Information Security Tips from Westfield Insurance

Protect Your Customers' Social Security Numbers

This article was originally published in the Oct/Nov 2006 edition of The Agent Newsline, a publication of Westfield Insurance.

We all know about the rising threat of identity theft, and hear how it can affect a person's life. Along with businesses, legislatures around the country are also under a lot of pressure to do something about identity theft. Here are some tips to help you keep your customers' Social Security Numbers (SSNs) and your agency safe. It's not just a good practice - in almost all states, it's the law.

• If you don't absolutely need the SSN, don't ask for it. Take the field off forms unless it is absolutely necessary.
• If you only need the SSN once, use and destroy. Don't record a copy or make a note "just in case." If you must ask for the SSN, protect it carefully:
  • Watch records that get posted on a web site. Be cautious of spreadsheets with SSNs, which can get found via a search engine. Keep documents with SSNs in secured folders.
  • For log-ons to web sites, don't use the SSN unless the web site also requires a password or PIN for access.
  • Several states explicitly ban the selling, renting, trading, etc. of any list containing the consumer's SSN, so don't give out a consumer's SSN to anyone.
  • Only print or show the last four characters from the SSN.
  • SSNs may not be printed on any ID card required for the individual to receive products or services. That means that SSNs generally may not be printed on the proof-of-insurance card. This includes embedding the SSN using a barcode, smart chip or magnetic strip.
  • Unless the message is encrypted, don't request or send SSNs via e-mail.
• When sending mail, do not print the SSN on anything mailed to the individual unless required by law. The news tends to highlight the technology-based hacks and compromises but research continues to show that most identity theft is committed based on paper records and the largest single source of stolen SSNs is still physical mail theft. (The second source is trash.)
  • If you do send a document with a SSN in the mail, be sure the SSN is not visible through the envelope. Also watch postcards, top-sealed mailers with open sides or envelope window openings.
  • The "required by law" exception applies primarily to certain HR records like your W-2. There may be a few state laws requiring us to send SSNs by mail either to a state agency or to the individual but as a general rule, avoid putting any document with the consumer's SSN in the mail unless it is strictly required.
• Destroy everything when it is no longer necessary. As soon as that retention period runs out and the record is no longer necessary, make sure that it is properly destroyed.
  • Paper documents should generally be destroyed by shredding. While the FACTA Disposal regulation allows other means of destroying paper documents, shredding is almost always the most reliable and cost-effective way.
  • Make sure that all electronic media (hard-drives, floppy-disks, thumb-drives, CD-ROMs) get sent back to your IT department for wipe. Make sure that the data has been irrecoverably destroyed first before donating or throwing away.

Email can come back to haunt you

Halloween is a time for scary stories – tales of vampires and ghouls rising from the dead to terrify innocents – a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

The problem is that we have a bad habit of treating email as a very casual form of communication. We think of it as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the recipient understands the context and correctly interprets our tone. When third parties read your message, however, they assume that you spent as much time crafting and wordsmithing your message as you would have in the days of typewritten memoranda. They may or may not understand (or care about) the context of the message and they will interpret the tone according to their own preconceptions.

Legally, email is a type of formal business communication. The contents of the message are not protected. You have no right of privacy in your email, either sent or received. Any email can be subpoenaed and forced into the public record. Or it could be saved, forwarded or posted to the internet by one of the recipients. When you write your emails, you must assume that it will be read by an unknown and unforeseen audience. Assume that anything you write will come out at the worst possible time and in the worst possible light.

Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow's newspaper. Remember, email can come back to haunt you.

Trends in Phishing

A survey by First Data Corp. in 2005 found 43% of US adults had received at least one fraudulent email, in most cases purporting to be a financial institution. Of those, about 1 in 20 – or 4.5 million people – provided the requested information and about half of those ended up being victims of theft or identity fraud. According to antiphishing.org, 89.3% of all phishing attacks target financial institutions.

Those are some large numbers but I have to admit that my first reaction was to ask "who are those lucky 57% who have not yet received a phishing email?" Many of them simply do not have email. For the remainder, unfortunately the question answers itself. They are the people who have not yet received their first phish.

Phishing emails attempt to trick the reader into believing that the message is from a trusted source and following their "convenient" link to a fraudulent site which looks and feels just like the official site but which is designed to steal the user's private information. Even though this doesn't fool most consumers, phishers rely on "spam economics" – they can make money even if only a fraction of a percent of their scams succeed.

Phishers are beginning to add to their tactics. Many are providing a fraudulent telephone number in the email rather than just a fraudulent hyperlink. The criminal then sets up his/her own IVR system to steal your information when you call in. Others are making increased use of trojan horses – programs which are covertly installed onto your computer and which either log all your keystrokes or install a backdoor through with the criminal can take control of your computer.

Never trust anything sent in an unsolicited email. Never directly answer any request for your private information. If you think the request might be legitimate, type the company's address into your web-browser yourself. If this is a real request, expect it to be prominently displayed on your account page on the company's real website. If you are going to call them by phone, get the phone number off of your last paper statement. Never trust the "convenient" number on the email. Finally, remember that no reputable financial institution will ever ask for your personal information via email.

Incidentally, in 2005 the Federal Trade Commission estimated that 9.93 million persons were affected by identity theft, causing a loss to financial institutions of $46.9 billion. Combining that with the statistics above, phishing accounts for only about one quarter of all identity theft cases. This is consistent with other studies which show that most ID theft is based on paper documents. We should still be vigilant against these kinds of scam messages but we should be even more vigilant about making sure that our paper waste is properly destroyed.

iPods shipped carrying a computer virus

Apple recently announced that some of the iPod digital music players shipped over the last month carried a computer virus. This virus could be passed back to the user's computer and attack the Windows operating system. Most anti-virus programs would have identified and removed the virus as soon as the iPod was plugged in as long as the anti-virus definitions were up-to-date. Other manufacturers have had similar problems.

• Always keep your anti-virus program up-to-date and active.
• Don't connect your personal iPod to your work computer.

Read this msnbc.com story for more on Apple and this article if you have a Zen Neeon MP3 player.

Overpayment scams

More and more people are turning to eBay and other online sales channels to get rid of old furniture or toys that the children have outgrown. Even though you may have to deal with shipping, it can be a lot more convenient than holding a yard sale in the rain. And it can reach many more people, increasing the chance that you'll get the best price for your stuff.

If you do sell anything online, beware of overly generous offers. A particularly common scam is for the buyer to send a check for several thousand dollars more than the asking price and then ask the victim to send back for the difference. The scammer will make up a plausible reason for the overpayment. It could be "a clerical error" or "a way around the local taxes". Very often, these offers come from overseas – places which do have different and sometimes confusing tax laws. Sometimes, it's "an agency fee that you must remit to the agent", but the "agent" is a confederate to the scam. Some of these scams look very credible.

Regardless of the alleged reason, the thief will take your "refund" and run, knowing that it can take weeks before his/her original counterfeit check is discovered. When your bank finally does get the counterfeit back, they will deduct the full amount of the bounced check back from your account, leaving you without your stuff, owing bounced-check fees and the cost of the wire transfer and with a loss for the "refunded" amount.

Overpayment scams have been around for years but used to be almost exclusively based on foreign banks. Many of these scams are now based on counterfeits of checks from US banks or even on counterfeit postal money orders.

To recognize the scam, watch out if the buyer is sends you more than your asking price. Return the check and have the buyer send a new check for the correct amount. And don't be shy about holding the delivery until the check clears. If someone offers more than you asked for, be suspicious.

Read more at FTC.gov.

Multi-Factor Authentication - defined

Authentication means knowing who is on the other end of the line. Authentication is essential before you share any non-public information with the other person whether you are sharing it by phone, email, instant messaging or in person. Authentication is based on one of three "factors":

• Something you are – recognizing your face, voice, fingerprint, signature, etc.
• Something you have – a car key, a digital certificate on your computer, an ID card or security token
• Something you know – a password, the last four of your SSN, mother's maiden name, etc.

Multi-Factor Authentication means checking against two or more of those types of authentications. For example, the HELP Desk might check caller ID to see if you are calling from your own phone (something you have) and still ask for your employee ID number (something you know). A debit card is another form of two-factor authentication. You need both the physical card and the four digit PIN to get cash out of the ATM. Authentication methods that use more than one factor are more difficult to compromise than single-factor methods.

In the weaker sense, multi-factor authentication is sometimes interpreted as asking for two things you know – a password and a PIN. This is better protection than just asking for a single password but considerably weaker than proper multi-factor authentication. If a hacker knows enough to compromise your password, they are also likely to be able to compromise your PIN. Still, internet sites which require both a password and PIN have added "friction" to the process. They force the hacker to do more work and make it more likely that the hacker will go somewhere else instead.

Banking Authentication Scam

Banks and other financial institutions have until 1 January to implement multi-factor authentication to confirm the identities of their customers when accessing internet-based services. That means that banks can no longer rely on a single PIN or password to give you access to your account. They must use some other method in addition to the PIN or password.

Some banks have recently implemented the new procedures. Others are in the midst of changing their procedures. In the meantime, a large number of scams are attempting to exploit these changes in authentication procedures. They are trying to take advantage of the natural confusion of users during the transition.

Banking regulators are warning the public to be alert for scams attempting to exploit the change in authentication procedures. One popular scam describes the federal requirement for the new procedures and then asks the reader to re-register his/her online banking accounts.

• You should never respond to any email that is requesting information that your bank already has in its possession.
• Never click on the "convenient" link provided in the email. Too often, it takes you to an imposter site run by the scammer. Type the bank's URL into your web browser yourself.
• Keep your online password secure – even your banker should not know your password!

As the deadline approaches, you should receive communications directly from your bank with details of any new procedures. When in doubt, play it safe and contact your financial institution.