Web Security, Privacy & Commerce, 2nd Edition

Identity Theft

In 1991, a car salesman from Orlando, Florida named Steven Shaw obtained the credit report for a journalist in Washington named, coincidently enough, Stephen Shaw. For Steven Shaw, getting Stephen Shaw’s credit report was easier than you might think: for years, the consumer reporting firm Equifax had aggressively marketed its credit reporting service to car dealers. The service lets salespeople weed out the Sunday window-shoppers from the serious prospects by asking for a customer’s name and then surreptitiously disappearing into the back room and running a quick credit check. In all likelihood, the Shaw in Florida had simply gone fishing for someone with a similar-sounding name and a good credit history.

Once Steven Shaw in Florida had Stephen Shaw’s Social Security number and credit report, he had everything he needed to steal the journalist’s identity. Besides stating that Stephen Shaw had excellent credit, the report listed his current and previous addresses, his mother’s maiden name, and the account numbers of all of his major credit cards. Jackpot!

“He used my information to open 35 accounts and racked up $100,000 worth of charges,” says Stephen Shaw. “He tagged me for everything under the sun—car loans, personal loans, bank accounts, stereos, furniture, appliances, clothes, airline tickets.”

Because all the accounts were opened using Stephen Shaw’s name and Social Security number, all of the businesses held the Washington-based Stephen Shaw liable for the money ...