Identify Theft in E- Commerce

By Ravi Das, President, HTG Solutions

Our last article examined Open Source Software, and its impact on E-Commerce. Specifically, the differentiation between Open Source and Closed Source Software was defined, the history of the development of various Open Source Software projects were examined (Linux, Apache, PostgreSQL, and MySQL), the advantages and disadvantages of Open Source Software was reviewed, and the impact of these Open Source Software tools on E-Commerce was also examined.

This article continues with the theme of E-Commerce. However, we will be looking at a problem which is becoming rampant today: Identity Theft. Every where go, and everywhere you read, there is always a case of ID Theft occurring on almost a daily basis. First, it was simply stealing a Credit Card Number or a Bank Account Number, but now ID Theft is occurring on a much larger scale, where it affects millions of people all at once. As we move more towards a wireless and mobile world, people who launch ID Theft attacks are becoming much more sophisticated in the manner in which these attacks are launched. We are also seeing a trend today where large corporations are becoming very complacent in protecting their customer databases from ID Theft attacks. There are also trends occurring where small, Wireless devices with enormous storage capacity being used in ID Theft, and confidential information is even sold on the Internet in auctioning processes.

This article will review and examine ID Theft, with the ultimate goal of making you proactive in protecting your identity. Specifically, this article is divided into the following sections:

•  A Formal Definition Of Identity Theft, And The Need To Be Proactive In Protecting Your Identity;

•  Real World Examples Of Identity Theft;

•  Where Identity Theft Can Occur;

4) How To Protect Yourself From Identity Theft.

A Formal Definition Of Identity Theft, And The Need To Be Proactive In Protecting Your Identity

The term “Identity Theft” has literally become a catch all phrase for any type of information which is stolen, whether the information is private or public. Therefore, it is important at this point to provide a specific definition of Identity Theft. For purposes of this article, Identity Theft can be defined as “The act of impersonating another, by means of using the person's information, such as birth date, Social Security number, address, name, and bank account information” (SOURCE: 1). Although the act of simply stealing one's confidential information is a crime, the key factor to be distinguished here is that this information is then used to claim to be somebody else (in other words, when somebody else assumes your identity as their own) with the ultimate goal for financial, monetary, and material gain. It is also important at this point to make the distinction between ID Theft and ID Fraud. ID Fraud simply involves making unauthorized charges and transactions to any financial accounts you may have. For example, ID Fraud

“. . . . consists mainly of someone making unauthorized charges to your credit card.” (SOURCE: 11). Remember, the keyword between ID Theft and ID Fraud is impersonation .

ID Theft simply used to mean the theft of personal information, as the definition states. However, with the growth of E-Commerce, the Internet, On Line Shopping, and Wireless capability, the definition of ID Theft can extended to include such things as the theft of usernames and passwords; the hijacking and theft of network login sessions; the theft of data packets, hijacking into the customer databases of large corporations; and so forth. Really, in a way, the growth of E-Commerce and especially Wireless has compounded the problem of ID Theft even more. Essentially, it can happen to anybody, at anytime, and worst yet, at very unpredictable extremes in the way that information can be stolen. For example, ID Theft can occur by a person simply rummaging through the garbage cans at the local dumpster (the technical term for this is known as “Dumpster Diving”, and will be discussed later), or ID Theft can also occur at your workplace, especially if you do most of your work via telecommuting over a Wireless connection. Imagine yourself sitting in a Café at the airport, and you are waiting for your flight. More than likely, you will be preoccupied with that all important business meeting. You connect your laptop computer to the Wireless, or “Hot Spot” connection at the café, and you access your work e-mail and important, as well as confidential customer data. But how do you know if the Wireless connection is for real? For example, there could be a person sitting right next to you, and this person could have set up a fake Wireless access point, and you have actually logged into that, thinking you have really connected to a safe, encrypted, and legitimate Wireless connection. Now, this person has all the access to your usernames and passwords, and customer information as a result of that fake, or “rogue” Wireless access point, and you are completely oblivious to all of this (this particular scenario is known as “The Evil Twins”, a form of a “Man In The Middle Attack”, and will be discussed later in the article).

However, despite the proliferation of ID Theft today, the ironic fact is that people are still reactive in protecting their confidential and personal information. The attitude seems to be, “Well, why should I care, it can't happen to me, because it has happened to the other person”. Well, the truth of the matter is that ID Theft can happen to you. The same mantra I give to business owners I am going to bring down to the level of the individual: Why not be proactive now, and take the necessary steps to protect your elf as much as possible, so that the chances are greatly reduced that you will not become a victim of ID Theft? Why wait to become a victim, then take the steps to protect yourself? Later in this article, we will review and examine protective steps you can take to avoid ID Theft.

Get the complete whitepaper here