Sensitive identity data is everywhere.
For the right price, fraudsters can use stolen identities to with just about any online service. How are modern day applications and services supposed to protect themselves and their members from fraud when all that data is just floating out there ready to be used!?
The most recent data breach by Equifax of 143 Million U.S. Citizen identities is only the latest in a long string of leaks, but it is one of the scarier ones because it includes information that many websites and services use to confirm identity. It included names, credit card numbers and social security numbers. Here’s just a sampling of the data breaches that have occurred in the last 5 years:
|Equifax||143 million people’s personal, financial, and credit information||2017|
|Verizon||14 million subscribers||2017|
|167 million accounts||2016|
|Yahoo||500+ million accounts had data stolen in 2014 (reported in 2016)||2016|
|Anthem||80 million patient and employee records||2015|
|Ashley Madison||33 million user accounts and contact information||2015|
|eBay||145 million customer accounts||2014|
|JPMorgan Chase||76 million households, 7 million small businesses.||2014|
|Home Depot||56 million credit card accounts, 53 million email addresses||2014|
|Target||40 million credit and debit card accounts, as well as data on 70 million customers.||2013|
Ever wonder where all that data from those data breaches go?
It turns out that much like any commodity, identities can be bought and sold. In fact it’s easy to acquire fake IDs and while in 2015 the cost of an ID might’ve been around $20, simple supply and demand dictates that with more breaches and more information can drive the price required to buy a fraudulent ID down. It’s important to note here that these purchased identities may be a assembly of the data from multiple breach so they can include everything from passport, driver’s license, social security number, credit cards, phone numbers and mother’s maiden name – on a single person!
These identities may then be used to conduct transactions or make purchases on the websites and services where institutions these mechanisms to help verify that people are who they say that are.