Officials get look into world of ID theft.

Byline: Bill Bishop The Register-Guard

With the calm of a businessman discussing his sales operation, an Oregon State Prison inmate disclosed how he recruited and befriended drug addicts, exploited businesses with lax security and operated an identity theft ring that stole more than $1 million in a two-year period in Oregon and Washington.

The inmate, now serving a six-year sentence, experienced a religious conversion in prison and agreed to a videotaped interview that was shown Friday at the sixth annual Financial Crimes Conference in Eugene.

The three-day conference, sponsored by state and federal law enforcement agencies, is like a graduate-level course in crime fighting for hundreds of fraud investigators, prosecutors and security officers for financial institutions and public agencies from around the state.

"Identity theft rings are ... like a family corporation. It's professional, yet family. It's methodical and meticulous," said the inmate, whose identity was concealed to prevent possible retaliation against him in prison. Drugs and theft are "husband and wife," he said.

"Most people involved in drugs are cut off from their family. You make them feel welcome and a part of the organization," the inmate said. "I was there to give them a hug. You have to truly befriend them. That brings loyalty."

Increasingly, theft rings are being run by similarly skilled organizers who avoid capture by paying a percentage of the theft to an assembly of loyal employees, Salem police Detective Paul Henninger said.

While small identity theft rings work in cities around the country, much larger rings with international membership work globally on scales that were unimaginable a decade ago, said Scott Lupfer, principal security architect for Internet Security Systems, a company that provides Internet security products to global enterprises and governments.

For example, investigators tracked an operation they called "Shadowcrew" that had 4,000 members in several countries, all operating together but anonymously through the Internet.

The ring exploited flaws in software programs to harvest all kinds of information that it auctioned on a Web site and used in other ways.

In just one transaction, the ring sold 115,695 stolen credit card numbers that resulted in $4.3 million in fraudulent charges, Lupfer said.

Given the increasing use of wireless devices, Lupfer said criminals are bound to think up ways to tap into mobile devices to steal data, both personal and business-related. Hackers have already entered business computer databases and locked companies out of their own computer systems until a ransom is paid, he said.

"If people build it, people can exploit it," he said.

The technology tug-of-war will rage forever behind the scenes, with software companies developing intrusion prevention systems and criminals trying to break in through the weakest link, Lupfer said.

Consumers and businesses are vulnerable to the extent they use the Internet without taking precautions, he said, adding, "The biggest issue is education."

IDENTITY THEFT

With identity theft expected to grow in coming years, potential victims need to be ready to respond quickly if they are targeted by thieves. If you become a victim, here's what you should do:

Place a fraud alert on your credit reports and review your reports. Contact the three reporting agencies: Equifax: [phone], www.equifax.com; Experian, [phone], www.experian.com; TransUnion, [phone], www.transunion.com.

Contact agencies that issued your identity cards, such as your driver's license. Get a replacement and flag your file so no one else can get a duplicate.

Close accounts that may have been tampered with or opened fraudulently.

File a report with local police.

File a complaint with the Federal Trade Commission online at www.consumer.gov/idtheft or phone [phone].

Prevention is best. Never store personal information, checkbooks, credit cards, passwords and account numbers in cars or in text files on portable electronic devices that can be lost or stolen.

For more information, visit ftc.gov or phone [phone].

- Federal Trade Commission