我管理的架構，而非由政府制訂的單一法規，係採由下而上模式。我國現在使用的國民身分證和身分證號在實體世界所建構的通用身分識別體系，因為個人資料庫雖分散但可集中連線查詢管理的特性，其在身分竊用防制機制的優勢因此建立。美國在對抗身分竊用問題所採取的方式雖因為國情和歷史的不同而和我國有相當程度的差異，但其在犯罪嚇阻控制上特別注意建立執法機關的查緝能力、訴追工具和司法機關量刑裁判的嚇阻效益，仍值得我國學習。本研究對於「美國聯邦量刑委員會」在其《量刑基準》上針對身分竊用罪的量刑考量及該委員會如此設計之源由稍有描述，或可為後續研究或實務參考之用。 / Identity theft is a form of stealing someone's identity in which someone pretends to be someone else by assuming that person's identity, typically in order to access resources or obtain credit and other benefits in that person's name. The first victim of identity theft is the person whose identity has been assumed by the identity thief and this person can suffer adverse consequences if they are held accountable for the perpetrator's actions. The other victims are those who were defrauded by identity theft tactics. Along with the prevalence of information and communication technology, identity theft is becoming a great threat to common people and even to national security. This study has collected more than 20 pieces of U.S.A. federal acts and statutes that related to combating identity theft problems. This study then categorizes then into 4 groups, namely 1) identity theft criminalization; 2) national personal identification system; 3) consumer credit report; and 4) personal data protection. In the mean time, this study also collected related laws and Taiwan (R.O.C.) for comparison. The government organization structures and legal systems between U.S.A. and Taiwan (R.O.C.) are very different, though the common goal of fighting identity theft is the same; the measures are quite different as well. In short, in terms of laws and personal identification system, the U.S.A. is more decentralized while in Taiwan (R.O.C.) it is more centralized. Taiwan (R.O.C.) has a national-wide and unified personal identification system that put it in a better position to respond and mitigate to identity theft impacts. On the other hand, from the law enforceability aspect, the study finds the U.S.A. provides better tools to law enforcement agencies and prosecutors to bring the offenders to justice in court and the judges have relatively more clear guidelines for case consideration and sentence.