Жеке куәлікті ұрлау және оның салдары

Deliberate use of someone else's identity
the concept of identity theft
the 1953 film

Identity theft, identity piracy or identity infringement occurs when someone uses another's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The term identity theft was coined in 1964. Since that time, the definition of identity theft has been legally defined throughout both the U. K. and the U. S. as the theft of personally identifiable information. Identity theft deliberately uses someone else's identity as a method to gain financial advantages or obtain credit and other benefits. The person whose identity has been stolen may suffer adverse consequences, especially if they are falsely held responsible for the perpetrator's actions. Personally identifiable information generally includes a person's name, date of birth, social security number, driver's license number, bank account or credit card numbers, PINs, electronic signatures, fingerprints, passwords, or any other information that can be used to access a person's financial resources. Determining the link between data breaches and identity theft is challenging, primarily because identity theft victims often do not know how their personal information was obtained. According to a report done for the FTC, identity theft is not always detectable by the individual victims. Identity fraud is often but not necessarily the consequence of identity theft. Someone can steal or misappropriate personal information without then committing identity theft using the information about every person, such as when a major data breach occurs. A U. S. Government Accountability Office study determined that "most breaches have not resulted in detected incidents of identity theft". The report also warned that "the full extent is unknown". A later unpublished study by Carnegie Mellon University noted that "Most often, the causes of identity theft is not known", but reported that someone else concluded that "the probability of becoming a victim to identity theft as a result of a data breach is around only 2%". For example, in one of the largest data breaches which affected over four million records, it resulted in only about 1,800 instances of identity theft, according to the company whose systems were breached. An October 2010 article entitled "Cyber Crime Made Easy" explained the level to which hackers are using malicious software. As Gunter Ollmann,
Chief Technology Officer of security at Microsoft, said, "Interested in credit card theft? There's an app for that." This statement summed up the ease with which these hackers are accessing all kinds of information online. The new program for infecting users' computers was called Zeus, and the program is so hacker friendly that even an inexperienced hacker can operate it. Although the hacking program is easy to use, that fact does not diminish the devastating effects that Zeus (or other software like Zeus) can do on a computer and the user. For example, programs like Zeus can steal credit card information, important documents, and even documents necessary for homeland security. If a hacker were to gain this information, it would mean nationwide identity theft or even a possible terrorist attack. The ITAC said that about 15 million Americans had their identity stolen in 2012.

In this situation, the identity thief impersonates someone else to conceal their own true identity. Examples are illegal immigrants hiding their illegal status, people hiding from creditors or other individuals and those who simply want to become "anonymous" for personal reasons. Another example is posers, a label given to people who use someone else's photos and information on social networking sites. Posers mostly create believable stories involving friends of the real person they are imitating. Unlike identity theft used to obtain credit which usually comes to light when the debts mount, concealment may continue indefinitely without being detected, particularly if the identity thief can obtain false credentials to pass various authentication tests in everyday life.

When a criminal fraudulently identifies themselves to police as another individual at the point of arrest, it is sometimes referred to as "Criminal Identity Theft." In some cases, criminals have previously obtained state issued identity documents using credentials stolen from others, or have simply presented a fake ID. Provided the subterfuge works, charges may be placed under the victim's name, letting the criminal off the hook. Victims might only learn of such incidents by chance, for example by receiving a court summons, discovering their driver's licenses are suspended when stopped for minor traffic violations, or through background checks performed for employment purposes. It can be difficult for the victim of criminal identity theft to clear their record. The steps required to clear the victim's incorrect criminal record depend on which jurisdiction the crime occurred and whether the true identity of the criminal can be determined. The victim might need to locate the original arresting officers and prove their own identity by some reliable means such as fingerprinting or DNA testing and may need to go to a court hearing to be cleared of the charges. Obtaining an expungement of court records may also be required. Authorities might permanently maintain the victim's name as an alias for the criminal's true identity in their criminal records databases. One problem that victims of criminal identity theft may encounter is that various data aggregators might still have incorrect criminal records in their databases even after court and police records are corrected. Thus a future background check may return the incorrect criminal records. This is just one example of the kinds of impact that may continue to affect the victims of identity theft for some months or even years after the crime, aside from the psychological trauma that being 'cloned' typically engenders.

A variation of identity theft that has recently become more common is synthetic identity theft, in which identities are completely or partially fabricated. The most common technique involves combining a real social security number with a name and birthdate other than the ones that are simply associated with the number. Synthetic identity theft is more difficult to track as it doesn't show on either person's credit report directly but may appear as an entirely new file in the credit bureau or as a subfile on one of the victim's credit reports. Synthetic identity theft primarily harms the creditors who unwittingly grant the fraudsters credit. Individual victims can be affected if their names become confused with the synthetic identities, or if negative information in their subfiles impacts their credit ratings.

Privacy researcher Pam Dixon, the founder of the World Privacy Forum, coined the term medical identity theft and released the first major report about this issue in 2006. In the report, she defined the crime for the first time and made the plight of victims public. The report's definition of the crime is that medical identity theft occurs when someone seeks medical care under the identity of another person. Insurance theft is also very common, if a thief has your insurance information and or your insurance card, they can seek medical attention posing as yourself. In addition to risks of financial harm common to all forms of identity theft, the thief's medical history may be added to the victim's medical records. Inaccurate information in the victim's records is difficult to correct and may affect future insurability or cause doctors to rely on misinformation to deliver inappropriate care. After the publication of the report, which contained a recommendation that consumers receive notifications of medical data breach incidents, California passed a law requiring this, and then finally HIPAA was expanded to also require medical breach notification when breaches affect 500 or more people. Data collected and stored by hospitals and other organizations such as medical aid schemes is up to 10 times more valuable to cybercriminals than credit card information.

Child identity theft occurs when a minor's identity is used by another person for the impostor's personal gain. The impostor can be a family member, a friend, or even a stranger who targets children. The Social Security numbers of children are valued because they do not have any information associated with them. Thieves can establish lines of credit, obtain driver's licenses, or even buy a house using a child's identity. This fraud can go undetected for years, as most children do not discover the problem until years later. Child identity theft is fairly common, and studies have shown that the problem is growing. The largest study on child identity theft, as reported by Richard Power of the Carnegie Mellon Cylab with data supplied by AllClear ID, found that of 40,000 children, 10.2% were victims of identity theft. The Federal Trade Commission (FTC) estimates that about nine million people will be victims of identity theft in the United States per year. It was also estimated that in 2008; 630,000 people under the age of 19 were victims of theft. This then gave the victims a debt of about $12,799. Not only are children in general big targets of identity theft but children who are in foster care are even bigger targets. This is because they are most likely moved around quite frequently and their SSN is being shared with multiple people and agencies. Foster children are even more victims of identity theft within their own families and other relatives. Young people in foster care who are victims of this crime are usually left alone to struggle and figure out how to fix their newly formed bad credit.

The most common type of identity theft is related to finance. Financial identity theft includes obtaining credit, loans, goods, and services while claiming to be someone else.

The acquisition of personal identifiers is made possible through serious breaches of privacy. For consumers, this is usually a result of them naively providing their personal information or login credentials to the identity thieves (e. g., in a phishing attack) but identity related documents such as credit cards, bank statements, utility bills, checkbooks, etc. may also be physically stolen from vehicles, homes, offices, and not the least letterboxes, or directly from victims by pickpockets and bag snatchers. Guardianship of personal identifiers by consumers is the most common intervention strategy recommended by the US Federal Trade Commission, Canadian Phone Busters and most sites that address identity theft. Such organizations offer recommendations on how individuals can prevent their information from falling into the wrong hands. Identity theft can be partially mitigated by not identifying oneself unnecessarily (a form of information security control known as risk avoidance). This implies that organizations, IT systems, and procedures should not demand excessive amounts of personal information or credentials for identification and authentication. Requiring, storing, and processing personal identifiers (such as Social Security number, national identification number, driver's license number, credit card number, etc.) increases the risks of identity theft unless this valuable personal information is adequately secured at all times. Committing personal identifiers to memory is a sound practice that can reduce the risks of a would be identity thief from obtaining these records. To help in remembering numbers such as social security numbers and credit card numbers, it is helpful to consider using mnemonic techniques or memory aids such as the mnemonic Major System. Identity thieves sometimes impersonate dead people, using personal information obtained from death notices, gravestones, and other sources to exploit delays between the death and the closure of the person's accounts, the inattentiveness of grieving families, and weaknesses in the processes for credit checking. Such crimes may continue for some time until the deceased's families or the authorities notice and react to anomalies. In recent years, commercial identity theft protection/insurance services have become available in many countries. These services purport to help protect the individual from identity theft or help detect that identity theft has occurred in exchange for a monthly or annual membership fee or premium. The services typically work either by setting fraud alerts on the individual's credit files with the three major credit bureaus or by setting up credit report monitoring with the credit bureau. While identity theft protection/insurance services have been heavily marketed, their value has been called into question.

Identity theft is a serious problem in the United States. In a 2018 study, it was reported that 60 million Americans' identities had been wrongfully acquired. In response, under advisement from the Identity Theft Resource Center, some new bills have been implemented to improve security such as requiring electronic signatures and social security verification. The conclusions of this study revealed that identity theft was a positive correlation with reputable damages.

There is an active market for buying and selling stolen personal information, which occurs mostly in darknet markets but also in other black markets. People increase the value of the stolen data by aggregating it with publicly available data, and sell it again for a profit, increasing the damage that can be done to the people whose data was stolen.

In March 2014, after it was learned two passengers with stolen passports were on board Malaysia Airlines Flight 370, which went missing on 8 March 2014. It came to light that Interpol maintains a database of 40 million lost and stolen travel documents from 157 countries, which Interpol makes available to governments and the public, including airlines and hotels. The Stolen and Lost Travel Documents (SLTD) database, however, is rarely used. Big News Network (which is based in the UAE) reported that Interpol Secretary General Ronald K. Noble told a forum in Abu Dhabi in the previous month, "The bad news is that, despite being incredibly cost effective and deployable to virtually anywhere in the world, only a handful of countries are systematically using SLTD to screen travelers. The result is a major gap in our global security apparatus that is left vulnerable to exploitation by criminals and terrorists."

Social networking sites are one of the most famous spreaders of posers in the online community, giving the users the freedom to post any information they want without any verification that the account is being used by the real person. The Philippines, which ranks eighth in the numbers of users of Facebook and other social networking sites (such as Twitter, Multiply and Tumblr), has been known as a source of various identity theft problems. Identities of people who carelessly put personal information on their profiles can easily be stolen just by simple browsing. Some people meet online, get to know each other through Facebook chat, and exchange messages that share private information. Others get romantically involved with online friends and end up sharing too much information (such as their social security number, bank account, home address, and company address). This phenomenon leads to the creation of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175). Section 2 of this act states that it recognizes the importance of communication and multimedia for the development, exploitation, and dissemination of information, but violators will be punished by the law through imprisonment or a fine upwards of ₱200,000, but not exceeding ₱1,000,000, or (depending on the damage caused) both.

Sweden has had relatively few problems with identity theft because only Swedish identity documents were accepted for identity verification. Stolen documents are traceable by banks and certain other institutions. Banks are required to check the identity of anyone withdrawing money or getting loans. If a bank gives money to someone using an identity document that has been reported as stolen, the bank must take this loss. Since 2008, any EU passport is valid in Sweden for identity verification, and Swedish passports are valid all over the EU. This makes it harder to detect stolen documents, but banks in Sweden still must ensure that stolen documents are not accepted. Other types of identity theft have become more common in Sweden. One common example is ordering a credit card to someone who has an unlocked letterbox and is not home during the daytime. The thief steals the letter with the credit card and the letter with the code, which typically arrives a few days later. Usage of a stolen credit card is difficult in Sweden since an identity document or a PIN code is normally demanded. If a shop does not demand either, it must take the loss from accepting a stolen credit card. The practice of observing someone using their credit card's PIN code, stealing the credit card, or skimming it, and then using the credit card has become more common. Legally, Sweden is an open society. The Principle of Public Access states that all information (e. g. addresses, incomes, taxes) kept by public authorities must be available for anyone, except in certain cases (for example, the addresses of people who need to hide are restricted). This makes fraud easier. Until 2016, there were no laws that specifically prohibited using someone's identity. Instead, there were only laws regarding any indirect damages caused. Impersonating anyone else for financial gain is a type of fraud in the Criminal Code (brottsbalken). Impersonating anyone else to discredit them by hacking into their social media accounts and provoke is considered libel. However, it is difficult to convict someone of committing this crime. In late 2016, a new law was introduced which partially banned undetermined identity usage.

In the United Kingdom, personal data is protected by the Data Protection Act 1998. The Act covers all personal data which an organization may hold, including names, birthday and anniversary dates, addresses, and telephone numbers. Under English law (which extends to Wales but not to Northern Ireland or Scotland), the deception offences under the Theft Act 1968 increasingly contend with identity theft situations. In R v Seward (2005) EWCA Crim 1941, the defendant was acting as the "frontman" in the use of stolen credit cards and other documents to obtain goods. He obtained goods to the value of £10,000 for others who are unlikely ever to be identified. The Court of Appeal considered a sentencing policy for deception offenses involving "identity theft" and concluded that a prison sentence was required. Henriques J. said at para 14: "Identity fraud is a particularly pernicious and prevalent form of dishonesty calling for, in our judgment, deterrent sentences." Statistics released by CIFAS (UK's Fraud Prevention Service) show that there were 89,000 victims of identity theft in the UK in 2010 and 85,000 victims in 2009. Unreliable source: date=December 2015 Men in their 30s and 40s are the most common victims. Unreliable source: date=December 2015 Identity fraud now accounts for nearly half of all frauds recorded.

The increase in crimes of identity theft led to the drafting of the Identity Theft and Assumption Deterrence Act. In 1998, The Federal Trade Commission appeared before the United States Senate. The FTC discussed crimes which exploit consumer credit to commit loan fraud, mortgage fraud, lines of credit fraud, credit card fraud, commodities and services frauds. The Identity Theft Deterrence Act (2003)[ITADA] amended U. S. Code Title 18, § 1028 ("Fraud related to activity in connection with identification documents, authentication features, and information"). The statute now makes the possession of any "means of identification" to "knowingly transfer, possess, or use without lawful authority" a federal crime, alongside unlawful possession of identification documents. However, for federal jurisdiction to prosecute, the crime must include an "identification document" that either: (a) is purportedly issued by the United States, (b) is used or intended to defraud the United States, (c) is sent through the mail, or (d) is used in a manner that affects interstate or foreign commerce. See (c). Punishment can be up to 5, 15, 20, or 30 years in federal prison, plus fines, depending on the underlying crime per (b). In addition, punishments for the unlawful use of a "means of identification" were strengthened in § 1028A ("Aggravated Identity Theft"), allowing for a consecutive sentence under specific enumerated felony violations as defined in § 1028A(c)(1) through (11). The Act also provides the Federal Trade Commission with authority to track the number of incidents and the dollar value of losses. Their figures relate mainly to consumer financial crimes and not the broader range of all identification based crimes. If charges are brought by state or local law enforcement agencies, different penalties apply to depend on the state. Six Federal agencies conducted a joint task force to increase the ability to detect identity theft. Their joint recommendation on "red flag" guidelines is a set of requirements on financial institutions and other entities which furnish credit data to credit reporting services to develop written plans for detecting identity theft. The FTC has determined that most medical practices are considered creditors and are subject to requirements to develop a plan to prevent and respond to patient identity theft. These plans must be adopted by each organization's board of directors and monitored by senior executives. Identity theft complaints as a percentage of all fraud complaints decreased from 2004 to 2006. The Federal Trade Commission reported that fraud complaints in general were growing faster than ID theft complaints. The commission's 2003 estimate was that identity theft accounted for some $52.6 billion of losses in the preceding year alone and affected more than 9.91 million Americans; the figure comprises $47.6 billion lost by businesses and $5 billion lost by consumers. According to the U. S. Bureau of Justice Statistics, in 2010, 7% of US households experienced identity theft up from 5.5% in 2005 when the figures were first assembled, but broadly flat since 2007. In 2012, approximately 16.6 million persons, or 7% of all U. S. residents age 16 or older, reported being victims of one or more incidents of identity theft. At least two states, California and Wisconsin have created an Office of Privacy Protection to assist their citizens in avoiding and recovering from identity theft. In 2009, Indiana created an Identity Theft Unit within their Office of Attorney General to educate and assist consumers in avoiding and recovering from identity theft as well as assist law enforcement in investigating and prosecuting identity theft crimes. In Massachusetts in 2009–2010, Governor Deval Patrick committed to balancing consumer protection with the needs of small business owners. His Office of Consumer Affairs and Business Regulation announced certain adjustments to Massachusetts' identity theft regulations that maintain protections and also allow flexibility in compliance. These updated regulations went into effect on 1 March 2010. The regulations are clear that their approach to data security is a risk based approach important to small businesses and might not handle a lot of personal information about customers. The IRS has created the IRS Identity Protection Specialized Unit to help taxpayers' who are victims of federal tax related identity theft. Generally, the identity thief will use a stolen SSN to file a forged tax return and attempt to get a fraudulent refund early in the filing season. A taxpayer will need to fill out Form 14039, Identity Theft Affidavit. As for the future of medical care and Medicaid, people are mostly concerned about cloud computing. The addition of using cloud information within the United States medicare system would institute easily accessible health information for individuals, but that also makes it easier for identity theft. Currently, new technology is being produced to help encrypt and protect files, which will create a smooth transition to cloud technology in the healthcare system.

Many states followed California's lead and enacted mandatory data breach notification laws. As a result, companies that report a data breach typically report it to all their customers.

U. S.