WHAT IS IDENTITY THEFT?

SUCCESSFUL PROSECUTION OF IDENTITY THEFT Created by Michael Lennon Presented by Sheri Maxim and Michael Lennon Assistant State Attorney Thirteenth Judicial Circuit Hillsborough County, Florida WHAT IS IDENTITY THEFT? Willfully and fraudulently using, or possessing with intent to fraudulently use, someone else s personal identification information without the owner s s consent. Florida Statute 817.568

WHAT IS PERSONAL IDENTIFICATION INFORMATION? Florida Statute 817.568(1)(f) defines personal identification information to include name, postal or electronic [email] address, telephone number, social security number, date of birth, mother s s maiden name, official state-issued or United States-issued driver s s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, Medicaid or food stamp account number, bank account number, credit or debit card number, or personal identification number or code assigned to the holder of a debit card by the issuer to permit authorized electronic use of such card. Also includes biometric data (fingerprint, voice, retina image). HOW ARE THIEVES 1. Theft from your mailbox or garbage.

HOW ARE THIEVES 1. Theft from your mailbox or garbage. HOW ARE THIEVES 1. Theft from your mailbox or garbage.

HOW ARE THIEVES 1. Theft from your mailbox or garbage. HOW ARE THIEVES 2. Obtaining personal identification information from ordinary theft and robbery.

HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing At first glance it would appear as though this individual is simply performing a simple ATM transaction. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing What he is in fact doing is rigging the slot on the machine so as to capture (or keep) the card of the next person who uses the ATM. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL

HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing Rigging the machine is very risky business therefore the services of a lookout is required in order to warn of possible witnesses and/or potential victims. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing Here we see the next customer to use the machine after the trap has been set. He inserts his card and attempts a transaction. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL

HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing The card has been captured and the customer is confused as to why this is so. However in the background we see that help is on its way or is it? This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing Here we see the Fraudster pretending to render assistance. What he is in fact trying to do is obtain the customer s s P.I.N now that he has captured the card This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL

HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing He convinces the customer that he would be able to retrieve his card if he entered his P.I.N while he holds down both the cancel and the enter buttons. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing After several attempts the customer is convinced that the machine has captured his card. Both he and the Fraudster leave the ATM. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL

HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing Satisfied that the coast is clear the Fraudster returns to retrieve the card that has been captured by his trap. He not only has the customers card he also has his P.I.N. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL HOW ARE THIEVES COMMITTING IDENTITY THEFT? 3. Shoulder Surfing Armed with card and P.I.N he left and was able to withdraw $1000 from the account. This Slide is courtesy of the United States Secret Service Thanks to Special Agent Don Cox, MD-FL

HOW ARE THIEVES 3. Shoulder Surfing HOW ARE THIEVES 4. Skimming Skimming is the use of computers to read and store information encoded on the magnetic strip of a debit or credit card when the victim inserts the card through either a specialized card reader or a legitimate payment mechanism (e.g., e.g., the card reader used to pay for gas at the pump in a gas station). Once stored, that information can be re- encoded onto any other card with a magnetic strip, instantly transforming a blank card into a machine-readable ATM or credit card identical to that of the victim.

HOW ARE THIEVES Selling the information to other thieves. Using the information to make purchases online or over the phone. Using the information to make counterfeit cards. 4. Skimming HOW ARE THIEVES 5. Card Taking

HOW ARE THIEVES 5. Card Taking HOW ARE THIEVES 6. Phishing

HOW ARE THIEVES 7. Vishing Like Phishing except that instead of using a web link to lure the victim, the thief uses a false telephone number in the fraudulent email to lure unsuspecting victims into calling the telephone number and providing account information over the phone. HOW ARE THIEVES 8. Pharming Pharming is changing the specific record for a domain, sending the victim to a fake website similar in appearance and web address to the website that the victim intended to access, without the victim s s knowledge. Obtain the web history and domain history as evidence.

HOW ARE THIEVES 9. The Insider The Insider stands in a position of trust and has access to victims person identification information. Medical Records Car Dealerships Credit card companies. Pat O Brien O is not an identity thief. His picture is being used as a play on words. HOW ARE THIEVES 10. The Insider & Check Writing Software

HOW ARE THIEVES Keystroke catchers are computer programs or small devices that attach to the cable that connects your keyboard to your computer. The "catcher" resembles a standard connector, but contains a memory chip that records everything typed. 11. Keystroke Catchers HOW ARE THIEVES 11. Spoofing

HOW ARE THIEVES 11. Spoofing Allows thieves to call a credit card company with the caller ID appearing to originate from the card holder's home, and use the credit card number to order cash transfers that the thief can pick up. Pretext calls are calls made by someone posing as a customer, employee, or even a regulator to obtain personal information from companies and individuals. SUCCESSFUL INVESTIGATION AND PROSECUTION OF IDENTITY THEFT the average time between the occurrence of the crime and discovery by the victims is 12.7 months, with almost 10% of cases taking in excess of 60 months before discovery. Statewide Grand Jury Report Identity Theft in Florida January 10, 2002 First Interim Report of the Sixteenth Statewide Grand Jury In the Supreme Court of the State of Florida Case No.: SC 01-1095 1095

FIRST STEP IN THE INVESTIGATION STEP #1: Meeting with the victim. Generate a complaint. Have the victim fill out an identity theft affidavit to place with the police report. http://www.ftc.gov/bcp/conline/pubs/credit/affidavit.pdf Instruct the victim to immediately contact the credit reporting companies (credit bureaus) over the phone and in writing to report the fraudulent transactions (requesting placement of a fraud alert on the victim s s account). Give a copy of the police report to the victim (needed to prove identity theft to the consumer reporting companies). FIRST STEP IN THE INVESTIGATION Spend time with the victim to retrace steps. Attempt to ascertain who may have had access to the identification information. Does the victim live alone? Was the victim recently a victim of a robbery, burglary, or theft? Obtain as many credit documents from the victim as possible.

FIRST STEP IN THE INVESTIGATION What county has jurisdiction (venue) for prosecution? Florida Statute 817.568(16) allows prosecution in any county in which an element of the offense occurred, including the county where the victim generally resides. FIRST STEP IN THE INVESTIGATION Statute of Limitations Florida Statute 817.568(17) allows commencement of prosecution (filing an Information and reasonable attempt at arrest in timely manner) within 3 years of the offense date. EXCEPTION: If the three year time period has elapsed, prosecution can commence within 1 year of discovery so long as prosecution commences within 5 years of the offense date. Can you prosecute on another statute?

SECOND STEP IN THE INVESTIGATION DOES NOT NECESSARILY INVOLVE ARREST! Florida Rule of Criminal Procedure 3.191(a) entitles a defendant charged with a felony offense to a trial within 175 days from the date of arrest. Florida Rule of Criminal Procedure 3.191(b) allows a defendant to demand a trial within 60 days from the date of arrest. SECOND STEP IN THE INVESTIGATION Should you arrest? Does the Defendant present an imminent threat to continued loss? Is the Defendant a flight risk? Do the reasons for not arresting outweigh the benefits of arresting?

SECOND STEP IN THE INVESTIGATION Gather the necessary documents to prove the identity theft via subpoena or written consent from the victim to obtain the necessary documents. How are you going to ensure that a court will admit the records into evidence at trial? Authentication Florida Statute 90.901 provides that [a]uthentication or identification of evidence is required as a condition precedent to its admissibility. ty. Hearsay Florida Statute 90.802 states that unless an exception applies, hearsay evidence is inadmissible. SECOND STEP IN THE INVESTIGATION Records Custodians are essential witnesses. Florida Statute 90.803(6)(c) allows a business records certification to replace a live records custodian at trial. Send the Business Records Certification to the company when obtaining records.

SECOND STEP IN THE INVESTIGATION Obtaining Records from Internet Service Providers 18 USC 2703(f) Establishes a process by which the government may request that an ISP preserve evidence in its possession relating to a specified target pending the issuance of appropriate process. While 2703 (f) does not establish a required format, requests are usually in the form of a letter on the letterhead of the requesting agency identifying the target account or accounts and the information that is required. (See attached example language). The 2703 (f) request only preserves records in the possession of the ISP at the time of the receipt of the request and are not prospective. Therefore it is imperative for the requesting agency to work with the ISP to identify the type of record that is kept by the ISP and to make sure that the request is timely. Section 2703(f) requires that the requested records be retained for a period of 90-days which can be extended for an additional 90-days. 4. Other Evidentiary Considerations Business Records 6) RECORDS OF REGULARLY CONDUCTED BUSINESS ACTIVITY.-- (a) A memorandum, report, record, or data compilation, in any form, of acts, events, conditions, opinion, or diagnosis, made at or near the time by, or from information transmitted by, a person with knowledge, if kept in the course of a regularly conducted business activity and if it was the regular practice of that business activity to make such memorandum, report, record, or data compilation, all as shown by the testimony of the custodian or other qualified witness, or as shown by a certification or declaration that complies with paragraph (c) and s. 90.902(11), unless the sources of information or other circumstances show lack of trustworthiness.

Other Evidentiary Considerations Continued... Records Custodians are essential witnesses. Florida Statute 90.803(6)(c) allows a business records certification to replace a live records custodian at trial. Send the Business Records Certification to the company when obtaining records. CERTIFICATION OF BUSINESS RECORDS PURSUANT TO F.S. 90.803(6)(c) AND F.S. 90.902(11) I, (print name), hereby certify that I am a custodian of records of WACHOVIA BANK, NA (name of company) located at 401 Market Street, Philadelphia, PA 19101. (address of company). Pursuant to sections 90.803(6) and 90.902(11), Florida Statutes, I hereby certify the following: (1) that as part of my regular duties, I maintain custody and control of the original records of WACHOVIA BANK, NA (name of company); (2) that the enclosed documents consisting of (number of pages) pages are a true and accurate copy of the original memorandums, reports, records, or data compilations maintained at WACHOVIA BANK, NA (name of company); (3) that the attached documents consist of the following information: ; (4) that all the memorandums, reports, records, or data compilations ions described in paragraph 3 were made at or near the time of the occurrence of the matters set s forth by, or from information transmitted by, a person having knowledge of those matters; (5) that all the memorandums, reports, records, or data compilations ions maintained in the enclosed documents are kept in the course of the regularly conducted activities of WACHOVIA BANK, NA (name of company); (6) that all the memorandums, reports, records, or data compilations ions contained in the documents were made as a regular practice in the course of the regularly conducted c activities of WACHOVIA BANK, NA (name of company). STATE OF PENNSYLVANIA ) COUNTY OF PHILADELPHIA ) PERSONALLY APPEARED before me, the undersigned authority, (name of affiant), being duly sworn, says that the allegations of fact as set forth in the above Affidavit are true. SIGNATURE OF AFFIANT SWORN TO AND SUBSCRIBED before me this day of, 20. (signature) Notary Public, State of at Large Print, Type, or Stamp Commission of Notary Public Personally known OR Produced Identification Type of Identification Produced

Other Evidentiary Considerations (Continued) 1. Authentication 2. Identifying the perpetrator 3. Privileged communication 1. Authentication (documents do not fall out of the sky) Fla. Stat. 90.901. Requirement of authentication or identification. Authentication or identification of evidence is required as a condition precedent to its admissibility. The requirements of this section are satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.

Authentication (Continued) Fla. Stat. 90.902. Self- Authentication. In general, documents bearing a seal from the public agency and having a signature from the custodian attesting to the authenticity of the seal. Also called certified documents. Fla. Stat. 90.953 allows copies of originals so long as properly authenticated. 2. Identifying the Perpetrator 1. Considerations: a. Defendant s s story b. Motive where did the money go? c. Handwriting Expert d. Immunity to Coconspirator

3. Privileged Communications Marital Privilege Attorney Client Privilege Accountant Client Privilege 90.504 Husband-wife privilege.-- (1) A spouse has a privilege during and after the marital relationship to refuse to disclose, and to prevent another from disclosing, communications which were intended to be made in confidence between the spouses while they were husband and wife.

WAIVER 90.507 Waiver of privilege by voluntary disclosure.-- --A A person who has a privilege against the disclosure of a confidential matter or communication waives the privilege if the person, or the person's predecessor while holder of the privilege, voluntarily discloses or makes the communication when he or she does not have a reasonable expectation of privacy, or consents to disclosure of, any significant part of the matter or communication. This section is not applicable when the disclosure is itself a privileged communication. 4. Defendant s s Statement 1. Considerations: a. General statements are not helpful. b. Use exhibits whenever possible. c. RECORD THE STATEMENT!!! NO EXCUSES!!!! Why not video the statement? d. A Defendant s s statement can eliminate any hearsay issues and any authentication issues. e. A Defendant s s statement can eliminate the need for a handwriting expert. f. Mention the crime s s elements.

Examples of bad statements taken from Defendants

Theft Intent circumstantial v. direct evidence Because intent to commit theft usually cannot be proven by direct evidence, the intent may be inferred from the circumstances surrounding the illegal act; however, the circumstantial evidence must exclude every reasonable hypothesis but that of guilt. Sewall v. State, 783 So. 2d 1171 (Fla. Dist. Ct. App. 5th Dist. 2001).

Evasiveness is Evidence An effort to conceal the property of another to prevent the owner from discovering it, or giving evasive answers when questioned in relation to it, is evidence of felonious intent. Long v. State,, 11 Fla. 295 (1866). 5. Subpoena a possible suspect??? Fla. Stat. 914.04... No person who has been duly served with a subpoena or subpoena duces tecum shall be excused from attending and testifying or producing any book, paper, or other document before any court having felony trial jurisdiction, grand jury, or state attorney upon investigation, proceeding, or trial for a violation of any of the criminal statutes of this state upon the ground or for the reason that the testimony or evidence, documentary or otherwise, required of the person may tend to convict him or her of a crime or to subject him or her to a penalty or forfeiture, but no testimony so given or evidence so produced shall be received against the person upon any criminal investigation or proceeding.

Scope of Fla. Stat. 914.04 This section grants derivative use immunity. Therefore, if witness s compelled testimony led to evidence that he had committed another crime, he could not be prosecuted for that crime unless prosecution could affirmatively prove that evidence it proposed to use was derived from legitimate source solely independent of compelled testimony. State v. McSwain, 440 So.2d 502 (Fla. 2d DCA 1983). A thorough investigation will lead to less of these... We the jury find as follows... the Defendant is NOT GUILTY.

And more of these. Sheri Maxim Michael Lennon Assistant State Attorneys Hillsborough County State Attorney s s Office Office: (813) 272-5400 Email: lennon_m@sao13th.com maxim_s@sao13th.com