IP: re: Serious new CALIFORNIA Drivers License ID RISK: [risks] Risks Digest 21.29

[David Farber <dave@farber.net>]

>X-Sender: tgoltz@mercury.quietsoftware.com
>X-Mailer: QUALCOMM Windows Eudora Version 5.0.2
>Date: Sun, 25 Mar 2001 20:48:30 -0500
>To: farber@cis.upenn.edu
>From: Tom Goltz <tgoltz@QuietSoftware.com>
>Subject: Re: IP: Serious new CALIFORNIA Drivers License ID RISK:
>   [risks] Risks Digest 21.29
>Cc: "Peter V. Cornell" <pcornell@nanospace.com>
>
>
>>>Date: Wed, 21 Mar 2001 16:03:12 -0800
>>>From: "Peter V. Cornell" <pcornell@nanospace.com>
>>>Subject: Serious new CA Drivers License ID RISK
>>>
>>>This is really happening!
>>>
>>>Almost exactly one decade ago Chris Hibbert posted a RISKS article
>>>describing the (then) new California Drivers License (CDL). He gave a
>>>warning to us all. That little piece is still on server:
>>>   http://catless.ncl.ac.uk/Risks/11.03.html#subj10
>>>[and has been updated by Chris since.  PGN]
>>>
>>>That warning, given in 1991, has blossomed into a nightmare.
>>>
>>>Recently, The California driver license and ID card have been declared as
>>>PRIMARY IDENTIFICATION DOCUMENTS in this state by the California
>>>legislature.
>>>
>>>http://www.dmv.ca.gov/faq/dlfaq.htm#2504
>>>http://www.lbl.gov/Workplace/HumanResources/irss/dmv.html
>>>
>>>Guess why?  A great convenience for bankers, but enabling serious new ID
>>>fraud RISKS based on easily obtained fake driver licenses and data.
>
>Very easily.  Ironically, the fake doesn't even have to be very good.
>
>A couple of facts that you may find interesting:
>
>I am white.  I have held a California driver's license in the past, but 
>that license has been inactive for over two years since I established 
>residency in another state.
>
>In October of last year, a black male obtained a fake California driver's 
>license with my name on it and his picture.  The driver's license ID # he 
>used belongs to a white female.  The address is a Commercial Mail 
>Receiving Agency in Costa Mesa CA, which the state doesn't normally 
>allow.  The fake also contained two spelling errors.
>
>This person used this ID and my social security number to open a dozen 
>different credit accounts in my name at various locations around the Los 
>Angeles area.  He was using a cell phone with a phone number based in the 
>603 area code as his residence phone.
>
>If anyone had bothered to look, just about everything about this guy 
>screamed fraud, yet he managed to steal $15,000 worth of merchandise 
>(mostly jewelry).
>
>Out of all these people who were supposed to be checking this information, 
>only TWO found problems.  One was a used car dealer who became suspicious 
>when the check this guy gave for the down payment proved to be 
>bogus.  They refused to give the guy the car, but didn't bother to pursue 
>the matter with the police.  The other was store security at a Costco in 
>Las Vegas, who tracked me down in New Hampshire and informed me that I had 
>a problem.  They detained the man, and turned him over to the police.
>
>Sadly, the most he's going do is a couple of years probation - he didn't 
>actually steal anything in Las Vegas, and the identity theft, although a 
>crime in NV is not sufficient to assure jail time by itself.  I discussed 
>the matter of extraditing the varmint to California with Las Vegas police, 
>but they told me that it was unlikely that California would bother for 
>something that would only net the offender probation there as 
>well.  According to the LV police detective, in California, you have to be 
>charged with stealing over $50,000 before you'll do any jail time.
>
>It's no wonder this crime is exploding...it's low risk, extremely 
>profitable, and trivial to implement.
>
>Oh yes...how did he get my name and social security number?  He told the 
>Las Vegas police that he purchased the information on the street for $500.
>
>
>
>
>Tom Goltz
>Software Engineering Services
>(603) 594-9922
>(603) 594-9939 (fax)
>



For archives see: http://www.interesting-people.org/