The Business Of Identity Theft

Q: I use PayPal to accept credit cards for my online collectibles business. I recently received an email that my PayPal account was going to expire in five days if I didn’t click on a link in the email and give them my PayPal account information. Being naturally paranoid I decided not to provide this info and I’m happy to say that my PayPal account did not expire. Was this a scam? — Brenda A.

A: Be thankful your paranoia kicked in, Brenda, because you’re about to fall prey to the scam of the week, that one aimed at the 35 million merchants and those who use http://Paypal.com as their online payment processor.

The email you received wasn’t from PayPal, but from an Internet bad guy behind a forged email address with the http://PayPal.com domainname. You need to understand that no reputable online company will ever ask you to supply your account information. Consider it. They already have this info. Why would they ask you to give it.

Since I use PayPal for several of my online ventures, I, too, received the email in question. The email first seeks to instill fear in you by saying that your PayPal account will be closed if you don’t offer personal details. You are then directed to open an attached executable file and enter your PayPal account information and other personal information that PayPal does not even require, including your social security number, checking account and savings account informationand driver’s licence number, and other personal information which may be employed to clean out your PayPal account and perhaps even steal your identity.

If you are not familiar with PayPal, it’s a hugely successful, online company (purchased by eBay in 2002) that many online retailers and eBay sellers use to accept electronic payments for everything from newsletter subscriptions to consulting services to just about every product for sale on eBay.

The allure of PayPal is that it doesn’t need the seller to have a bank merchant account through which to process credit cards. Anyone with a verifiable email address and bank account can use PayPal and the service can be implemented almost immediately after registering.

When someone places an order on a website that uses PayPal for online payments, that customer is directed to http://PayPal.com to finish the payment process using a credit card or electronic check. The merchant can transfer the money collected in his PayPal account to his checking account any time he likes. Since many larger merchants make this transfer just once a week or so, their PayPal accounts are ripe for the picking from those people who have the cunning and lack of ethics required to gain access.

The shear number of PayPal customers is one reason it is now a popular target of scam artists trying to steal personal information from individuals and businesses alike.

Identify theft is increasing. Thanks to the Internet stealing someone’s identity has never been easier. At any given time, you can find any number of Internet thieves using all manner of high tech wizardry to steal personal and business information from unsuspecting souls, and many times they could get access to the information simply by asking the person to provide it through fraudulent means.

The PayPal scam is just the newest in a long line of sophisticated attempts to steal personal information through online means, Amazon, eBay, Dell Computer, and many others are the brunt of many such scams in the past few decades.

Identity theft is what’s known as an understanding crime, which means that the offender does not need to break into your house to rob you blind. If you have a bank account and a social security number, you are prone to identity theft.

Although most individuals are familiar with identity theft, most business people never think of it happening to them, at least at an expert level. Think about this: if a criminal can learn your business checking account number or the number of your company credit card, they can steal far more from your business than if they had simply knocked down the door and carted off your desk.

The world wide web aside, most business and personal identity theft is still the result of stolen wallets and dumpster diving. You should guard your business records closely and be very careful what you throw away. Stop and consider for a moment what a criminal might find in the dumpster behind your office.

There’s a fantastic chance that dumpster has, at various times, contained scraps of paper with your social security numberand driver’s licence number, credit card number, old ATM cards, phone calling cards, and other pieces of vital business information like bank statements, invoices, and purchase requests. A dumpster-diving thief could literally rob your company blind in a matter of hours.

Listed below are a few ways to protect yourself from business and personal identity theft.

* Never give out your first name, last name, company name, email address, account passwords, credit card numbers, bank account information, PIN number, social security number, or driver’s license number.

* Change your online account passwords every 30 days. Believe it or not, a hacker who steals your personal information can guess your online account passwords in about two or three minutes. If your Charles Schwab online account password is your birthday or the name of the first born or family pet, count on a hacker cracking that code faster than you can say’Bill Gates.’

* Never give personal information in response to an email or phone call. Just because somebody calls and says that they are from Dunn & Bradstreet and need to confirm your business information doesn’t mean they are from Dunn & Bradstreet.

* Never give your business credit card number over the telephone to place an order with somebody who has called you unsolicited. If you are thinking about what they are selling get their number, check out their company, then call them back to place the order.

If you think you have come to be the victim of identity theft or think someone is attempting to steal your identity or personal information you should report them immediately to the Federal Trade Commission. You may find more information on their site in http://www.consumer.gov/idtheft/. To learn more about what to do if identity theft happens to you personally visit http://www.privacyrights.org/fs/fs17a.htm.

Thus, in the event you ever get an email from PayPal, Amazon, eBay, or any other ecommerce website asking you to upgrade your account information by email you can pretty much bet the farm it is a scam.

In business, as in life, a little paranoia is a fantastic thing.