Identity cards: exacerbating identity theft
by Wendy Barnaby
ID cards will not stop identity theft, says criminologist Dr Emily Finch of the University of East Anglia. In fact, she maintains, they may aggravate the problem.
‘Many people depend on technology to beat identity theft, but fraudsters evolve their strategies to keep up with changes in security technology,’ she says.
Through her research with criminals, Dr Finch has discovered what techniques they use to steal information about people.
‘As far as the state is concerned, we are collections of information,’ she says. ‘This means that you can impersonate me if you have enough information about me.’
As a simple example of how criminals steal credit cards, Dr Finch explains that they find it easier to steal the PIN and then the card rather than the other way round. ‘With chip and pin, you can find the PIN first if you look when people punch it in,’ she says.
‘Since chip and pin came in, sales staff have been told to look away when customers enter their PINs. The human element has been taken out of the transaction, and it’s easy for fraudsters to take advantage of that.
‘Fraudsters know how people behave,’ explains Dr Finch.
Even if they have stolen a card first, criminals pretend to have forgotten their PIN when they punch in an incorrect sequence. The helpful sales assistant will then swipe the card for them.
Because of the new norm of not overlooking the customer, and because of the relationship the fraudster has built between them during the encounter, the assistant will not then check the criminal’s signature on the card slip.
‘The time at which detection is most likely – the moment at which the signature was done – no longer exists,’ says Dr Finch. ‘It’s diluted. So fraud is actually easier.’
Part of the problem is that people trust the technology too much. ‘Many people look to technology to stop ID theft,’ says Dr Finch, ‘but it’s people who commit fraud.’
Another sort of identity theft doesn’t involve financial gain. Some people want to make a fresh start and take on a new identity as a means of escape. They may then take on the identity of someone who died in infancy, and whom they ‘resurrect’ in mid-life. This is not a crime, as long as the purpose is not fraudulent.
‘The paradox of identity and identity theft’, says Dr Finch, ‘is that we think the way to prevent one person impersonating another is to fix identity more firmly to a particular individual with, for example, biometrics.
‘However, the link between me and the card I hold depends on my initial application for the card being reliable. And at the moment, there is no way to ensure that’s the case.
‘The more we try to fix ID on one person, the more information we demand from each person to identify them. But the more personal information that is available, the more vulnerable it is to being appropriated by fraudsters,’ she says.
Dr Finch points out that identity cards depend on birth certificates, passports and driving licences, ‘all of which’, she says, ‘are easy to obtain in someone else’s name.’ With these pieces of information we will issue ID cards which we will regard as infallible.
‘But you can’t change a bunch of insecure pieces of information into one secure one,’ says Finch. ‘If you do, you run the risk – and it’s a risk the Home Office has acknowledged – that someone else will get in first and register as you. Once your identity has been registered, you cannot register in that same identity – in other words, as you.’
Dr Finch’s talk is one of the BA Award Lectures to be presented at this year’s BA Festival of Science.
ID cards will not stop identity theft, says criminologist Dr Emily Finch of the University of East Anglia. In fact, she maintains, they may aggravate the problem.
‘Many people depend on technology to beat identity theft, but fraudsters evolve their strategies to keep up with changes in security technology,’ she says.
Through her research with criminals, Dr Finch has discovered what techniques they use to steal information about people.
‘As far as the state is concerned, we are collections of information,’ she says. ‘This means that you can impersonate me if you have enough information about me.’
As a simple example of how criminals steal credit cards, Dr Finch explains that they find it easier to steal the PIN and then the card rather than the other way round. ‘With chip and pin, you can find the PIN first if you look when people punch it in,’ she says.
‘Since chip and pin came in, sales staff have been told to look away when customers enter their PINs. The human element has been taken out of the transaction, and it’s easy for fraudsters to take advantage of that.
‘Fraudsters know how people behave,’ explains Dr Finch.
Even if they have stolen a card first, criminals pretend to have forgotten their PIN when they punch in an incorrect sequence. The helpful sales assistant will then swipe the card for them.
Because of the new norm of not overlooking the customer, and because of the relationship the fraudster has built between them during the encounter, the assistant will not then check the criminal’s signature on the card slip.
‘The time at which detection is most likely – the moment at which the signature was done – no longer exists,’ says Dr Finch. ‘It’s diluted. So fraud is actually easier.’
Part of the problem is that people trust the technology too much. ‘Many people look to technology to stop ID theft,’ says Dr Finch, ‘but it’s people who commit fraud.’
Another sort of identity theft doesn’t involve financial gain. Some people want to make a fresh start and take on a new identity as a means of escape. They may then take on the identity of someone who died in infancy, and whom they ‘resurrect’ in mid-life. This is not a crime, as long as the purpose is not fraudulent.
‘The paradox of identity and identity theft’, says Dr Finch, ‘is that we think the way to prevent one person impersonating another is to fix identity more firmly to a particular individual with, for example, biometrics.
‘However, the link between me and the card I hold depends on my initial application for the card being reliable. And at the moment, there is no way to ensure that’s the case.
‘The more we try to fix ID on one person, the more information we demand from each person to identify them. But the more personal information that is available, the more vulnerable it is to being appropriated by fraudsters,’ she says.
Dr Finch points out that identity cards depend on birth certificates, passports and driving licences, ‘all of which’, she says, ‘are easy to obtain in someone else’s name.’ With these pieces of information we will issue ID cards which we will regard as infallible.
‘But you can’t change a bunch of insecure pieces of information into one secure one,’ says Finch. ‘If you do, you run the risk – and it’s a risk the Home Office has acknowledged – that someone else will get in first and register as you. Once your identity has been registered, you cannot register in that same identity – in other words, as you.’
Dr Finch’s talk is one of the BA Award Lectures to be presented at this year’s BA Festival of Science.
search this section
