Junkyard Identity Theft: How easy is it to hack your account?

Junkyard Identity Theft: How easy is it to hack your account?

In two Michiana salvage yards, NewsCenter 16 found paystubs, credit cards, insurance policies, old vehicle registrations and bills.

To find out just how much or how little information an identity theft needs to compromise your financial information, we checked with a cybercrimes investigator with the St. Joseph County Prosecutor’s Office, Mitch Kajzer.

“It’s very easy for someone’s identity to be stolen,” said Kajzer.

With more and more people using the internet to share life moments on social media, experts are finding online users are over-sharing key data points to their online financial information as well.

“Through a very little bit of information, people, through online searches and through social engineering, can find out other bits of information and keep building,” Kajzer explained it only takes one seemingly small piece of personal info to leave a person vulnerable.

Even information like name and address.

“Just those two pieces of information you can build on that,” Kajzer explains that access to public records has made ‘social engineering’ identity information easier when used in conjunction with social media searches

Banks and other businesses holding a person’s credit information use data points to verify identities online: things like birthdays, family names, even someone’s favorite color, are formatted as security questions.

“There is no such thing as a good security question,” said Kajzer, “because all of them can be solved through social engineering.

Take the popular security question protecting many sensitive online accounts: “What’s your mother’s maiden name?”

A quick check of Facebook, that information can be found in a tagged family photo or a comment shared on someone’s wall.

The best and safest bet is to make your own security question if possible, or write an answer that makes no sense.

“Such as ‘what’s your favorite color?’ The answer? ‘Kalamazoo, Michigan.’ Something that you know the answer to but anyone trying to socially engineer it would never think of it” Kajzer explained.

Back to the salvage yard where NewsCenter 16 found debit cards, vehicle registrations, old bills, paystubs and even a W-4 form completed with social security information, experts say those forgotten items are the building blocks to stolen identities.

So NewsCenter 16 put it to the test.

In a wrecked car someone left behind a complete auto insurance policy which included the drivers name, address, policy number and much more. All that was left to access her account without the password was her date of birth.

But there’s a much easier way junkyard thieves could gain access to sensitive financial information. Instead of google searching and scanning social media to find the answers to a person’s security questions, Kajzer said it’s much simpler to scam the information out of a person through phishing emails.

Cybercrimes investigators have seen a rise in “phishing” emails, notes from seemingly legitimate companies like PayPal who push the recipient to “act fast” and send them financial information in return. But the emails aren’t actually from PayPal.

In the case of the insurance policy, Kajzer said it would be far easier to convince the policy holder to send an updated payment method in an email by feeding back their name, account number and information about a recent crash.

“Most people, she’s going to say well it looks like Gieco’s Facebook, it’s got my correct name, husband’s name, policy number, she knows the bank account and the payment that we made,” Kajzer warned against the phishing threats and any messages which request sensitive account data to be sent over an email or a Facebook message.

It should be noted, many banks used multiple layers beyond just email and security questions to gain access if someone doesn’t know the password. However, if the identity thief has your social security number and basic account info because it was left behind in a car or thrown out in the trash, your financial account is even more vulnerable.

The best way to safeguard personal information is to put a lock on online accounts, and if you are in an accident, make sure your car is cleared out of all bills, registrations, anything with your name and address.

Legal Shred