"None of these companies really have any way of verifying you are who you are."

When her sister became incapacitated by a serious medical emergency, this 45-year-old senior executive was shocked by how easily she was able to assume her identity and take over her financial accounts.

GlobalPOV: How did you get access to your sister's information?
Victim: It was surprisingly easy in most cases. I thought it was going to be a lot harder. First off, there were some accounts, like email - where I logged on the Web browser and guessed at her password. Some of it I was able to guess because I'm her sister. I used things like pet's names and old addresses and house numbers, town names, zip codes, etc.

In other cases, I did the "I forgot my password" thing. You'd be surprised at how many things where first you have to give your mother's maiden name - and that's really easy. Sometimes you'll get a question - like a pet's name. So you get some sort of identifying information, and then you get the question. In any event, the fact that I was I her sister, I knew a little bit about her and could guess almost all of those.

GlobalPOV: What was the nature of the information you were looking for online?
Victim: Really what I was looking for was control of her bank accounts - I needed to pay her bills. And I wanted to get at her email to make sure there were no crisises in her inbox. She had two bank accounts, and the majority of the money I needed was in her savings account, whereas I could just forge checks from the checking account.

GlobalPOV: Did you process some sort of transfer?
Victim: Yes. What I did was I registered her for online banking --- she wasn't registered before. All I needed was her ss#, date of birth, address and telephone number, and bank account number. One of her other accounts, I did the "I forgot my password" function, and they asked me about the last five transactions. But that was very easy to do because I had her bank statement. If I were to break into someone's house, I would steal their last bank statement, because that provides you with just about all the general identifying information you need.

GlobalPOV: Were you disturbed by how easy it was to assume her identity and go about this process?
Victim: Very much so. The thing that amazed me was how - with a little bit of thought - each thing I had to crack into only took required about an hour to think through and crack in either over the telephone or over the web. And it hit me how incredibly vulnerable this information is - because none of these companies have any way of verifying that you really are who you are, except by these little bits of information. And most of this stuff you can easily find out.

It also struck me on some of the online access how much she used the same password over and over again. So all I had to do was find one guy to email me my password, and I was set. I broke into her email by guessing. Then, once that happened, I could get another guy to email me my password.

GlobalPOV: What type of institution provided you with her password?
Victim: It was something innocuous that didn't have any online payments. It was something that didn't have any financial information online, but guess what…she used the same password for the financial stuff.

GlobalPOV: Let's say your sister was in fine health, would any red flags have shown up for her?
Victim: I've thought about this. Yeah, there would be red flags. You'd be getting statements back to you. And in some cases, if you weren't able to get into the person's email, you might see password resets coming back. If I were going to do this right and steal someone's money, the first thing I would do is get online access and change the people's mailing address, so they wouldn't see a statement for several months. You could run their credit cards up like crazy, and they wouldn't see it. What would be really bad is a husband and wife splitting up where they wanted to do something nasty to each other. If you really did know the person, there's nothing stopping you. If you can get into their house and get copies of a couple statements you can clean them right out.

GlobalPOV: Did it feel kind of creepy to be doing this?
Victim: Definitely...it felt like I was sneaking around.

Years ago, you lived in small towns, the people knew you and you showed up in person. That doesn't happen anymore - even in the small towns. So you need some way to verify that the person is who they say they are, and it's impossible to do. The only mechanism they have is to ask obscure bits of information, and if you figure those out, you're home free.

• Respond on the Message Board
• Back to Previous Page