Carnival of Cybercrimes - Taking off the Mask of Synthetic Identity Theft
Downloads
This article portrays a comparative and doctrinal analysis that aims to combine theoretical and applicable knowledge over a deeply rooted, yet still unfamiliar cybercrime: synthetic identity theft. The jurisdictional dimensions explore the European Union (EU), United Kingdom (UK) and United States (US) in terms of expertise, legal initiatives, regulations and practical cases. As a prerequisite, the study has addressed the connection with identity theft and identity fraud as the Criminal Law “labels” it generally belongs to. Moreover, the most thought-provoking part represents analysing the nexus between synthetic identity theft and personal data protection, focused on security incidents. On this latter point, personal data breaches are proven as frequently being both a cause and an effect for synthetic identity theft. Subsequently, this turns out to have significant impact on individuals and organisations alike, predominantly in the financial sector, although harm may take several shapes.
Downloads
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1.
Retained Regulation (EU) 2016/679 of the European Parliament and of the Council (UK GDPR).
Police Executive Research Forum, “New National Commitment required: The Changing Nature of Crime and Criminal Investigations,” Washington, D.C., USA, Jan. 2018. Accessed: Mar. 15, 2023. [Online]. Available: https://centerforimprovinginvestigations.org/wp-content/uploads/2018/04/20180000-The-Changing-Nature-of-Crime-and-Criminal-Investigations-Police-Executive-Research-Forum.pdf.
ENISA, “The year in review: ENISA Threat Landscape,” Greece, Nov. 2022. Accessed: Mar. 6, 2023. [Online]. Available: https://www.enisa.europa.eu/publications/enisa-threat-landscape-2022.
W. Bracker, S. Goeringer and S. Krauss, “Fraud Prevention and Privacy Law: Emerging Conflicts Between Privacy Law and Fraud Prevention,” presented at the SCTE ISBE Cable-Tec Expo, Denver, CO, USA, Oct. 13-16, 2020.
ENISA, “Identity theft: ENISA Threat Landscape,” Greece, Oct. 2020. Accessed: Mar. 3, 2023. [Online]. Available: https://www.enisa.europa.eu/publications/enisa-threat-landscape-2020-identity-theft.
J. Bandler and A. Merzon, Cybercrime investigations: A comprehensive resource for everyone. Boca Raton, FL, USA: CRC Press, 2020.
AuthenticID, “2023 State of Identity Fraud,” 2023. Accessed: Mar. 20, 2023. [Online]. Available: https://www.authenticid.com/2023-state-of-identity-fraud-report/.
S. Marchetti, “Rolling in the deep(fakes),” Bank of Italy Occasional Paper, no. 668, Feb. 2022. Accessed: Mar. 3, 2023. [Online]. Available: doi:10.2139/ssrn.4032831.
J. Davis, “The real victim in health data breaches? Patients' medical identities,” HealthcareITNews, Oct. 29, 2018. Accessed: Mar. 28, 2023. [Online]. Available: https://www.healthcareitnews.com/news/real-victim-health-data-breaches-patients-medical-identities.
Federal Reserve Banks, “Defining Synthetic Identity Fraud,” 2021. Accessed: Mar. 29, 2023. [Online]. Available: https://fedpaymentsimprovement.org/wp-content/uploads/synthetic-identity-fraud-definition-overview.pdf.
B. Richardson and D. Waldron, “Fighting back against synthetic identity fraud,” McKinsey on Risk, no. 7, Jan. 2019. Accessed: Mar. 13, 2023. [Online]. Available: https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/fighting-back-against-synthetic-identity-fraud.
C.J. Hoofnagle, “Identity Theft: Making the Known Unknowns Known,” Harvard Journal of Law & Technology, vol. 21, no. 1, pp. 97-122, Fall 2007. Accessed: Mar. 13, 2023. [Online]. Available: https://ssrn.com/abstract=969441.
D. Rebovich and J.M. Byrne, Eds., The New Technology of Financial Crime: New Crime Commission Technology, New Victims, New Offenders, and New Strategies for Prevention and Control. Routledge. 2023.
Federal Reserve, “Mitigating Synthetic Identity Fraud in the U.S. Payment System,” 2020. Accessed: Mar. 9, 2023. [Online]. Available: https://fedpaymentsimprovement.org/wp-content/uploads/frs-synthetic-identity-payments-fraud-white-paper-july-2020.pdf.
D.W. Opderbeck, “Cybersecurity and Data Breach Harms: Theory and Reality” in Seton Hall University School of Law Legal Studies Research Paper Series, Aug. 2022, p. 54. Accessed: Mar. 29, 2023. [Online]. Available: doi.org/10.2139/ssrn.4187263.
United Nations Office on Drugs and Crime, Handbook on Identity-related Crime, 2011. Accessed: Apr. 9, 2023. [Online]. Available: https://www.unodc.org/documents/congress/background-information/Corruption/Handbook_on_Identity-related_Crime_ENG.pdf.
Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Pub. L. No. 116-136, H.R.748. 2020 [Online]. Available: https://www.congress.gov/bill/116th-congress/house-bill/748/text.
Two Men Who Allegedly Used Synthetic Identities, Existing Shell Companies, and Prior Fraud Experience to Exploit Covid-19 Relief Programs Charged in Miami Federal Court, United States Attorney’s Office – Southern District of Florida, Aug. 28, 2020. Accessed: Apr. 9, 2023. [Online]. Available: https://www.justice.gov/usao-sdfl/pr/two-men-who-allegedly-used-synthetic-identities-existing-shell-companies-and-prior-0.
Pandemic Response Accountability Committee, “Key Insights: Identity Fraud Reduction and Redress in Pandemic Response Programs,” Jun. 2022. https://www.pandemicoversight.gov/media/file/identity-fraud-capping-report.
United States v Rose, D Ariz, Aug. 22, 2006, CR06-0787PHX.
Federal Reserve, “Synthetic Identity Fraud Mitigation Toolkit,” 2022. Accessed: Apr. 2, 2023. [Online]. Available: https://fedpaymentsimprovement.org/synthetic-identity-fraud-mitigation-toolkit/.
Federal Reserve, “Protecting Your Kids from Synthetic Identity Fraud”, 2022. Accessed: Apr. 2, 2023. [Online]. Available: https://fedpaymentsimprovement.org/wp-content/uploads/protect-kids-from-synthetic-identity-fraud.pdf.
Convention on Cybercrime, opened for signature 23 November 2001, ETS No 185 (entered into force 1 July 2004).
F. D. Ciccio, “Comparison of Identity Theft in Different Countries,” 2014. [Online]. Available: https://courses.cs.ut.ee/MTAT.07.022/2014_fall/uploads/Main/francesco-report-f14.pdf.
Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement [2019] OJ L 188/67.
UK House of Lords, “Fighting Fraud: Breaking the Chain,” Fraud Act 2006 and Digital Fraud Committee Report of Session 2022-23, HL Paper 87, 2022. Accessed: Mar. 27, 2023. [Online]. Available: https://publications.parliament.uk/pa/ld5803/ldselect/.
UK Fraud Act 2006 (2006, Nov. 8). Accessed: Apr. 10, 2023. [Online]. Available: https://www.legislation.gov.uk/ukpga/2006/35/contents.
UK Computer Misuse Act 1990 (1990, Jun. 29). Accessed: Apr. 10, 2023. [Online]. Available: https://www.legislation.gov.uk/ukpga/1990/18/contents.
UK Identity Documents Act 2010 (2010, Dec. 21). Accessed: Apr. 10, 2023. [Online]. Available: https://www.legislation.gov.uk/ukpga/2010/40.
S.R. Ahmed, “Identity Crime Legislation in the United States, Canada, Australia and the United Kingdom,” in Preventing Identity Crime: Identity Theft and Identity Fraud, Brill|Nijhoff, 2020, ch. 6, pp. 252-542. https://doi.org/10.1163/9789004395978_007.
UK Cabinet Office and Government Digital Service, “Guide: How to prove and verify someone’s identity,” Jan. 9, 2023. Accessed: Apr. 10, 2023. [Online]. Available: https://www.gov.uk/government/publications/identity-proofing-and-verification-of-an-individual/how-to-prove-and-verify-someones-identity.
U.S. Code, Title 18, pt. I, ch. 47, section 1028.
Paul Newmann, “Identity Theft: A Growing Problem,” The Bill Blackwood Law Enforcement Management Institute of Texas, Denison, TX, USA, 2018. Accessed: Apr. 3, 2023. [Online]. Available: https://shsu-ir.tdl.org/bitstream/handle/20.500.11875/2452/1767.pdf?sequence=1&isAllowed=y.
Congressional Research Service, “Accomplices, Aiding and Abetting, and the Like: An Overview of 18 U.S.C. § 2,” R43769, 2020. Accessed: Apr. 3, 2023. [Online]. Available: https://sgp.fas.org/crs/misc/R43769.pdf.
U.S. Code, Title 18, pt. I, ch. 47, section 1030.
U.S. Government Accountability Office, “Identity Theft Services: Services Offer Some Benefits but Are Limited in Preventing Fraud,” GAO-17-254, Mar. 2017. Accessed: Apr. 3, 2023. [Online]. Available: https://apps.dtic.mil/sti/pdfs/AD1031224.pdf.
U.S. Gramm-Leach-Bliley Act (GLBA) of 1999. 15 U.S.C, § 6801-6809, § 6821-6827.
U.S. Fair Credit Reporting Act (FCRA) of 1970. 15 U.S.C, § 1681-1681x.
U.S. Credit Repair Organizations Act (CRA) of 1996.15 U.S.C. § 1679-1679j.
U.S. Federal Trade Commission Act (FTC Act) of 1914. 15 U.S.C. § 41-58, as amended.
U.S. Consumer Financial Protection Act of 2010. 12 U.S.C. § 5301-5641.
IBM, “Synthetic identity fraud: Can I borrow your SSN?: Who else might be using your Social Security number and why?,” Armonk, NY, USA, Mar. 2015. Accessed: Apr. 9, 2023. [Online]. Available: http://www.turnkeyrisk.com/images/whitepapers/Can-I-borrow-your-SSN.pdf.
F. Bisogni and H. Asghari, “More Than a Suspect: An Investigation into the Connection Between Data Breaches, Identity Theft, and Data Breach Notification Laws,” Journal of Information Policy, vol. 10, pp. 45-82, May 2020. Accessed: Apr. 9, 2023. [Online]. Available: doi:10.5325/jinfopoli.10.2020.0045.
Guidelines 9/2022 on personal data breach notification under GDPR, Version 2.0, Adopted 28 March 2023. Accessed: Mar. 13, 2023. [Online]. Available: https://edpb. europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf.
N. L. Piquero, A. R. Piquero, S. Gies, B. Green, A. Bobnis and E. Velasquez, “Preventing Identity Theft: Perspectives on Technological Solutions from Industry Insiders”, Victims & Offenders, vol. 16, no. 3, pp. 444-463, 2021. Accessed: Apr. 8, 2023. [Online]. Available: doi:10.1080/15564886.2020.1826023.
European Commission, “Trends in electronic identification: An overview: Value Proposition of eIDAS eID,” COM/DIGIT.D3/2017/01-035, 2018. Accessed: Apr. 18, 2023. [Online]. Available: https://ec.europa.eu/cefdigital/wiki/download/attachments/78549570/Trends%20report%20on%20electronic%20identification_for%20publication_v.1.1.pdf?version=1&modificationDate=1551198712785&api=v2.
dataTENET, Response to the public consultation “Guidelines 01/2021 on Examples regarding Data Breach Notification Adopted on January 14, 2021, Version 1.0”, Mar. 1, 2021. Accessed: Apr. 18, 2023. [Online]. Available: https://edpb.europa.eu/sites/default/files/public_consultation_replies/mail_edpb_02_03_response_to_the_public_consultation_guidelines_012021_.pdf.
