What is identity theft? How does this deal with email?
While most people are concerned about “Identity Theft” as the result of a credit card being stolen or the loss of a wallet, a majority are not aware that the large number of identity thefts are the result of just utilizing regular email. And with over 150 billion emails sent daily, there is plenty of opportunity for the data thieves!
Often we are encouraged by organizations to provide privileged data about ourselves via regular email. Privileged data includes your full name, mailing address, social security number, credit card numbers, etc. Anything that uniquely identifies you can be considered “privileged data”. This is one of the primary reasons there are so many Federal and State level laws (HIPAA, FERPA, GLBA, SEC, etc.) requiring that privileged data be sent securely (or in most cases “encrypted”) as well as the email message being documented as to show the history of receipt of those emails.
With just basic information about an email user, a person with criminal intent can find free software on the Internet that would allow them to intercept or access almost anyone’s email. (Just Google “Intercepted Email” and read about the thousands of methods and products available to anyone to intercept email.) And while email can be intercepted from the originating network, in transit, or on the recipient’s network, emails are more often stolen directly from the user’s email mailbox where all of the contents of the email are stored in plain text.
Obtaining a user’s password to their email accounts is sadly very easy as most people do not make a serious effort to protect their passwords. How many of you still try to use some version of the word “password” as your password, something clever like “pa33word” or “password123”? Or worse, use your birthdate, dog’s name or child’s name. How many people write down their passwords and leave them on their desk or on sticky-notes on their computer monitors … come on, raise your hand.
Once in the user’s email inbox, the thief can then see any common types of purchases, bank info and e-commerce sites that the account user accesses. Then, they simply go to those websites, request a password reset (which is usually completed almost instantaneously and sent to the hacked email account) and the thief then is able to access the website posing as the legal user.
Then as they say, “The devil will play”. The sad thing here is that when the account owner tries to log in to their email or e-commerce accounts and finds that they have “forgotten” their password, they won’t even realize something is wrong … they will simply request a new password and go on. Think about it, how many times have you tried to log in to a website or email account with a password you were convinced was correct only to be told “invalid password”?
And once an email has been intercepted or accessed in the person mailbox, a hacker can interfere with the emails in four basic ways:
- Eavesdropping – The thief simply reads the emails and the information remains intact but its privacy is compromised.
- Tampering – The thief can change the contents of the email and then send the email on to the intended recipient.
- Impersonation (spoofing) – The thief can pretend to be the account holder and send out an email or reply to an email.
- Misrepresentation – The thief orders items using your credit card or social security number to obtain credit.
So what can you do about it?
- Simply do not leave your passwords on your desk or where someone can easily find them. If you have a problem remembering your passwords, store them in a file that is password protected, so you only have to remember one password to access your list of account passwords, or use an online password management product.
- DO NOT use the same password for multiple accounts … If you do get hacked and a thief gets ahold of your one password, they then have access to all of your online accounts.
- Try to use a “pass-phrase” rather than a short password. They are easier to remember but much harder to hack. So rather than a password like Bx#54r2! (very hard to remember) use a phrase like “Sallyishappy2!”
- If you do forget your password, check on the history of your account to see when your password was changed and try to remember if you changed it. If not, contact the fraud department with your email provider or e-commerce
- Utilize a secure/encrypted email product to send privileged data via email when necessary. There are a number of simple and inexpensive secure email solutions that you can use as an individual to protect your email.
So, if you want to save yourself from the heartache of having your identity stolen, you simply need to make a few changes to protect yourself.
Written by Peter J. Schaub
President & CEO of NeoCertified
