identity theft – Pickpocket Bob Arno

Database data loss

People often share their credit card anxiety with me. They’re afraid their cards will be lost or stolen and huge bills will be run up by a thief, and that their identities will be cloned. “Is it better to just carry cash?” they ask. “Should I follow the waiter when I pay my restaurant bill?” “How safe is it to use a credit card on the internet? Will my identity be stolen?”

So let’s put these questions to rest. Then we can move on to the real risk.

First, yes. Your credit card can be lost or stolen and big debts can be incurred by others. You won’t be responsible—your financial institution takes the hit. But in the grand scheme of things, the odds are not high that your credit card will disappear and be compromised. The risk is higher in some places than in others, and for some people more than for others. But that’s life. Get over it and live.

No. It’s not better to carry cash. Keep some cash for small (or secret) purchases, and use credit cards for the rest.

Yes, shop on the internet with your credit card. If it makes you feel better, get one of those temporary credit card numbers on your account, good for a single transaction or a limited amount. Without internet and a credit card, you’re crippled.

The real risk of identity theft and credit card fraud

It’s big business. The hotels and hospitals we go to, the stores, banks, schools, airlines, doctors, utilities, banks, credit unions we use, and even government organizations. All of these and more store information about us. They all comply with information security regulations to some extent. But how much and how well? Our identities are in the hands of those who store our details.

Database data loss

If our PII (personally identifiable information) is set free, it will most likely be due to an electronic data breach of some sort, in a (probably-large) batch with others’ information.

We used to be concerned that manilla folders containing our records were physically locked up. Who had access to them? How were they discarded? Shredded or dumped in a Dumpster? There’s so much more to worry about now, and so much more than a single set of paperwork. Our most sensitive secrets and deepest dirt are stored electronically on hard drives, on servers, in the cloud, backed up, on laptops, mobile phones, and even on thumbdrives.

Laptops and thumbdrives are lost and stolen every day. Databases are breached every day. This is where the risk is, and it’s out of our hands.

The advantage goes to data thieves like Rogelio Hackett who, until a little slip-up, broke into the computer networks of businesses, downloaded credit card information, and sold it for profit. Big profit.

“The bad news is that banks and businesses have not made great progress in the fight against account takeover fraud,” says The Information Security Media Group in its 2011 Business Banking Trust Study. Bringing institutions to compliance has been a painful process.

Security vulnerabilities are uncovered daily in computer networks everywhere, from the Australian Parliament House to the Pentagon to our water supplies In the 3/28/11 Los Angeles Times, Ken Dilanian wrote that “Impeding the move toward bolstering U.S. infrastructure is the government’s lack of authority to coerce industry to secure its networks and industry’s lack of an incentive to implement such protections.” He was referring to the threat of terrorist cyberattacks, but our personal security is at risk as well.

Read this for the state of cybersecurity:

A new survey reveals that roughly three-quarters of energy companies and utilities experienced at least one data breach in the past 12 months. … Seventy-one percent of respondents said that “the management team in their organization does not understand or appreciate the value of IT security.” Moreover, only 39 percent of organizations were found to be actively watching for advanced persistent threats, 67 percent were not using “state of the art” technology to stop attacks against SCADA (supervisory control and data acquisition) systems, and 41 percent said their strategy for SCADA security was not proactive. The survey also concluded that the leading threat for energy utilities was not external attackers, but rather inside ones—43 percent of utilities cited “negligent or malicious insiders” as causing the highest number of data breaches. …

InformationWeek (04/06/11)

To get a fuller grasp of the number of electronic records lost or stolen, take a peek at the DataLoss DataBase project, which “documents known and reported data loss incidents world-wide.” You can search by type of data lost (Social Security numbers, financial information, credit card numbers, etc.); by the industry sector (business, government, educational institution, etc.) You can see if the breach was by an insider or an outside attacker, and whether it was malicious or accidental. And you can search by many types of breach: improper disposal, a hacked or lost computer, a stolen drive, a web attack, etc. I’m especially fond of the datalossdb Twitter feed, for minute-by-minute reports of data losses, with links to known details. For example:

http://bit.ly/eDcD2s

http://bit.ly/gW2WYs – AllianceBernstein Holding LP – Employee downloaded client files and transactions before resigning

http://bit.ly/dTAmUX – Qdoba Mexican Grill – Customers’ card numbers acquired and misused

http://bit.ly/hdmt25 – Hyundai Capital – Personal credit rating information of 420,000 vehicle loan customers plus 13,000 security passwords acquired by hackers

And on and on. The feed may shock you daily, as it does me. Why is our vital information handled so carelessly?

Well-known and trusted companies like Brookstone, AbeBooks, Ralphs Grocery, Ritz-Carlton, Smith’s Food & Drug, Best Buy, Verizon, etc., assure us they store our information responsibly. Then they farm it out to Epsilon online marketing, a company they do not control. Epsilon got hacked.

More than 65 companies have been impacted, to the great risk and inconvenience of their customers. I got emails after the breach from three of the businesses, warning that data on me had been among the stolen records. Security experts now expect a massive increase in “spear phishing,” in which individuals are personally targeted and tricked by spoofs of companies they have a legitimate relationship with. I get plenty of phishing email already, and some of them look damn believable. Expect them to look even better now, addressed to us by name.

I’m not going to address every risk and precaution here. There is much, and it’s all to be read elsewhere on and off this blog. My points are two:

1. Our ordinary everyday activities may expose us to a little risk of credit card fraud and identity theft, but the big risk is out of our hands.

2. Do look at DataLoss DataBase or at least skim its Twitter feed to get an idea of how much information is lost daily.

Credit card shimming

[dropcap letter=”F”]irst there was skimming, now there’s shimming,” says Kim Thomas, former Las Vegas Metro Detective, now an international authority on forgery. Information on this new credit card acquisition technique comes via a Citibank investigator.

Now, looking for parts stuck onto the front of a cash machine, which might indicate fraudulent activity, is not enough. A shimmer does the work of a skimmer, but is housed completely inside the card slot of an ATM. In other words, entirely invisible to users.

Shimming

Kim Thomas describes the shim-skimmer: “The thief makes a circuit board the size of a credit card, but approximately .1 mm thick. They use a carrier card to insert the device. Basically it is a reader-transmitter. The reader does what the usual credit card skimmer does: capture full track data. The transmitter does what bluetooth does: transmit the track data to a receiver. The technology is pretty sophisticated and will be hard to catch once it goes into mass production.”

According to Jamey Heary, Cisco Security Expert, “effective flexible shims are recently being mass produced and widely used in certain parts of Europe.” He diagrams the physical layout of this “man-in-the-middle” attack as installed inside a card-reader.

I haven’t found anyone who has actually seen one of these shimmers, but no one’s calling it just a proof-of-concept, either. It isn’t clear to me whether or not the shimmer works with U.S. credit cards that lack the chip-and-PIN. Anyone know more about this?

credit card fraud identity theft skimmer theft Thieves

Gas pump skimmers attached in 11 seconds

Breaking news from Las Vegas Metro’s Kim Thomas, the fraud cop featured in my story on credit card skimmers hidden in gas pumps.

Detective Thomas writes:

I read the post you did with my picture. It was very impressive. At the end you said a thief attached a skimmer in eight minutes. I just wanted to give you a small correction. We found that the one on the side of the gas pump drawer was attached in about 11 seconds, so if you add in opening the door, you’re looking at about 30 seconds (and that’s us fumbling with the key). So here’s the process: put the key in the lock, open the door, slide out the drawer, unplug the two cables from the gas pump connectors (keypad and reader cables), slap on the device, plug the two gas pump cables into the skimmer, plug the skimmer cables into the gas pump connectors, slide the drawer in, close the outside door, turn the key, remove it, test with a known credit card (outside the process of hooking the skimmer because anyone seeing you do that would assume you’ve doing something legitimate. Sounds like a lot, but look at a watch, close your eyes, and envision the process, then look at the watch and see what kind of time you get. It’ll probably amaze you. Now imagine practicing it a bit on your own gas pump either in your storage unit or living room or buddy’s gas pump. Now you’ve gotten faster and smoother, so you’re faster. See?

Thomas continues on the frightening trajectory of credit card fraud:

This type of crime used to be done strictly by hi-tech crews, but now we’re seeing it done by Joe and Julie the tweeker people (common street criminals), the traditional black crews who used to be just check passers and bust-out crooks, and the Hispanic immigrant groups who have always supplied ID documents (to name a few groups). There’s just so much money and property in this.

A hotel loyalty card and its data showing on a skimmer

I just asked for a warrant on a member of a group of rich college kids (who bought a $7,500.00 watch in a high end Fashion Show Mall store) who have been buying numbers skimmed from American hotel chains in Europe, then using that track data to make counterfeits (this is a good way to do it because the cards are from American customers and less likely to raise a red flag with the bank looking at the transaction since it’s used in the US), which they then use at stores here, in SoCal, and in Arizona. They then take the property and sell it. The kicker is that all these kids are Mexican nationals whose parents are so wealthy they have their kids going to school at American Universities.

See our pickpocket summary page.

credit card fraud identity theft Las Vegas skimmer

Phone phishing

If you read this blog, you’re probably already security-conscious. But this reminder is worth repeating. Don’t trust anyone.

Sorry.

It’s a shame that’s what the world has come to. Even the good samaritan has to be looked at sideways.

Scammers are now blasting entire towns, phone number by phone number, telling residents that their debit card has been restricted. They target customers of a specific local bank or credit union, name it, and give the customer an 800 number to call in order to correct the situation. If you have a debit card from that financial institution, you just might believe it. Well, other people are believing it. After all, their caller-ID proves that it really is the bank calling.

Or does it? The scammers are able to “spoof” the phone number, so it only appears to be the bank calling. You have no inkling that you’ve been targeted by overseas phishers. If you aren’t a customer of that bank, you probably just hang up and forget it.

If you follow the scammers’ instructions, you’ll give them your card number, pin, and all the other juicy data they need to rack up the charges.

So the tired old reminder worth repeating is this: If you suspect a problem with your bank account or debit card, etc., call your bank’s main number. Call the number on the back of your card or on your bank statement. Especially don’t call a number given to you by the bearer of the news.

bank credit debit financial fraud identity theft phishing phone scam social engineer

Shred

Do not let a power outage compromise your security.

identity theft

How Bernanke’s ID thieves did it

Shonya Michelle Young (Credit: U.S. Marshal Service)

Anna Bernanke hung her purse on the back of a chair at Starbucks. It was stolen and, soon after, she and Ben became victims of identity theft.

It’s extremely simple to steal a purse that isn’t attached to a person. It could be on the back of a chair, on an empty chair, or on the floor. Bob’s done it many times for television news shows. Yep, even in busy coffee shops and mall food courts, where you’d think a few people would notice. It has to do with how you drape a coat over the purse.

In her handbag, Anna carried what thieves call a spread: credit card, identification, checks, and her Social Security card (shame on her!). This is the jackpot for a pickpocket and identity theft ring.

Not all pickpockets know how to exploit checks and credit cards. But by now they know at least to sell them. In the old days, some thieves would actually bother to drop them in a mailbox.

Some pickpockets have their own ID theft specialists on staff or on call. When they snag a bag containing a spread, they want to cash a hefty check or two, and they want a fat cash advance on the credit card. They could just buy murch—stuff at a store—but then they’d get just a fraction of its value from a fence. A cash advance is the best, especially in cities with casinos. The thieves can request several advances simultaneously, at different casinos. Each will be approved because none has actually been granted yet. A thief can easily make about $60,000 in an hour with just one credit card.

I wrote of this in a forum a few years ago, and someone asked:

How can they get a cash advance without showing an ID matching their face to the name on the card? Whenever I’m in Vegas I get asked for ID when using credit cards even for a 5.00 purchase.

That’s where the pickpocket’s staff comes in. These thieves have a covey of accomplices on standby. “A blonde, a brunette, an Asian, an older woman with gray hair, and a heavy-set,” a practitioner of this business told me. They call them look-alikes. When the pickpocket gets a check or credit card with ID, he phones the accomplice who looks most like the victim (and that doesn’t have to be much!). The accomplice practices the victim’s signature a time or two, then goes to collect the cash advance (which the thief applied for at a machine.) At this point, the accomplice is referred to as a writer. She writes the check or signs for the cash advance. The harried teller or cashier takes a quick glance, sees a vague resemblance (maybe thinks: oh, honey, you’re having a bad day), and doles out the cash under pressure to serve the next person in line.

The suddenly-infamous George Lee Reid was [allegedly] the identity theft ring’s writer of one of Bernanke’s checks, at a bank in Maryland. The ring’s main writer, Shonya Michelle Young (pictured above), has just been captured. In her possession, she had fake ID, credit cards in the name of others, and “wigs worn while cashing fraudulent checks.”

Skimmers and credit card fraud (more)

Credit card fraud: Would you notice if a skimmer were attached to an ATM? — Would you notice if a skimmer were attached to an ATM?

Skimmers, officially called magnetic card readers, capture the data on a card’s magnetic strip. Exactly what information is that?

Credit and debit cards have three “tracks” of data. Track 1 stores your name, account number and expiration date, and discretionary data to verify the PIN and security code. This information goes to the point of sale terminal, and allows your receipt to include your name and the last four digits of your account number.

Track 2 stores similar information coded and formatted specifically for the banking industry. This is the data that, from a merchant, goes to the bank via modem. Actually, it goes to an “acquirer,” a middle-man organization that authenticates the account data and guarantees payment to the merchant.

Track 3 was supposed to store biometrics, like a photo and thumbprint, but the banks decided it was too expensive to implement and do not use track 3 at all. It’s sometimes used on non-bank cards: airline cards, hotel and club memberships, etc. Track 3 is also writable.

Credit card fraud

Legitimate mag-strip readers are everywhere. Illegitimate ones, which I’ll refer to as skimmers, are, too. They may be stuck onto the faces of ATMs or gas pumps (possibly detectable). They may be attached to a merchant’s point-of-sale terminal (undetectable by customer, should be detectable by aware merchant). They have recently been found inside gas pumps (undetectable). Tiny, handheld models are used by waiters and others who swipe credit cards legitimately; they make an additional, criminal swipe through the portable skimmer.

Mag-strip readers are easily, legally purchased. The largest distributor is (no surprise) just outside Las Vegas. Bob met with the owner of the business, and bought a skimmer. The owner claims that his largest customers are schools and libraries, which buy in bulk in order to record attendance and keep track of books. I’ve heard from law enforcement that his biggest customer is the FBI, which buys skimmers, encodes them with trackable ID, and lets them fall into the wrong hands.

Our skimmer, pictured below, captures all three data tracks. Bob could have bought one half the size with twice the storage and a bluetooth interface for twice the price. The kind just pulled from the apron of a waiter at a high-end restaurant at Caesar’s Forum in Las Vegas—a restaurant frequented by a celebrity clientele (i.e. high-limit credit cards).

Whether obtained by an employee using a handheld skimmer, or one attached to stationary equipment, card data is gathered and stored, then collected by wired download or wireless transmission. Then what?

Someone called “afterlife” wrote:

Credit card theft is a growing problem but it does not happen the way most people envision it.Â It’s not the lone hacker who goes it alone to compromise one site and sell the credit card numbers to fraudsters.

These days it’s a network of carders who each have a specific role.Â Roman Vega of Boa Factory fame was known for having lawyers, botnet owners, hackers, traffickers, and pushers all on staff.Â These days the professional carder will knock over several merchants and store the information without using it for up to two years.Â Once they have amassed enough information they join the databases together forming a master datasheet on peoples lives.

Once they join databases with your credit card number and others with your e-mail address they can perform ‘spear phishing’ where they send you a targeted e-mail, with your credit card number, asking for your PIN number.

Credit card fraud: Portable magnetic card reader, aka skimmer. — Portable magnetic card reader, aka skimmer.

Credit card fraud is highly organized, en masse. Besides phishing and spear phishing, data is also written to new cards. These new cards can be blank stock, stolen cards (where sometimes the encoded data does not match what is printed—but who notices that?), gift cards, or shared-value cards. Mag-strip writers can be purchased as easily as mag-strip readers; and some models of readers just need a little extra software in order to write.

Everything one needs for credit card fraud can be learned or purchased on “carder sites.” Skimmer “dumps” are sold in lots, with payment made via Western Union. Here’s a typical “ad,” found among Afterlife’s blog comments (link above). This one’s about six months old:

The Best Dumps for a Good Price. Selling USA.
Hello dear friends. I’m a Memfis.
I have USA dumps, and some Asian.…¨I have a good price for it:
USA…¨20 USD CLASSIC, MASTER…¨25 USD VISA GOLD…¨30 USD VISA PLATINUM AND BUSINESS
ASIA…¨80 USD CLASSIC, MASTER…¨100 USD PLATINUM
I have my own base, good approval percent …“ about 90%…¨USA and Asia …“ 101 only. But I dont have EU bins.
USA …“ original track2.…¨Asia …“ both tracks are original, track1 and track2.
Payment is Western Union.…¨I’m sending order only after recieving payment, in 3-24 hours.…¨I have a replace pocily, but i should know what cards declined or holdcall in 24 hours, to replace it, in other time i wont replace.
For real buyers:…¨I can proove my quality, message me my ICQ.

Credit card fraud: Latest ATM skimmer, with measurement in centimeters. — Latest ATM skimmer, with measurement in centimeters.

Here’s a good thing: some of these gizmos hidden in gas pumps cause the pump to fail, so they’re found. But there’s bad news, too. Data from skimmers slyly hidden in gas pumps and other good places is often not used for three or four months. Why ruin a good thing if the skimmer is steadily transmitting account numbers and PINs? When credit card holders start reporting fraud, the common merchant on the victims’ accounts will be investigated and the device will be pulled. Has your card already been skimmed? Has mine?

Read our summary page of pickpockets, thieves, scammers, and skimmers.

credit card fraud identity theft Las Vegas skimmer

High-tech identity theft today

…¢ Identity theft is now the number one crime in the world.
…¢ Las Vegas is number one in the U.S. for ID theft; even though it’s estimated that only 20% of the crimes are reported.
…¢ The FBI estimates that seven out of every ten stolen dollars end up in Las Vegas. There’s more money in Vegas than most places. Hence Vegas’s place at the top of the ID theft heap.

These wispy facts were spit out by Las Vegas Metro Police Department Forgery Detail’s Detective Kim Thomas at the start of his recent identity theft presentation. Then he got to the scary stuff.

I recently wrote about “profiles,” the findable bits of personal information about an individual. A utility bill constitutes a profile, though not as good of one as a loan application. Envelopes, receipts, statements, are others.

Detective Thomas emphasized the importance of shredding all documents before discarding them. Then he pointed out how something as simple as a discarded box can trigger both a burglary and ID theft. He gave the example of a resident getting a new plasma tv. A trawling thief spots the box at the curb on trash day. He watches the house and notes when it’s unoccupied. Then he steals a truck, kicks in the front door (that’s how they break in nowadays, Det. Thomas explained; no finesse involved), grabs the tv—and the pile of bills in the kitchen at the same time. “Even a box has value to someone,” he said. “Cut it up.”

We can shred.

We can break down our discarded boxes, or take them to dumpsters.

We cannot control how businesses store and discard our data. (My own little example: I went to a health clinic where patients are given forms on clipboards to fill out and return to the desk. When I returned to the unattended desk with my completed forms, I stood staring at other patients’ medical histories and Social Security numbers on the clipboards they’d left on the desk as instructed.)

Credit card data skimmer: the size of a Bic lighter.

But here’s the big thing now: skimmers. Wait! You think you know, but I’m about to describe the very latest in skimmers; not the deck-of-cards-sized box in a waitress’s apron, not the big old multi-part plastic set-ups of yesterday stuck onto ATMs. If you’re not sure exactly what a skimmer is, read the three little paragraphs of my previous post. In the old days (not very long ago), waiters and store clerks were given skimmers to swipe credit cards through and they were paid for the data they collected. But a waiter might talk if caught. A store clerk will be watched if suspected, leading police to the skim-master. And how many cards can they skim in a day, anyway?

Old news: nowadays, skimmers are attached to the fronts of ATMs and gas pumps. Yeah, we know. But you probably don’t know how impressive the latest version is. It’s tiny: 3.5 inches long, by a half inch by a quarter inch. It’s almost impossible to detect. It contains batteries charged by an induction plate and stores data on a camera memory card. It attaches to a thin number pad overlay to capture PINs, and as a secondary method, also has a motion-activated video camera (jury-rigged from a high-end mobile phone) which is time-tagged to match up with the right credit card info. It has a bluetooth transmitter that allows remote, anonymous downloads, which means the skim-master doesn’t have to go near the scene of the crime, once the thing is installed.

About 40 of these tiny self-contained data-collectors have been recovered in Las Vegas in the past month. Probably more by now. Certainly more still out there, too.

Where do you get your gas?

Yes, they’re still stuck onto the fronts of ATMs. But they’re also put inside gas pumps. How do you open a gas pump? Use the same key that opens an RV storage locker, five bucks online. LVMPD found that one of these skimmers can be installed in eight minutes flat. Which, they figure, means the skim-master can probably do it in seven.

Edited 3/15/10 to add: Detective Kim Thomas explains how skimmers are hidden inside gas pumps in about 11 seconds. Yes, 11 seconds!

Yes, there’s more to tell.

credit card fraud identity theft Las Vegas skimmer

Skimmers for credit card fraud

A little background, as reference for my next post:

A skimmer is a battery-operated device smaller than a deck of cards with a slot for swiping credit cards. It reads and stores data embedded in the magnetic strip on the back of the card. Restaurant waiters are the typical recruit, given the contraption and requested to swipe each credit card as they take customers’ payments. At the end of the shift, the data collector shows up with a computer and downloads the skimmer’s memory, which might hold the information from a hundred or more cards.

This is effective data collection; and the waiters—for the data collector solicits many of them—may not even understand the purpose of the exercise for which they receive a nice little tax-free chunk of change. Restaurant and service station employees are reportedly earning over $100 for each credit card they skim.

Meanwhile, the customer has no way of knowing that his credit card has been skimmed. Some privacy advocates and security experts recommend that you never let your credit card out of your sight. I find this advice impractical to the point of impossible, but it’s a question of compromise: convenience in exchange for risk. Each of us must decide where to live along that scale. While I might hand my credit card over to a waiter for processing, you might decide to follow him to the charge machine and supervise the transaction.

Excerpt from Travel Advisory: How to Avoid Thefts, Cons, and Street Scams
Chapter Nine: You’ve Got a Criminal Clone

…¢ …¢Â …¢Â Yeah. That was then. Wait ’til you read about now!

credit card fraud identity theft Travel Advisory

ID theft buffet

A former mortgage broker put 40 boxes of customers’ personal information into a Las Vegas dumpster. It was December 2006, but we all knew enough about identity theft already to know better. The Fair and Accurate Credit Transactions Act of 2003, effective in 2005, requires the proper disposal of consumer report information and records, as does state law.

The boxes were found and put into safekeeping, probably before any documents were stolen from them. The Las Vegas Sun reported that the boxes contained “tax returns, mortgage applications, bank statements, photocopies of credit cards and drivers’ licenses, at least 230 consumer reports, and other documents containing sensitive consumer information.” Only now is the Federal Trade Commission charging former mortgage broker Gregory Navone with violating the Act.

Five gone-bust mortgage brokers dumped documents at around the same time—five that we know of. We can assume that many others dumped docs too, or deserted their premises complete with documents, which were left for the bad guys to find. No wonder Las Vegas is at the forefront of fraud and identity theft.

Bob and I recently spent many hours with a tweeker (meth-addict) during one of her clean and coherent spells. I’ll call her Kristin, because I can’t use her beautiful, real name. The time was just between her release from jail and her next bust. She had a job, her family had taken her back in and were supportive, and she was poring over a university catalog. She was full of hope and determination.

But the boyfriend…. Still in prison, a meth-cooker and ID thief, due out soon, demanding daily phone calls to keep his girl tied to the old life…

Right. He got out and Kristin disappeared. Back into the cycle of drugs and ID theft. We could have cried for her, this pretty 21-year-old. She was smart, but not strong enough to resist the lure of meth and easy money.

When she was high, she told us, she knew she’d never be caught; she was too clever. She knew she was going to get caught; she was always looking over her shoulder. Confident and paranoid.

In those hours we spent with Kristin, she told us how she used to “get profiles.” A profile is information about a person. It doesn’t have to be much because with a little goes a long way. With a little, you can find the rest.

Her favorite way to get profiles was out of dumpsters located behind businesses. She’d also get quick-credit apps from insiders in casino booths, who’d allow her to take a few off the top on the way to the shredder. Car registrations were good, too, easily found in glove compartments.

With the profiles, she created IDs. First simple ones, just good enough to allow her to purchase the special inks and papers needed to print government IDs. She had the precious printer, but supplies for it are regulated. For Kristin, easy to get around with a simple fake ID, a sweet smile.

With her newly minted IDs and profiles (for herself and her pals), Kristin and her team leased cars. Cadillac SUVs, to be specific, whatever they’re called. They always drove the latest models. They had an endless source of identities, cash, and credit.

They lived in motels, where they set up their mobile meth labs. Kristin, just the clean-up girl in the operation, got too close to the fumes once and got chemical burns on her face, neck, chest, hands, and arms. She was scabbed over for a year. She pointed out the scars, and the thick makeup she wore on her face to minimize them.

In a moment of desperation, Kristin once grabbed the profile of a wealthy family friend from her father’s home office. Tears trickled down her cheeks as she told us how she destroyed the man’s credit—and her father. Because he knew. She was ashamed of herself; mortified. Now she recognized that she was out of jail on an incredibly lucky break. She was going to study to become an architect. She was going to return to ballet.

Kristin’s back at it again, getting profiles, getting cash and credit on other people’s good histories, wreaking havoc. She and how many others?

Many people tell us they’re afraid to shop and bank online. But these activities are not a big factor in identity theft. The real threat is out of our hands. It’s how others keep our information. Big businesses with databases. Small businesses with manila folders. Mom & pops with a property to rent and an old box of rental apps (as I recently found in my garage—and shredded).

One man’s garbage is another’s fortune. Kristin and her friends are ready to exploit that old, forgotten information.

But there’s worse. Much worse. I’ll write about that soon.

identity theft Las Vegas