The Dangers of Relying on Insecure Identifiers
Author: John Published Under: Information Security
Identity theft is a very big problem in the United States and all over the World. Increasingly, financial institutions rely upon relatively insecure identifiers, such as birth certificates, which were never intended to prove identity. As a result, it has become much easier for identity thieves to accommodate these types of identifiers and commit fraud.
There are actually many ways that criminals get their hands on the identifiers that are required to commit identity theft. In some cases it is as simple as doing a search on Google or finding a state that doesn't require proof of identity to get a copy of a birth certificate.
The way institutions that we trust use our identifiers is also a very big problem. For example, the social security number is one identifier that can be used to commit identity theft. However, this number is rarely well protected. For instance, if you stop and think about it, you could probably not even list how many people have had access to you social security number.
To compound this problem is the fact that many of these institutions freely give out your information to other institutions, who subsequently do the same. All of this is common practice and legal. So, for instance, you might give your social security number to a bank, who then gives you social security number to a credit checking agency, who then gives your social security number to yet another agency. So, even if you trust the initial company, there is no way to guarantee that each of these agencies are trustworthy, nor securely protect this information.
All it takes is one criminal in any of these positions to skim social security numbers and your identity is at risk. This used to be even easier, until recent legislation that prevented the entire social security number from being used as an identifier for things like a hotel rewards program.
Often, this information is collected by a dishonest employee, but most financial institutions do not have any real understanding of information security when it comes to their online applications and network security. As a result, each month you will hear about an institution being compromised and millions of peoples personal information being released.
While this is not to say that these companies do not take the protection of this information seriously, it is safe to say that many do a very poor job.
However, it is not always a dishonest employee, enterprising hacker, or poorly designed web application that puts your information at risk. There are, in fact, a number of instances where the criminal is someone you know, perhaps even a spouse or loved one. For this reason, it is essential to be very careful who you let see your information, not only in regards to businesses and companies, but also on a much more personal level.