WEBVTT 00:00:00.000 --> 00:00:02.819 Okay, let's unpack this. We are diving deep today 00:00:02.819 --> 00:00:07.599 into a topic that has really reshaped the whole 00:00:07.599 --> 00:00:10.939 landscape of personal security and finance identity 00:00:10.939 --> 00:00:14.019 piracy. For so long, we sort of treated identity 00:00:14.019 --> 00:00:17.320 theft as this niche crime, you know, a stolen 00:00:17.320 --> 00:00:20.239 wallet, a fraudulent credit card charge. But 00:00:20.239 --> 00:00:22.879 the sources you shared for this deep dive, they 00:00:22.879 --> 00:00:27.199 reveal a criminal ecosystem that is just. It's 00:00:27.199 --> 00:00:30.039 vast, it's specialized, and honestly, way more 00:00:30.039 --> 00:00:32.329 insidious than that simple definition. That's 00:00:32.329 --> 00:00:34.130 absolutely right. The listener shared a stack 00:00:34.130 --> 00:00:36.950 of material that moves so far beyond the headline 00:00:36.950 --> 00:00:39.729 -grabbing one -off breaches. We're dealing with 00:00:39.729 --> 00:00:41.890 what the material calls, well, a few different 00:00:41.890 --> 00:00:45.429 things. Identity theft, identity piracy, or identity 00:00:45.429 --> 00:00:47.590 infringement. Right, different names for a similar 00:00:47.590 --> 00:00:50.250 problem. Exactly. And our mission today is to 00:00:50.250 --> 00:00:52.850 give you a clear, synthesized map of this terrain. 00:00:53.329 --> 00:00:55.469 We're going to distinguish the seven faces of 00:00:55.469 --> 00:00:58.229 modern identity theft and explore why each one 00:00:58.229 --> 00:00:59.670 really demands a different kind of defensive 00:00:59.670 --> 00:01:02.780 posture. definition here is really important 00:01:02.780 --> 00:01:05.379 for setting the scope. This is the deliberate 00:01:05.379 --> 00:01:08.340 use of someone else's personal identifying information 00:01:08.340 --> 00:01:12.780 or PII. Right. Everything from their name and 00:01:12.780 --> 00:01:17.459 date of birth to electronic signatures, even 00:01:17.459 --> 00:01:20.060 fingerprints, all of it used without permission 00:01:20.060 --> 00:01:22.680 specifically to commit fraud or other crimes. 00:01:22.760 --> 00:01:25.500 It's really the weaponization of our personal 00:01:25.500 --> 00:01:28.260 data. It is. And it's fascinating how recent 00:01:28.260 --> 00:01:30.939 this all is, at least as a concept. The term 00:01:30.939 --> 00:01:33.359 identity theft was only coined back in 1964. 00:01:33.780 --> 00:01:36.599 Wow. That recent. That recent. But in the decades 00:01:36.599 --> 00:01:39.480 since, the theft and use of PII have just exploded 00:01:39.480 --> 00:01:41.980 into a global economic engine for criminal groups. 00:01:42.140 --> 00:01:44.299 And PII is the currency here. So we should probably 00:01:44.299 --> 00:01:47.099 clarify just how diverse that currency has become. 00:01:47.299 --> 00:01:49.239 It's not just your social security number anymore. 00:01:49.379 --> 00:01:51.620 No, not at all. The research details this huge 00:01:51.620 --> 00:01:54.219 expanding list of vulnerable data points. Your 00:01:54.219 --> 00:01:56.980 name, date of birth. Earth, SSN, bank account 00:01:56.980 --> 00:01:59.439 numbers, credit card numbers, PINs. Electronic 00:01:59.439 --> 00:02:01.680 signatures, biometric data like fingerprints. 00:02:02.019 --> 00:02:04.579 And of course, passwords. Anything that gives 00:02:04.579 --> 00:02:08.639 someone access to your money or your unique status, 00:02:08.740 --> 00:02:12.060 your digital self, basically, that's PII. And 00:02:12.060 --> 00:02:14.780 this brings us to a really important nuance that 00:02:14.780 --> 00:02:16.539 I think gets lost in the public conversation. 00:02:17.439 --> 00:02:20.819 The link between a massive data breach and immediate, 00:02:21.039 --> 00:02:23.639 you know, individual identity theft. Yes, this 00:02:23.639 --> 00:02:26.180 is a critical point. When you see a headline 00:02:26.180 --> 00:02:28.460 announcing a breach that affects millions of 00:02:28.460 --> 00:02:31.280 people, the immediate panic is that, you know, 00:02:31.280 --> 00:02:33.620 widespread identity theft is already happening 00:02:33.620 --> 00:02:36.219 to all of them. But the reality, according to 00:02:36.219 --> 00:02:38.879 the research we looked at, it's a lot more complex, 00:02:39.080 --> 00:02:40.819 isn't it? It's much more complex. There is a 00:02:40.819 --> 00:02:42.939 U .S. Government Accountability Office study 00:02:42.939 --> 00:02:46.240 that noted that most breaches have not resulted 00:02:46.240 --> 00:02:48.819 in detected incidents of identity theft. So if 00:02:48.819 --> 00:02:51.060 your data is stolen, but the immediate fraud 00:02:51.060 --> 00:02:54.319 rate is low, I mean, what's happening? Is the 00:02:54.319 --> 00:02:56.460 data just sitting in a file somewhere? That's 00:02:56.460 --> 00:02:58.400 the million -dollar question. And one study even 00:02:58.400 --> 00:03:00.379 reported that the probability of you becoming 00:03:00.379 --> 00:03:03.180 a victim as a direct result of a specific data 00:03:03.180 --> 00:03:06.379 breach is only around 2%. 2%. That seems incredibly 00:03:06.379 --> 00:03:08.860 low. It does, but that low number doesn't mean 00:03:08.860 --> 00:03:11.000 the risk is gone. It just means it's not immediate. 00:03:11.080 --> 00:03:14.539 It underscores a critical point. The theft of 00:03:14.539 --> 00:03:17.639 the information, the breach, isn't always followed 00:03:17.639 --> 00:03:20.840 right away by the fraud, the identity theft itself. 00:03:21.139 --> 00:03:23.259 So it's delayed. It's delayed weaponization. 00:03:23.960 --> 00:03:26.659 The stolen data might be old, it might be incomplete, 00:03:26.979 --> 00:03:29.099 or, and this is the key, it might be sitting 00:03:29.099 --> 00:03:31.080 with a criminal organization that's waiting. 00:03:31.280 --> 00:03:33.360 Waiting for what? Waiting to aggregate it with 00:03:33.360 --> 00:03:36.180 other data, or just waiting for the right time 00:03:36.180 --> 00:03:38.840 or the right group of victims to maximize their 00:03:38.840 --> 00:03:41.240 profit. The sources are really careful to warn 00:03:41.240 --> 00:03:43.719 that the full scope of these delayed consequences 00:03:43.719 --> 00:03:47.060 is, well, it's largely an unknown. So our mission 00:03:47.060 --> 00:03:49.139 today is to move past those high -level stats 00:03:49.139 --> 00:03:50.840 and really understand the different types of 00:03:50.840 --> 00:03:53.219 attacks. Exactly, and the real -world, sometimes 00:03:53.219 --> 00:03:55.840 decade -long consequences that follow. That distinction 00:03:55.840 --> 00:03:58.300 you made between the theft of information and 00:03:58.300 --> 00:04:00.639 the weaponization of identity, I think that's 00:04:00.639 --> 00:04:03.580 the perfect foundation for this dive. So let's 00:04:03.580 --> 00:04:06.319 start with how these crimes scale. Section 1 00:04:06.319 --> 00:04:09.259 focuses on exactly that, when cybercrime gets 00:04:09.259 --> 00:04:13.110 easy. The technological shift toward accessible, 00:04:13.349 --> 00:04:17.129 high -impact cybercrime is, I think, maybe the 00:04:17.129 --> 00:04:20.370 most worrying trend. The material quotes Gunter 00:04:20.370 --> 00:04:22.129 Ullmann, who summed it up brilliantly. He said, 00:04:22.250 --> 00:04:24.990 interested in credit card theft. There's an app 00:04:24.990 --> 00:04:27.829 for that. That framing from, you know, specialized 00:04:27.829 --> 00:04:30.769 coding to just an app that says so much about 00:04:30.769 --> 00:04:33.569 how low the barrier to entry has become. We're 00:04:33.569 --> 00:04:35.029 not talking about needing to be some kind of 00:04:35.029 --> 00:04:37.310 master coder anymore. Not at all. And the Zeus 00:04:37.310 --> 00:04:39.389 malicious software is the prime example of this. 00:04:39.529 --> 00:04:43.310 Zeus is a type of crime where that is incredibly 00:04:43.310 --> 00:04:46.050 hacker friendly. It's basically a toolkit that 00:04:46.050 --> 00:04:48.269 even inexperienced hackers can use to pull off 00:04:48.269 --> 00:04:50.329 large scale financial crime. So what does that 00:04:50.329 --> 00:04:52.209 toolkit actually do? How does it get the PII? 00:04:52.639 --> 00:04:55.939 Zeus is a very sophisticated Trojan horse, and 00:04:55.939 --> 00:04:58.579 it's designed specifically to steal banking information. 00:04:59.060 --> 00:05:02.000 It uses key logging to record what you type when 00:05:02.000 --> 00:05:04.240 you enter your bank login. And it uses something 00:05:04.240 --> 00:05:06.879 called form grabbing, which intercepts data you 00:05:06.879 --> 00:05:09.060 submit in web forms before it gets encrypted. 00:05:09.339 --> 00:05:11.300 So it can just harvest credit card info, important 00:05:11.300 --> 00:05:14.399 documents. And this is a critical escalation 00:05:14.399 --> 00:05:17.019 of risk mentioned in the sources documents necessary 00:05:17.019 --> 00:05:20.100 for homeland security. Things like... digital 00:05:20.100 --> 00:05:23.649 passport files or internal government PII. The 00:05:23.649 --> 00:05:26.170 moment you link PII theft to Homeland Security 00:05:26.170 --> 00:05:29.290 documents, you've moved this crime from the business 00:05:29.290 --> 00:05:31.449 section of the newspaper straight to the national 00:05:31.449 --> 00:05:33.569 security section. Absolutely. If a hacker gets 00:05:33.569 --> 00:05:35.850 that level of information, the consequences could 00:05:35.850 --> 00:05:38.769 range from massive financial identity theft to 00:05:38.769 --> 00:05:43.170 facilitating espionage or even terrorism. The 00:05:43.170 --> 00:05:45.870 sources are very clear. ID theft is a facilitator. 00:05:45.930 --> 00:05:48.490 It's a foundational crime that funds or enables 00:05:48.490 --> 00:05:51.329 other even more severe crimes. Like illegal immigration. 00:05:51.970 --> 00:05:54.689 Terrorism. Phishing campaigns, espionage. It's 00:05:54.689 --> 00:05:56.970 the fuel for the engine of organized crime. And 00:05:56.970 --> 00:05:59.410 to get a handle on the sheer scale, the material 00:05:59.410 --> 00:06:01.949 sites in ITAC estimate that about 15 million 00:06:01.949 --> 00:06:04.610 Americans had their identity stolen way back 00:06:04.610 --> 00:06:07.110 in 2012. Right. And that figure, even being a 00:06:07.110 --> 00:06:09.449 decade old, shows how pervasive this issue was 00:06:09.449 --> 00:06:11.370 before a lot of these sophisticated tools became 00:06:11.370 --> 00:06:14.810 even easier to use. That 15 million number, it 00:06:14.810 --> 00:06:17.149 really helps us understand why we need to categorize 00:06:17.149 --> 00:06:19.850 the damage. It confirms this is not a small, 00:06:19.889 --> 00:06:23.680 localized problem. It is a mass digitized threat. 00:06:23.879 --> 00:06:26.300 Which is why just thinking of it as stolen credit 00:06:26.300 --> 00:06:29.019 is completely insufficient. This leads us right 00:06:29.019 --> 00:06:32.240 into the heart of it all. If the tools make the 00:06:32.240 --> 00:06:34.579 crime easy, let's look at where the perpetrators 00:06:34.579 --> 00:06:37.680 are aiming their efforts. Identity theft is a 00:06:37.680 --> 00:06:40.220 spectrum. We're going to dive into the core material 00:06:40.220 --> 00:06:43.860 now and break down the distinct categories. Our 00:06:43.860 --> 00:06:46.379 sources lay this out as the seven distinct faces 00:06:46.379 --> 00:06:48.959 of stolen identity. And this is where we stop 00:06:48.959 --> 00:06:51.639 generalizing and really start analyzing the specific 00:06:51.639 --> 00:06:53.920 mechanics of the crime and its impact on the 00:06:53.920 --> 00:06:56.120 victim and on society. We'll start with the most 00:06:56.120 --> 00:06:58.860 familiar territory, Section 2 .1, financial and 00:06:58.860 --> 00:07:01.620 tax identity theft, the common thread. Financial 00:07:01.620 --> 00:07:03.579 identity theft is, yeah, it's the most common 00:07:03.579 --> 00:07:06.040 type. It's using another person's identity to 00:07:06.040 --> 00:07:09.040 get credit, loans, goods, services. This is the 00:07:09.040 --> 00:07:10.759 one that usually shows up first when the victim 00:07:10.759 --> 00:07:12.899 gets a bill or a collection notice for something 00:07:12.899 --> 00:07:14.939 they never bought. Or a notice that a new credit 00:07:14.939 --> 00:07:17.759 line was opened in their name. Exactly. But it's 00:07:17.759 --> 00:07:20.220 sibling crime, tax identity theft. That's where 00:07:20.220 --> 00:07:22.959 the bureaucracy really becomes a weapon against 00:07:22.959 --> 00:07:26.240 you. How does that specific scheme work? What's 00:07:26.240 --> 00:07:28.300 the method? Tax identity theft relies heavily 00:07:28.300 --> 00:07:31.800 on two things. Speed and the victim's social 00:07:31.800 --> 00:07:34.759 security number. The standard method is for a 00:07:34.759 --> 00:07:38.019 thief to use the victim's real PII name, address, 00:07:38.120 --> 00:07:42.019 SSN to file a fraudulent tax return super early 00:07:42.019 --> 00:07:43.899 in the filing season. Before the real person 00:07:43.899 --> 00:07:46.560 gets a chance to. Right. The thief claims a huge 00:07:46.560 --> 00:07:49.660 refund and has the IRS deposit it into an account 00:07:49.660 --> 00:07:51.879 they control, which is often just a prepaid debit 00:07:51.879 --> 00:07:54.019 card. And the victim only finds out when they 00:07:54.019 --> 00:07:56.639 go to file their legitimate return and the IRS 00:07:56.639 --> 00:07:58.759 system just kicks it back saying a return has 00:07:58.759 --> 00:08:01.279 already been filed for that SSN. I can't imagine 00:08:01.279 --> 00:08:04.170 the nightmare of trying to. It creates a massive 00:08:04.170 --> 00:08:06.769 burden of proof for the victim. But there's a 00:08:06.769 --> 00:08:09.730 second risk here that's just as damaging. the 00:08:09.730 --> 00:08:12.490 employment -related scheme. What's that? A thief 00:08:12.490 --> 00:08:15.149 can use the victim's SSN to get a job they couldn't 00:08:15.149 --> 00:08:17.449 otherwise get. The employer reports the income 00:08:17.449 --> 00:08:20.790 to the IRS under the victim's SSN, and all of 00:08:20.790 --> 00:08:23.370 a sudden the real taxpayer has this huge income 00:08:23.370 --> 00:08:26.490 discrepancy. So the IRS flags their account and 00:08:26.490 --> 00:08:28.970 demands taxes on money they never earned. Exactly. 00:08:29.069 --> 00:08:31.550 So now the victim has to prove they didn't file 00:08:31.550 --> 00:08:33.769 the fraudulent return and prove they didn't work 00:08:33.769 --> 00:08:36.269 at the job the thief used their SSN for. It's 00:08:36.269 --> 00:08:39.330 a long, long road to getting clear. It sounds 00:08:39.330 --> 00:08:42.070 like it. What's the solution? Well the IRS recognized 00:08:42.070 --> 00:08:43.990 this vulnerability and developed a response. 00:08:44.600 --> 00:08:48.519 The victim has to file Form 14039, the Identity 00:08:48.519 --> 00:08:51.600 Theft Affidavit. Okay. Once the IRS validates 00:08:51.600 --> 00:08:54.279 their claim, the victim is issued an Identity 00:08:54.279 --> 00:08:57.179 Protection Personal Identification Number, or 00:08:57.179 --> 00:09:01.000 an IPPN. An IPPN. It's a six -digit code that 00:09:01.000 --> 00:09:03.740 permanently replaces their SSN just for tax filing. 00:09:03.919 --> 00:09:06.340 So that IPPN is basically like a two -factor 00:09:06.340 --> 00:09:08.559 authentication for the whole tax system? It's 00:09:08.559 --> 00:09:10.659 an admission that the SSN alone is just not a 00:09:10.659 --> 00:09:13.019 secret anymore. Precisely. It hardens their defense 00:09:13.019 --> 00:09:15.539 against future tax - because it recognizes that 00:09:15.539 --> 00:09:17.740 their main identifier has been permanently exposed. 00:09:18.100 --> 00:09:20.100 Let's move on to a type that completely changes 00:09:20.100 --> 00:09:23.860 the battlefield. Section 2 .2, criminal identity 00:09:23.860 --> 00:09:26.799 theft. We're leaving the financial world now 00:09:26.799 --> 00:09:30.100 and entering the legal system. And this is a 00:09:30.100 --> 00:09:33.419 truly devastating form of identity theft. The 00:09:33.419 --> 00:09:35.820 consequences are immediate and they're legal. 00:09:36.480 --> 00:09:39.679 It happens when a criminal fraudulently identifies 00:09:39.679 --> 00:09:42.059 themselves to law enforcement at the moment they're 00:09:42.059 --> 00:09:44.320 arrested. And they do that using a fake or stolen 00:09:44.320 --> 00:09:47.480 ID. Right. They might have a fake driver's license 00:09:47.480 --> 00:09:50.139 they bought or one they stole. So that means 00:09:50.139 --> 00:09:53.419 the charges, any warrants, a failure to appear 00:09:53.419 --> 00:09:56.360 history, it all gets filed under the victim's 00:09:56.360 --> 00:09:58.759 name. How does a victim even find out about this? 00:09:58.960 --> 00:10:00.879 They often find out through these incredibly 00:10:00.879 --> 00:10:04.220 stressful, indirect ways, and usually long after 00:10:04.220 --> 00:10:06.460 it's happened. They might get a court summons 00:10:06.460 --> 00:10:09.019 for a felony they never committed, or, and this 00:10:09.019 --> 00:10:11.179 is a more common example, they get stopped for 00:10:11.179 --> 00:10:13.080 a routine traffic violation only to find out 00:10:13.080 --> 00:10:14.840 their license has been suspended because of an 00:10:14.840 --> 00:10:17.019 outstanding warrant in a state they've never 00:10:17.019 --> 00:10:19.039 even been to. Or a background check for a new 00:10:19.039 --> 00:10:22.080 job fails. That's the worst. Suddenly a potential 00:10:22.080 --> 00:10:24.379 employer sees a list of offenses that aren't 00:10:24.379 --> 00:10:27.980 theirs. And once your identity is tangled up 00:10:27.980 --> 00:10:30.679 with the criminal justice system, I have to imagine 00:10:30.679 --> 00:10:33.460 that Proving you're innocent is exponentially 00:10:33.460 --> 00:10:35.879 harder than clearing up a bad credit report. 00:10:36.059 --> 00:10:38.600 It is exponentially more difficult. The victim 00:10:38.600 --> 00:10:41.340 gets thrown into this incredibly complex bureaucratic 00:10:41.340 --> 00:10:44.299 fight. To clear their record, they usually have 00:10:44.299 --> 00:10:46.460 to track down the original arresting officers. 00:10:46.820 --> 00:10:49.139 If they can even find them. Right. Then they 00:10:49.139 --> 00:10:51.580 have to prove their true identity through modern, 00:10:51.620 --> 00:10:54.340 reliable means like fingerprinting or maybe even 00:10:54.340 --> 00:10:57.200 DNA testing, and then go through the whole process 00:10:57.200 --> 00:10:59.700 of getting the court records formally expunged. 00:10:59.799 --> 00:11:02.169 But the research... points out this terrifying 00:11:02.169 --> 00:11:05.350 lasting impact. Even if you convince the court, 00:11:05.470 --> 00:11:07.970 something remains, doesn't it? It does. There 00:11:07.970 --> 00:11:10.750 are two persistent problems here. First, law 00:11:10.750 --> 00:11:13.070 enforcement agencies might permanently keep the 00:11:13.070 --> 00:11:15.649 victim's name as an alias for the criminal in 00:11:15.649 --> 00:11:18.409 their internal databases. So your name is forever 00:11:18.409 --> 00:11:20.789 linked to that crime. That's unbelievable. And 00:11:20.789 --> 00:11:23.649 second, data aggregators, the third party companies 00:11:23.649 --> 00:11:26.009 that supply info to background check services, 00:11:26.309 --> 00:11:29.409 they are notoriously slow to update their records 00:11:29.409 --> 00:11:31.809 if they do it at all. So even if the court record 00:11:31.809 --> 00:11:34.919 is officially cleared. The incorrect criminal 00:11:34.919 --> 00:11:37.480 history can just live on in these other systems 00:11:37.480 --> 00:11:40.580 for years, continuing to affect your job prospects, 00:11:40.879 --> 00:11:43.720 your housing options. And the source material 00:11:43.720 --> 00:11:46.919 mentions the very real psychological trauma that 00:11:46.919 --> 00:11:50.360 comes with that. But the digital ghost of the 00:11:50.360 --> 00:11:53.220 crime just stays there, haunting your life. That's 00:11:53.220 --> 00:11:55.980 a profound system failure. It really is. It shows 00:11:55.980 --> 00:11:58.639 that in our digital age, clearing your name isn't 00:11:58.639 --> 00:12:01.279 just about convincing one judge. It's about convincing 00:12:01.279 --> 00:12:03.799 hundreds of separate, independent databases. 00:12:04.340 --> 00:12:07.820 Okay, let's transition to 2 .3. Synthetic identity 00:12:07.820 --> 00:12:11.169 theft. This one feels different. It's like an 00:12:11.169 --> 00:12:13.309 attack on the system itself, creating a phantom 00:12:13.309 --> 00:12:15.549 citizen. That's a great way to put it. Synthetic 00:12:15.549 --> 00:12:17.610 identity theft is where the identities are either 00:12:17.610 --> 00:12:19.710 completely or partially fabricated. It's very 00:12:19.710 --> 00:12:22.129 technical, very surgical. The most common method 00:12:22.129 --> 00:12:24.730 is combining a real social security number. Often 00:12:24.730 --> 00:12:26.870 a clean one, like from a child? Exactly, a clean 00:12:26.870 --> 00:12:29.210 one with a fake name and birth date that have 00:12:29.210 --> 00:12:31.990 no previous connection to the person whose SSN 00:12:31.990 --> 00:12:34.970 it is. Why do that? Why create a fake person 00:12:34.970 --> 00:12:37.590 instead of just stealing a whole identity package? 00:12:37.710 --> 00:12:41.250 What makes this approach... so insidious. It's 00:12:41.250 --> 00:12:44.169 insidious because it exploits weaknesses in the 00:12:44.169 --> 00:12:46.970 credit granting algorithm. A completely stolen 00:12:46.970 --> 00:12:49.830 identity might trigger a fraud alert right away 00:12:49.830 --> 00:12:53.149 because, you know, the address or spending habits 00:12:53.149 --> 00:12:55.730 suddenly change. Right. A synthetic identity, 00:12:55.929 --> 00:12:58.590 though, is a new identity. It lets the criminal 00:12:58.590 --> 00:13:02.370 slowly and methodically age that identity. So 00:13:02.370 --> 00:13:04.470 they create the identity, they wait, and then 00:13:04.470 --> 00:13:07.450 they start building a fake but credible credit 00:13:07.450 --> 00:13:10.470 history. Precisely. They start small, maybe with 00:13:10.470 --> 00:13:12.470 a little store credit card, and they pay the 00:13:12.470 --> 00:13:14.889 bills on time for months. They're essentially 00:13:14.889 --> 00:13:16.830 building a high -quality credit score on the 00:13:16.830 --> 00:13:20.169 back of a real SSN. This slow, steady activity 00:13:20.169 --> 00:13:22.990 bypasses a lot of the usual fraud detection systems. 00:13:23.330 --> 00:13:25.690 So it sounds like this kind of fraud hurts the 00:13:25.690 --> 00:13:27.750 creditors who give out the big loans in the end 00:13:27.750 --> 00:13:30.929 more so than the person whose SSN was used. Initially, 00:13:31.009 --> 00:13:33.929 yes. The creditors are the main financial victims. 00:13:34.389 --> 00:13:37.289 But the individual whose SSN was stolen is still 00:13:37.289 --> 00:13:40.330 harmed. Since the synthetic identity is tied 00:13:40.330 --> 00:13:43.269 to their real SSN, the fraud might show up as 00:13:43.269 --> 00:13:45.470 some kind of anomaly on their credit file. It 00:13:45.470 --> 00:13:47.409 could even create a new sub file. And if that 00:13:47.409 --> 00:13:50.350 sub file goes bad. When the thief finally maxes 00:13:50.350 --> 00:13:53.110 out the credit and disappears. All that negative 00:13:53.110 --> 00:13:55.429 information can impact the real person's credit 00:13:55.429 --> 00:13:58.190 score. It can cause them to be denied for loans 00:13:58.190 --> 00:14:00.629 in the future. It's an attack on the institutional 00:14:00.629 --> 00:14:03.330 trust that's built around the SSN. Let's move 00:14:03.330 --> 00:14:06.870 on to 2 .4, medical identity theft. This is where 00:14:06.870 --> 00:14:09.029 identity fraud becomes a direct threat to your 00:14:09.029 --> 00:14:11.070 actual health and safety. This is a critical 00:14:11.070 --> 00:14:13.929 one. The first major analysis was done by a privacy 00:14:13.929 --> 00:14:16.970 researcher named Pam Dixon back in 2006, and 00:14:16.970 --> 00:14:19.029 she really highlighted the unique dangers here. 00:14:19.149 --> 00:14:21.730 The crime involves someone seeking medical care 00:14:21.730 --> 00:14:24.750 or getting prescription drugs using another person's 00:14:24.750 --> 00:14:26.789 identity or their insurance card. The financial 00:14:26.789 --> 00:14:29.429 risk is obvious. You get fraudulent bills. But 00:14:29.429 --> 00:14:31.710 let's focus on that life -threatening dual harm 00:14:31.710 --> 00:14:34.629 the sources mentioned. Right. Beyond the money, 00:14:34.750 --> 00:14:37.389 the thief's medical history, their diagnoses, 00:14:37.389 --> 00:14:39.730 treatments, their medications, even their allergies, 00:14:39.970 --> 00:14:42.730 it all becomes permanently mixed in with the 00:14:42.730 --> 00:14:45.129 victim's own medical record. Which means a doctor 00:14:45.129 --> 00:14:47.950 looking at that contaminated record could make 00:14:47.950 --> 00:14:51.480 a disastrous clinical decision. Absolutely. The 00:14:51.480 --> 00:14:53.659 research really emphasizes that this inaccurate 00:14:53.659 --> 00:14:56.500 information is incredibly difficult to correct 00:14:56.500 --> 00:14:59.440 in modern electronic health record systems. This 00:14:59.440 --> 00:15:02.139 contaminated history can affect your future insurability, 00:15:02.379 --> 00:15:05.240 and critically, it could cause a doctor to prescribe 00:15:05.240 --> 00:15:07.919 the wrong care. Or rely on a false diagnosis. 00:15:08.340 --> 00:15:10.580 Or give you a drug you're allergic to because 00:15:10.580 --> 00:15:12.659 the thief's allergy got entered into your file. 00:15:12.940 --> 00:15:16.100 It creates a direct and potentially fatal health 00:15:16.100 --> 00:15:19.179 hazard. That puts a huge premium on medical data 00:15:19.179 --> 00:15:22.279 for cybercriminals. Why is medical PII reportedly 00:15:22.279 --> 00:15:24.759 so much more valuable than a credit card number? 00:15:24.960 --> 00:15:27.279 It's exponentially more valuable because of its 00:15:27.279 --> 00:15:30.080 depth and its permanence. Medical data stored 00:15:30.080 --> 00:15:32.080 by hospitals or insurance companies contains 00:15:32.080 --> 00:15:35.340 decades of verified PII, combined with insurance 00:15:35.340 --> 00:15:38.019 details and often financial information. It's 00:15:38.019 --> 00:15:40.220 a much richer data set. It's a complete profile. 00:15:40.700 --> 00:15:43.299 And the sources say this data is worth up to 00:15:43.299 --> 00:15:46.159 10 times more to cyber criminals than a standard 00:15:46.159 --> 00:15:48.580 credit card number, which has a much shorter 00:15:48.580 --> 00:15:50.860 shelf life before it gets canceled. This high 00:15:50.860 --> 00:15:53.220 stakes reality is what drove a regulatory change 00:15:53.220 --> 00:15:55.480 in the U .S., right? It did. The Health Insurance 00:15:55.480 --> 00:15:59.039 Portability and Accountability Act, IPAE, was 00:15:59.039 --> 00:16:02.279 expanded. Now it requires medical breach notification 00:16:02.279 --> 00:16:05.299 if 500 or more people are affected. It was a 00:16:05.299 --> 00:16:07.860 direct attempt to force organizations to be more 00:16:07.860 --> 00:16:10.330 diligent. about protecting this incredibly sensitive 00:16:10.330 --> 00:16:15.149 data. Next up, 2 .5, child identity theft. This 00:16:15.149 --> 00:16:17.269 one is really about stealing a future because 00:16:17.269 --> 00:16:20.870 the crime can sit there undetected for a decade 00:16:20.870 --> 00:16:23.250 or more. It's one of the most long term devastating 00:16:23.250 --> 00:16:25.669 forms. Children are targeted precisely because 00:16:25.669 --> 00:16:27.629 their social security numbers are clean. They 00:16:27.629 --> 00:16:29.490 have no credit history. So a fraudulent account 00:16:29.490 --> 00:16:32.250 open under their SSN is unlikely to get flagged 00:16:32.250 --> 00:16:34.269 until that child, maybe at age 18, applies for 00:16:34.269 --> 00:16:37.149 a job or student loan. And that study we saw 00:16:37.149 --> 00:16:39.090 found that over 10 percent of children studied 00:16:39.090 --> 00:16:41.830 were victims. That is a staggering number. It 00:16:41.830 --> 00:16:44.470 is. The FTC estimated that hundreds of thousands 00:16:44.470 --> 00:16:47.269 of children were victims back in 2008, often 00:16:47.269 --> 00:16:50.370 saddled with an average debt of nearly $13 ,000 00:16:50.370 --> 00:16:53.129 to deal with when they finally discovered the 00:16:53.129 --> 00:16:55.610 fraud. And that's not just a financial burden. 00:16:56.429 --> 00:16:58.610 It's a foundational challenge to their reputation 00:16:58.610 --> 00:17:01.549 that can take years to fix. It can take a decade 00:17:01.549 --> 00:17:04.589 to unwind. And the research highlights that foster 00:17:04.589 --> 00:17:07.670 children are particularly at risk. Why them specifically? 00:17:07.930 --> 00:17:10.109 Because of the nature of the system. Their PII, 00:17:10.250 --> 00:17:13.170 especially their SSNs, get shared frequently 00:17:13.170 --> 00:17:16.549 among multiple agencies, social workers, government 00:17:16.549 --> 00:17:18.690 and non -government groups. So more exposure. 00:17:18.890 --> 00:17:21.650 A much higher exposure rate. And that's compounded 00:17:21.650 --> 00:17:23.470 by the fact that many of these kids transition 00:17:23.470 --> 00:17:25.630 out of the system without a strong support network. 00:17:25.710 --> 00:17:27.930 work. So they're often left all alone to try 00:17:27.930 --> 00:17:30.329 and fix the bad credit that was created for them. 00:17:30.470 --> 00:17:32.910 And then there's the related crime, digital kidnapping. 00:17:33.190 --> 00:17:35.710 This is a modern form of identity infringement 00:17:35.710 --> 00:17:38.390 that really exploits social media oversharing. 00:17:39.230 --> 00:17:42.009 Digital kidnapping is when someone steals online 00:17:42.009 --> 00:17:44.789 images of children, photos that parents share 00:17:44.789 --> 00:17:47.849 innocently, and then creates entirely fake digital 00:17:47.849 --> 00:17:50.190 stories misrepresenting those children as their 00:17:50.190 --> 00:17:52.569 own. So it's not directly financial, but it's 00:17:52.569 --> 00:17:54.730 still a violation. A significant violation of 00:17:54.730 --> 00:17:56.930 personal identity and privacy. It's creating 00:17:56.930 --> 00:17:59.509 a false history for a real person. Our last two 00:17:59.509 --> 00:18:03.210 faces, 2 .6, are identity cloning and concealment. 00:18:03.349 --> 00:18:06.190 What makes these different from the profit -driven 00:18:06.190 --> 00:18:08.309 financial crimes we've been talking about? Cloning 00:18:08.309 --> 00:18:10.230 and concealment are mainly about establishing 00:18:10.230 --> 00:18:12.569 a false identity to hide the thief's true self. 00:18:13.049 --> 00:18:16.049 The goal is evasion, not necessarily to maximize 00:18:16.049 --> 00:18:18.890 credit or financial gain. So if the motive isn't 00:18:18.890 --> 00:18:21.259 credit card fraud, what is it? Motives vary, 00:18:21.420 --> 00:18:24.079 but they center on avoidance. It could be illegal 00:18:24.079 --> 00:18:26.279 immigrants trying to conceal their status, people 00:18:26.279 --> 00:18:28.559 hiding from creditors, or criminals trying to 00:18:28.559 --> 00:18:31.940 avoid warrants. The source also mentions posers, 00:18:32.000 --> 00:18:34.359 people who steal photos and personal histories 00:18:34.359 --> 00:18:37.539 to create fake personas on social media. The 00:18:37.539 --> 00:18:40.059 goal is just to appear as someone else. And the 00:18:40.059 --> 00:18:42.079 big difference in detection is that these crimes 00:18:42.079 --> 00:18:45.460 don't have the obvious financial signals. Exactly. 00:18:45.920 --> 00:18:49.589 Financial theft is noisy. It creates debt. Collection 00:18:49.589 --> 00:18:52.869 calls, fraud alerts, concealment, on the other 00:18:52.869 --> 00:18:55.329 hand, can go on forever without being detected, 00:18:55.569 --> 00:18:57.869 especially if the thief gets false credentials 00:18:57.869 --> 00:19:00.450 like a new driver's license. The victim might 00:19:00.450 --> 00:19:03.170 never know they've been cloned. Until some critical 00:19:03.170 --> 00:19:06.029 life event forces it to the surface. Right, like 00:19:06.029 --> 00:19:08.390 a job application that requires a deep background 00:19:08.390 --> 00:19:10.750 check. Okay, we've mapped the seven distinct 00:19:10.750 --> 00:19:14.170 faces. Together, they paint this picture of a 00:19:14.170 --> 00:19:17.549 pervasive, multi -layered threat. Now let's turn 00:19:17.549 --> 00:19:21.640 to Section 3. the threat ecosystem. If we want 00:19:21.640 --> 00:19:23.440 to defend ourselves, we have to understand how 00:19:23.440 --> 00:19:26.279 these identity pirates get and profit from our 00:19:26.279 --> 00:19:29.180 PII and what protective measures actually work. 00:19:29.339 --> 00:19:31.519 Understanding the acquisition methods is vital 00:19:31.519 --> 00:19:33.720 because it gets rid of the idea that all identity 00:19:33.720 --> 00:19:36.400 theft requires some master hacker. It's often 00:19:36.400 --> 00:19:38.559 just a mix of low -tech garbage picking and high 00:19:38.559 --> 00:19:40.339 -tech intrusion. Let's start with the low -tech 00:19:40.339 --> 00:19:42.160 physical methods. This is the stuff that should 00:19:42.160 --> 00:19:45.140 be easy to prevent, but it still happens. Absolutely. 00:19:45.299 --> 00:19:47.839 The list includes physical theft of documents 00:19:47.839 --> 00:19:52.119 from cars, homes, offices. But the most common 00:19:52.119 --> 00:19:55.039 low -tech method is just stealing identity -related 00:19:55.039 --> 00:19:57.720 documents like bank statements and utility bills 00:19:57.720 --> 00:20:00.420 right out of your letterbox. So shredding your 00:20:00.420 --> 00:20:02.880 mail and getting a locking mailbox is a huge 00:20:02.880 --> 00:20:05.900 first step. A primary, indispensable defense. 00:20:06.220 --> 00:20:08.180 Then we move into the social engineering and 00:20:08.180 --> 00:20:10.180 high -tech stuff. This is where you have the 00:20:10.180 --> 00:20:13.619 phishing attacks. Those emails or texts designed 00:20:13.619 --> 00:20:15.799 to trick you into giving up your login details. 00:20:16.099 --> 00:20:18.880 It also includes the simple act of stealing checks. 00:20:19.079 --> 00:20:21.480 Not to cash them, but to get the banking information 00:20:21.480 --> 00:20:23.740 off of them. Account numbers, routing numbers. 00:20:23.920 --> 00:20:26.759 All of it. And the material also highlights data 00:20:26.759 --> 00:20:29.710 aggregation. Criminals using public records, 00:20:29.769 --> 00:20:31.910 like electoral rolls, to gather foundational 00:20:31.910 --> 00:20:34.630 PII that they can then combine with partial data 00:20:34.630 --> 00:20:38.339 they get from a breach. We post things that seem 00:20:38.339 --> 00:20:40.940 harmless, but it all adds up for a pirate. Social 00:20:40.940 --> 00:20:43.140 media plays a really disturbing role here. The 00:20:43.140 --> 00:20:45.200 research notes that social security numbers can 00:20:45.200 --> 00:20:47.480 sometimes be guessed or pieced together just 00:20:47.480 --> 00:20:50.059 by combining information found on public profiles. 00:20:50.400 --> 00:20:53.539 Like what? Birthdays, addresses, pet names, mothers' 00:20:53.579 --> 00:20:57.160 maiden names, graduation years. People are inadvertently 00:20:57.160 --> 00:20:59.619 handing over the puzzle pieces to attackers who 00:20:59.619 --> 00:21:01.940 specialize in pattern recognition. And once a 00:21:01.940 --> 00:21:04.279 thief has your information, they need time to 00:21:04.279 --> 00:21:06.660 use it before you catch on. What's the immediate 00:21:06.660 --> 00:21:09.059 next step they take to create that delay? The 00:21:09.059 --> 00:21:12.019 critical move is delay tactics. Identity thieves 00:21:12.019 --> 00:21:14.460 will frequently change the victim's contact details, 00:21:14.660 --> 00:21:17.579 their mailing address, phone number, email, to 00:21:17.579 --> 00:21:19.640 stop the victim from getting fraud alerts or 00:21:19.640 --> 00:21:22.720 notifications. So the bank sends an alert, but 00:21:22.720 --> 00:21:24.759 it goes to the new fraudulent email address. 00:21:25.099 --> 00:21:27.460 And the victim stays completely in the dark while 00:21:27.460 --> 00:21:29.420 the thief runs up debt. And then there's the 00:21:29.420 --> 00:21:31.400 grim method you mentioned earlier, ghosting. 00:21:31.849 --> 00:21:34.430 impersonating the dead. Ghosting exploits the 00:21:34.430 --> 00:21:36.829 delay in administrative processes after a death. 00:21:37.069 --> 00:21:39.769 Thieves get information from death notices or 00:21:39.769 --> 00:21:42.950 obituaries and use the deceased person's PII 00:21:42.950 --> 00:21:45.460 to open new accounts. They're banking on the 00:21:45.460 --> 00:21:48.339 fact that agencies take time to be notified and 00:21:48.339 --> 00:21:50.420 they're exploiting the inattentiveness of grieving 00:21:50.420 --> 00:21:52.940 families. It's a crime against someone's final 00:21:52.940 --> 00:21:55.880 financial reputation. It is. OK, let's talk defense. 00:21:56.259 --> 00:21:58.819 The U .S. Federal Trade Commission and Canadian 00:21:58.819 --> 00:22:02.359 recommendations all prioritize the guardianship 00:22:02.359 --> 00:22:05.099 of personal identifiers. What does that actually 00:22:05.099 --> 00:22:07.700 look like in practice? It looks like risk avoidance. 00:22:08.160 --> 00:22:10.799 Actively choosing not to identify yourself unless 00:22:10.799 --> 00:22:13.759 it's absolutely necessary. It means recognizing 00:22:13.759 --> 00:22:16.400 that organizations shouldn't be demanding excessive 00:22:16.400 --> 00:22:18.660 PII. So you should challenge them. You have to 00:22:18.660 --> 00:22:21.119 challenge why they need your full SSN or driver's 00:22:21.119 --> 00:22:23.460 license number. Every time that data is stored 00:22:23.460 --> 00:22:25.420 in another database, whether it's your doctor's 00:22:25.420 --> 00:22:28.059 office or a retail loyalty program, the risk 00:22:28.059 --> 00:22:30.980 just grows exponentially. And for those pieces 00:22:30.980 --> 00:22:34.160 of PII we most know, like an SSN, what's the 00:22:34.160 --> 00:22:36.539 best way to secure them? A sound practice recommended 00:22:36.539 --> 00:22:39.279 in the material is to commit those critical identifiers 00:22:39.279 --> 00:22:42.119 to memory. This gets rid of the risk of someone 00:22:42.119 --> 00:22:44.259 finding them written down or stored on a device. 00:22:44.559 --> 00:22:46.480 And to help with this, the research suggests 00:22:46.480 --> 00:22:49.460 mnemonic techniques, like the major system. We 00:22:49.460 --> 00:22:51.559 mentioned the major system earlier. How does 00:22:51.559 --> 00:22:53.500 that actually work to help you memorize a long 00:22:53.500 --> 00:22:56.140 number like an SSN? The major system is brilliant. 00:22:56.259 --> 00:22:58.720 It converts numbers into phonetic sounds, which 00:22:58.720 --> 00:23:00.640 you can then use to build memorable words or 00:23:00.640 --> 00:23:04.180 phrases. Each digit corresponds to a consonant 00:23:04.180 --> 00:23:08.930 sound. So, for example, the digit 1 is a T or 00:23:08.930 --> 00:23:12.250 D sound. Because a T has one downstroke. Exactly. 00:23:12.670 --> 00:23:15.549 2 is N for two downstrokes, 3 is M for three, 00:23:15.630 --> 00:23:19.109 and so on. So if your SSN had a 3 -2 -1 sequence, 00:23:19.549 --> 00:23:23.230 that would be MNT. Correct. You then add vowels 00:23:23.230 --> 00:23:26.230 between the consonants to form a word like minty, 00:23:26.250 --> 00:23:28.829 and you chain these words together into a memorable, 00:23:29.029 --> 00:23:32.210 often silly, sentence. This leverages your brain's 00:23:32.210 --> 00:23:34.349 ability to recall images and words far better 00:23:34.349 --> 00:23:36.750 than it can recall random numbers. That's a highly 00:23:36.750 --> 00:23:38.990 actionable technique. Now, what about those commercial 00:23:38.990 --> 00:23:41.170 defense services you see advertised all the time? 00:23:41.230 --> 00:23:43.500 Do the sources endorse them? They're heavily 00:23:43.500 --> 00:23:45.720 marketed, but the material says their value has 00:23:45.720 --> 00:23:48.660 been called into question. These services, which 00:23:48.660 --> 00:23:51.240 offer fraud alerts and credit monitoring, they're 00:23:51.240 --> 00:23:53.660 useful for detection, but they are not a substitute 00:23:53.660 --> 00:23:55.839 for aggressive prevention. Let's look at the 00:23:55.839 --> 00:23:58.559 institutional side, organizational failures. 00:23:59.480 --> 00:24:02.039 When corporations or governments drop the ball, 00:24:02.240 --> 00:24:06.140 the scale of risk just explodes. What are the 00:24:06.140 --> 00:24:08.940 key points of failure here? The Privacy Rights 00:24:08.940 --> 00:24:11.220 Clearinghouse has tracked hundreds of breaches 00:24:11.220 --> 00:24:13.880 affecting hundreds of millions of records. And 00:24:13.880 --> 00:24:16.279 the failures fall into both low -tech and high 00:24:16.279 --> 00:24:18.859 -tech buckets. Low -tech failures include simple 00:24:18.859 --> 00:24:21.420 things like not shredding confidential papers 00:24:21.420 --> 00:24:24.339 before throwing them out. Dumpster diving. It 00:24:24.339 --> 00:24:26.519 still happens. It's still a persistent problem. 00:24:26.839 --> 00:24:29.000 And on the high -tech side, what are the biggest 00:24:29.000 --> 00:24:31.490 corporate vulnerabilities? Inadequate network 00:24:31.490 --> 00:24:33.730 security is the big one, of course, but also 00:24:33.730 --> 00:24:36.029 internal theft credit card numbers stolen by 00:24:36.029 --> 00:24:38.849 call center agents. But the most glaring failure, 00:24:39.089 --> 00:24:41.750 cited again and again in the research, is the 00:24:41.750 --> 00:24:44.849 theft of unencrypted laptops or portable media 00:24:44.849 --> 00:24:47.890 containing huge amounts of PII. If the data isn't 00:24:47.890 --> 00:24:51.029 encrypted, a simple loss device instantly compromises 00:24:51.029 --> 00:24:53.410 millions of records. Encryption is the absolute 00:24:53.410 --> 00:24:56.230 minimum standard. The sources also suggest advanced 00:24:56.230 --> 00:24:58.710 techniques like biometric identification using 00:24:58.710 --> 00:25:01.190 fingerprints could theoretically stop thieves, 00:25:01.410 --> 00:25:04.089 but that introduces its own complex technological 00:25:04.089 --> 00:25:08.009 and significant privacy concerns. So what happens 00:25:08.009 --> 00:25:10.930 once all this PII is successfully stolen and 00:25:10.930 --> 00:25:13.490 aggregated? It doesn't just sit there. It enters 00:25:13.490 --> 00:25:16.460 a market. It feeds a sophisticated, active global 00:25:16.460 --> 00:25:20.140 market, mostly on darknet black markets. This 00:25:20.140 --> 00:25:22.759 is where criminal groups turn that raw data into 00:25:22.759 --> 00:25:25.759 weaponized assets. They increase the value of 00:25:25.759 --> 00:25:28.160 the raw data by aggregating it with publicly 00:25:28.160 --> 00:25:30.400 available information. So they take the data 00:25:30.400 --> 00:25:32.779 from the breach and combine it with the open 00:25:32.779 --> 00:25:35.019 source info they got from electoral rolls or 00:25:35.019 --> 00:25:37.460 social media. Exactly. They enrich the data. 00:25:37.559 --> 00:25:39.700 They create a complete identity profile name, 00:25:39.819 --> 00:25:42.619 SSN, mother's maiden name, address, maybe even 00:25:42.619 --> 00:25:44.869 recent purchases. which is far more valuable 00:25:44.869 --> 00:25:47.150 than the raw data alone. Then they sell this 00:25:47.150 --> 00:25:50.190 enriched data again for a higher profit. So a 00:25:50.190 --> 00:25:52.349 simple data breach is just the opening bid in 00:25:52.349 --> 00:25:55.329 a complex multi -stage attack. Precisely. And 00:25:55.329 --> 00:25:57.190 this gets us back to that philosophical tension 00:25:57.190 --> 00:25:59.960 we noted earlier. The availability of public 00:25:59.960 --> 00:26:02.900 PII, even things like addresses and voting records, 00:26:03.119 --> 00:26:05.880 is essential for this data enrichment. It creates 00:26:05.880 --> 00:26:08.220 a seamless link between government transparency 00:26:08.220 --> 00:26:11.700 and the ease of criminal aggregation. It does. 00:26:11.759 --> 00:26:13.960 Every time data is made public, even for good 00:26:13.960 --> 00:26:16.880 reasons, it just slightly lowers the bar for 00:26:16.880 --> 00:26:19.839 a criminal to complete an identity package. This 00:26:19.839 --> 00:26:22.869 tension is global. And it requires a global legal 00:26:22.869 --> 00:26:25.970 response, which brings us to section four, global 00:26:25.970 --> 00:26:28.990 response and legal consequences. The U .S. legal 00:26:28.990 --> 00:26:31.089 framework has really been playing catch up, getting 00:26:31.089 --> 00:26:33.930 stronger since the 90s. The foundation is the 00:26:33.930 --> 00:26:36.109 Identity Theft and Assumption Deterrence Act, 00:26:36.210 --> 00:26:39.190 or ITADA, passed in 1998. What did ITADA do? 00:26:39.630 --> 00:26:41.750 It was foundational because it defined a new 00:26:41.750 --> 00:26:43.950 type of crime. It made the unlawful possession 00:26:43.950 --> 00:26:46.809 or use of a means of identification a federal 00:26:46.809 --> 00:26:49.069 crime. This meant that the act of stealing the 00:26:49.069 --> 00:26:51.390 identity itself was federally prosecutable, not 00:26:51.390 --> 00:26:53.990 just the fraud that came after. It recognized 00:26:53.990 --> 00:26:56.190 identity theft as a crime against the person, 00:26:56.349 --> 00:26:59.420 not just against the bank. And later, the government 00:26:59.420 --> 00:27:02.400 needed an even stronger tool for when ID theft 00:27:02.400 --> 00:27:05.220 was used to enable other serious crimes. The 00:27:05.220 --> 00:27:07.720 Aggravated Identity Theft Statute. That's 18 00:27:07.720 --> 00:27:11.619 U .S .C. Section Newever 28A. It applies when 00:27:11.619 --> 00:27:14.160 identity theft is committed along with certain 00:27:14.160 --> 00:27:16.819 other felonies like bank fraud or passport fraud. 00:27:17.059 --> 00:27:19.720 And the real punch of this law is that it mandates 00:27:19.720 --> 00:27:22.200 a consecutive sentence. A consecutive sentence. 00:27:22.380 --> 00:27:25.400 A mandatory extra two years of prison time stacked 00:27:25.400 --> 00:27:27.799 on top of the sentence for the main felony. Wow. 00:27:28.180 --> 00:27:30.740 That forces prosecutors to charge the identity 00:27:30.740 --> 00:27:32.859 theft separately rather than just seeing it as 00:27:32.859 --> 00:27:35.019 a side effect of the bigger crime. It really 00:27:35.019 --> 00:27:37.700 reinforces the seriousness. It does. And beyond 00:27:37.700 --> 00:27:39.720 just prosecution, the U .S. has also enacted 00:27:39.720 --> 00:27:42.799 strong... regulatory action for prevention specifically 00:27:42.799 --> 00:27:45.720 the red flag guidelines we mentioned these what 00:27:45.720 --> 00:27:47.539 exactly are the red flag guidelines they were 00:27:47.539 --> 00:27:49.799 developed by a joint task force of federal agencies 00:27:49.799 --> 00:27:52.319 they require financial institutions and this 00:27:52.319 --> 00:27:54.059 has been broadly interpreted to include most 00:27:54.059 --> 00:27:56.680 medical practices utilities telecom providers 00:27:56.680 --> 00:27:59.240 to develop a written identity theft prevention 00:27:59.240 --> 00:28:01.900 program and this program has to be designed to 00:28:01.900 --> 00:28:04.950 detect and prevent patient identity theft Correct. 00:28:05.049 --> 00:28:07.609 It has to look for red flags. What are some examples 00:28:07.609 --> 00:28:10.450 of these red flags? Things like alerts for address 00:28:10.450 --> 00:28:12.650 discrepancies when someone is opening an account, 00:28:12.829 --> 00:28:15.789 suspicious documents, activity that doesn't match 00:28:15.789 --> 00:28:18.369 previous patterns, like a sudden flood of new 00:28:18.369 --> 00:28:21.670 credit applications, or attempts to use PII linked 00:28:21.670 --> 00:28:24.890 to a deceased person. The institutions have to 00:28:24.890 --> 00:28:27.569 have a plan approved by their board to respond 00:28:27.569 --> 00:28:30.609 the moment these red flags appear. So it shifts 00:28:30.609 --> 00:28:33.369 the protective burden firmly onto the organizations 00:28:33.369 --> 00:28:36.819 handling our PII. That's the idea. And on the 00:28:36.819 --> 00:28:39.200 ground, state level support has been crucial 00:28:39.200 --> 00:28:42.019 for helping victims. States like Indiana created 00:28:42.019 --> 00:28:44.799 a specialized identity theft unit to help victims 00:28:44.799 --> 00:28:47.640 navigate the recovery process. California's Office 00:28:47.640 --> 00:28:49.940 of Privacy Protection does similar work. And 00:28:49.940 --> 00:28:52.400 we can't forget the importance of mandated transparency. 00:28:52.900 --> 00:28:55.279 That's where notification laws come in. Many 00:28:55.279 --> 00:28:57.579 states followed California's lead in enacting 00:28:57.579 --> 00:29:00.579 mandatory data breach notification laws. This 00:29:00.579 --> 00:29:02.759 ensures that companies can't hide it when sensitive 00:29:02.759 --> 00:29:05.109 consumer information has been compromised. It 00:29:05.109 --> 00:29:07.230 doesn't prevent the theft, but it guarantees 00:29:07.230 --> 00:29:09.890 you're informed. So you can activate fraud alerts 00:29:09.890 --> 00:29:12.589 and start your own guardianship measures before 00:29:12.589 --> 00:29:15.589 that delayed weaponization phase begins. Let's 00:29:15.589 --> 00:29:18.089 shift globally now because this is a transnational 00:29:18.089 --> 00:29:20.410 crime and that leads to some massive institutional 00:29:20.410 --> 00:29:24.049 gaps. The failure around Malaysia Airlines Flight 00:29:24.049 --> 00:29:27.710 370 is a perfect illustration. That 2014 incident 00:29:27.710 --> 00:29:30.690 where two passengers boarded using stolen passports, 00:29:30.829 --> 00:29:34.630 it highlighted a shocking vulnerability. Interpol 00:29:34.630 --> 00:29:37.430 has a massive stolen and lost travel documents 00:29:37.430 --> 00:29:41.049 database with 40 million records. 40 million 00:29:41.049 --> 00:29:43.470 records. But Interpol's secretary general reported 00:29:43.470 --> 00:29:45.710 that at the time, only a handful of countries 00:29:45.710 --> 00:29:48.089 were systematically using that database to screen 00:29:48.089 --> 00:29:50.710 travelers. So the data was there, but it was 00:29:50.710 --> 00:29:52.849 largely unused in real -time screening. That 00:29:52.849 --> 00:29:55.430 is a massive security hole. It is. It shows the 00:29:55.430 --> 00:29:57.509 failure often isn't a lack of data or tools, 00:29:57.670 --> 00:30:00.740 but institutional inertia. Now, if we look at 00:30:00.740 --> 00:30:03.220 penalties across the globe, the different philosophical 00:30:03.220 --> 00:30:05.900 approaches are immediately visible. Let's compare 00:30:05.900 --> 00:30:08.119 some of the tough ones. Australia, for instance, 00:30:08.259 --> 00:30:11.059 prohibits dishonest acts causing loss to a Commonwealth 00:30:11.059 --> 00:30:13.839 entity, and that's punishable by five years' 00:30:13.960 --> 00:30:17.730 imprisonment. Canada has tiered penalties. based 00:30:17.730 --> 00:30:21.410 on intent yes knowingly possessing identity info 00:30:21.410 --> 00:30:24.829 for fraud can get you five years but fraudulent 00:30:24.829 --> 00:30:27.210 personation actually acting as the person to 00:30:27.210 --> 00:30:29.549 gain an advantage that carries up to 10 years 00:30:29.549 --> 00:30:32.470 europe varies france has up to five years in 00:30:32.470 --> 00:30:35.710 a big fine and the uk seems particularly unforgiving 00:30:36.160 --> 00:30:39.079 The UK courts call identity fraud a particularly 00:30:39.079 --> 00:30:41.859 pernicious and prevalent form of dishonesty, 00:30:41.940 --> 00:30:45.140 calling for deterrent sentences. This reflects 00:30:45.140 --> 00:30:47.400 the sheer volume of the crime there. It accounts 00:30:47.400 --> 00:30:49.579 for nearly half of all recorded frauds in the 00:30:49.579 --> 00:30:52.079 UK. And Hong Kong. One of the highest we saw, 00:30:52.200 --> 00:30:55.019 14 years imprisonment. India has a framework 00:30:55.019 --> 00:30:57.569 too. Under their Information Technology Act, 00:30:57.730 --> 00:30:59.549 it's up to three years in prison and a fine. 00:30:59.730 --> 00:31:02.190 It shows a clear attempt to keep pace with the 00:31:02.190 --> 00:31:04.450 digitization of crime. And finally, let's go 00:31:04.450 --> 00:31:06.869 back to the unique case of Sweden, which challenges 00:31:06.869 --> 00:31:09.750 our basic assumptions about data privacy. Sweden 00:31:09.750 --> 00:31:12.819 is historically an open society. based on the 00:31:12.819 --> 00:31:15.420 principle of public access. This means that pretty 00:31:15.420 --> 00:31:17.700 much all information kept by public authorities, 00:31:17.880 --> 00:31:20.220 including your address, your taxes, your income, 00:31:20.339 --> 00:31:22.900 has to be available to anyone who asks. That 00:31:22.900 --> 00:31:25.519 accessibility must have made fraud easier. It 00:31:25.519 --> 00:31:29.099 did. And until late 2016, Sweden had few specific 00:31:29.099 --> 00:31:32.700 laws targeting identity theft itself. The government's 00:31:32.700 --> 00:31:35.019 priority on transparency created an environment 00:31:35.019 --> 00:31:37.980 that made data aggregation for pirates significantly 00:31:37.980 --> 00:31:40.970 simpler. It highlights that severe friction between 00:31:40.970 --> 00:31:43.009 the values of absolute government transparency 00:31:43.009 --> 00:31:46.130 and the practical need for robust personal data 00:31:46.130 --> 00:31:48.430 security. It really does. Moving to Section 4 00:31:48.430 --> 00:31:50.849 .3, we have to talk about the personal impact. 00:31:51.539 --> 00:31:53.519 Fines and prison sentences for the criminals 00:31:53.519 --> 00:31:55.799 are one thing, but what is the ultimate price 00:31:55.799 --> 00:31:58.480 paid by the victims? The emotional and financial 00:31:58.480 --> 00:32:01.519 strain is just crippling. Victims can face years 00:32:01.519 --> 00:32:03.559 of effort trying to prove their own identity 00:32:03.559 --> 00:32:06.599 to the legal system, to credit bureaus, to banks. 00:32:06.799 --> 00:32:09.440 And to add this complex layer of betrayal, the 00:32:09.440 --> 00:32:12.059 statistics show that most identity theft is perpetrated 00:32:12.059 --> 00:32:14.559 by a family member. Oh, that's devastating. It 00:32:14.559 --> 00:32:17.380 turns the fight for recovery into a profound 00:32:17.380 --> 00:32:20.339 psychological ordeal. And to really bring this 00:32:20.339 --> 00:32:23.539 home. The well -publicized case of Michelle Brown's 00:32:23.539 --> 00:32:26.319 identity theft is the perfect illustration of 00:32:26.319 --> 00:32:29.400 how fast this can escalate from financial fraud 00:32:29.400 --> 00:32:32.539 to a life -shattering catastrophe. Michelle Brown's 00:32:32.539 --> 00:32:34.740 testimony before the U .S. Senate detailed her 00:32:34.740 --> 00:32:38.000 experience. Her impersonator got over $50 ,000 00:32:38.000 --> 00:32:40.500 in goods and services, the typical financial 00:32:40.500 --> 00:32:42.920 fraud. But then the impersonator got into drug 00:32:42.920 --> 00:32:45.400 trafficking. And those consequences landed directly 00:32:45.400 --> 00:32:48.099 on Michelle Brown's record. Precisely. She got 00:32:48.099 --> 00:32:51.000 an erroneous arrest record. warrant out for her 00:32:51.000 --> 00:32:53.960 arrest. And it got so bad that the criminal was 00:32:53.960 --> 00:32:57.119 booked under Mrs. Brown's name as an inmate in 00:32:57.119 --> 00:32:59.180 the Chicago federal prison. So Michelle Brown 00:32:59.180 --> 00:33:01.460 spent years trying to prove she was not a drug 00:33:01.460 --> 00:33:03.539 trafficker who had served federal time. That 00:33:03.539 --> 00:33:06.200 story just shows that the burden of proof, the 00:33:06.200 --> 00:33:09.019 years of effort, the lasting fear of being implicated 00:33:09.019 --> 00:33:12.000 in a crime you didn't commit, that is the true 00:33:12.000 --> 00:33:14.539 punishment of identity theft. The non -financial 00:33:14.539 --> 00:33:17.440 institutional scars are often irreversible. The 00:33:17.440 --> 00:33:19.440 highest price paid. Without a doubt. We've covered 00:33:19.440 --> 00:33:21.880 a tremendous amount of ground. We've mapped the 00:33:21.880 --> 00:33:24.880 evolution of identity piracy from a simple financial 00:33:24.880 --> 00:33:28.410 crime to a systemic threat. We've detailed the 00:33:28.410 --> 00:33:31.750 seven faces, and we've reviewed the global patchwork 00:33:31.750 --> 00:33:34.029 of legal responses. And we've established that 00:33:34.029 --> 00:33:36.190 critical distinction. The financially common 00:33:36.190 --> 00:33:39.190 types, like financial and tax fraud, are often 00:33:39.190 --> 00:33:41.630 less personally damaging than the long -term, 00:33:41.710 --> 00:33:45.150 existence -challenging types. Criminal, medical, 00:33:45.329 --> 00:33:48.410 and child identity theft. Those inflict lasting 00:33:48.410 --> 00:33:51.349 institutional trauma. The primary actionable 00:33:51.349 --> 00:33:53.990 takeaway for you, the listener, reinforced by 00:33:53.990 --> 00:33:56.329 all the security advisories we've seen, is the 00:33:56.329 --> 00:33:58.390 crucial importance of aggressive guardianship 00:33:58.390 --> 00:34:00.769 of your personal identifiers. Coupled with risk 00:34:00.769 --> 00:34:03.509 avoidance. Don't over -identify yourself. Use 00:34:03.509 --> 00:34:05.609 memory aids like the major system for critical 00:34:05.609 --> 00:34:07.910 numbers and rigorously protect your physical 00:34:07.910 --> 00:34:09.929 documents. And we have to close by acknowledging 00:34:09.929 --> 00:34:11.989 the ongoing disagreement among professionals 00:34:11.989 --> 00:34:14.780 about the true scale of this problem. While some 00:34:14.780 --> 00:34:17.159 U .S. study suggested a decrease in victims and 00:34:17.159 --> 00:34:19.780 fraud value in the mid -2000s, the research we 00:34:19.780 --> 00:34:21.639 looked at highlights some serious skepticism. 00:34:21.739 --> 00:34:24.360 The Microsoft report in particular was very vocal. 00:34:24.519 --> 00:34:28.320 It argued that survey -based estimates are hopelessly 00:34:28.320 --> 00:34:31.179 flawed. and probably exaggerate the financial 00:34:31.179 --> 00:34:33.760 losses. That's correct. But regardless of the 00:34:33.760 --> 00:34:36.420 disputed financial scale, the sheer personal 00:34:36.420 --> 00:34:39.480 cost is undisputed. The fact that the average 00:34:39.480 --> 00:34:41.860 time spent resolving the problem in one survey 00:34:41.860 --> 00:34:45.980 was estimated at 330 hours for victims, that 00:34:45.980 --> 00:34:48.760 just underscores the immense non -monetary price 00:34:48.760 --> 00:34:52.159 paid in time, effort, and stress. As we close 00:34:52.159 --> 00:34:54.000 this deep dive, I want to come back to that tension 00:34:54.000 --> 00:34:56.559 we observed throughout this material, the friction 00:34:56.559 --> 00:34:59.679 between open access and private security, which 00:34:59.679 --> 00:35:01.860 was exemplified by Sweden's historical approach. 00:35:02.079 --> 00:35:04.340 It poses a profound question for the future of 00:35:04.340 --> 00:35:06.739 digital governance. How do we balance a society 00:35:06.739 --> 00:35:09.559 that seeks government transparency and data availability, 00:35:09.900 --> 00:35:12.480 that open society ideal, with the increasing 00:35:12.480 --> 00:35:14.420 and sophisticated risk of identity exploitation? 00:35:14.969 --> 00:35:17.630 Can a truly transparent state where our fundamental 00:35:17.630 --> 00:35:20.690 PII is easily accessible for democratic accountability 00:35:20.690 --> 00:35:23.489 ever offer robust personal privacy protections? 00:35:23.750 --> 00:35:25.590 Or is that a fundamental contradiction we just 00:35:25.590 --> 00:35:27.789 haven't resolved yet in the digital world? That 00:35:27.789 --> 00:35:30.090 is the complex challenge facing legislators and 00:35:30.090 --> 00:35:32.530 technologists everywhere. The convenience of 00:35:32.530 --> 00:35:35.449 access combined with the sophistication of exploitation 00:35:35.449 --> 00:35:39.650 requires this continuous, often painful re -evaluation 00:35:39.650 --> 00:35:42.429 of where that line between public interest and 00:35:42.429 --> 00:35:44.690 private security has to be drawn. A negotiation 00:35:44.690 --> 00:35:47.510 that evolves daily. And one we must all participate 00:35:47.510 --> 00:35:50.610 in. A deep dive into identity piracy reveals 00:35:50.610 --> 00:35:53.469 not just a crime wave, but a constant negotiation 00:35:53.469 --> 00:35:56.769 between trust, transparency, and technology that 00:35:56.769 --> 00:35:59.349 affects every aspect of modern life. Thank you 00:35:59.349 --> 00:36:00.969 for mapping this complex terrain with us.