Tools and Techniques

  • Increase FontDecrease Font
  • Download, Save and Print this Section
  • Assemble Toolkit
  • Print Text-Only Page
  • Bookmark
  • View Sitemap

Tools

In identity crime, it is rare that the perpetrator is caught on his/her first offense and is highly likely that the crime the victim is reporting is not an isolated incident. It may also be helpful to remember that the victim often knows the perpetrator and/or has provided him/her with the information in the first place, believing it was to be used for a legitimate purpose.

According to an FTC survey from 2006, in 16% of all cases, the victim personally knew the person who had misused their personal information. Of those who could personally identify the perpetrator, 6% said a family member or relative had misused their personal information; 8% named a friend, neighbor, or in-home employee; and 2% said the thief was a co-worker.18

The first step will be identifying the perpetrator. To aid in identification, study the crime and determine the two weak points for an identity crime - the contact point, or means by which the perpetrator contacted the victim, and the drop point, or physical location where an item, record, card or merchandise was sent. For example, if the victim information was used at a bank Web site to open a credit card account, the bank site will record the IP address of the computer used to open the account, and will have a verified e-mail to send account information. A search warrant for records can help reveal the suspect’s Internet service provider and physical location of access.

If the account was opened over the phone, most bank sites will record the ANI or caller ID number of the call made to open the account. The telephone number provides a basic place to start the investigation.

Drop points can be shipping addresses for merchandise, mailing addresses for statements, stores where the cards were or are being used, or ATMs where money is withdrawn. The drop point helps to identify the physical location of the thief and can provide valuable working points for search warrants. Don’t forget to check these locations for video of the transactions or for the records of delivery.

In addition, it is important that in any investigation all of the computer forensic evidence is gathered and analyzed. The hard drive of a computer (and other digital media) offer important evidence that can be quite fragile. It is helpful to reach out to specialists to help with the seizure and analysis of such evidence. Contact the National White Collar Crime Center for help online http://www.nw3c.org or by calling (804) 273-6932.

Many of the investigative techniques useful in other criminal investigations can serve to gather evidence in identity crimes as well. Important information can be found in:

  • Suspect’s trash
  • Suspect’s residence or automobile
  • Suspect’s computer, cellular phone, PDA or other wireless device
  • If you are able to get IP addresses linked to the application for fraudulent new accounts, it may be possible to get a court order for the subscriber information from the financial institution.

Investigators should not overlook using officers from other agencies as a resource when they hit a roadblock in an investigation. Each identity crime case has different nuances, and working collaboratively can leverage the collective wisdom, skills and experiences of many of your colleagues in neighboring agencies.

Sometimes identity crimes are deceptively low-tech. Consider the suspect who writes down a credit card number and name, then uses the phone book to get a matching address, then uses that information to buy things over the telephone.

Investigators may also want to pay special attention to mapping the small crimes in a jurisdiction. Using a pin map, it may be possible to see patterns in where credit information is routinely swiped, stolen and used. Postal inspectors can be brought in to help as well.

Other agencies can help to gather information leading to the suspect:

National Crime Information Center (NCIC)

Has the suspect been arrested using the victim’s identity? Has he/she been arrested for any other identity crimes? A check of NCIC, a computerized index of criminal justice data such as criminal record history, fugitives, stolen properties, missing persons, etc., may provide useful information. It is available to federal, state, and local law enforcement and other criminal justice agencies and is operational 24 hours a day, 365 days a year: http://www.fas.org/irp/agency/doj/fbi/is/ncic.htm.

U.S. Postal Inspection Service

A mail cover is the process by which a nonconsensual record is made of any data appearing on the outside cover of sealed or unsealed mail; or by which a record is made of the contents of any unsealed mail, as allowed by law, to obtain information to protect national security; locate a fugitive; obtain evidence of the commission or attempted commission of a crime; obtain evidence of a violation or attempted violation of a postal statute; or assist in the identification of property, proceeds, or assets forfeitable under law. A mail cover may be helpful in investigating identity crimes. Visit this Web site for more information on requesting a mail cover: http://www.usps.com/privacyoffice/intelligentmail.htm.

Postal Inspectors can also help with information about change of addresses the suspects may have made using the victim’s information or their own. Also, if the suspect is using a Post Office Box at either the Post Office or with a Commercial Mail Receiving Agency (CMRA), a Postal Inspector will be able to help you obtain the information used to open the P.O. Box.

Registry of Motor Vehicles

Did the suspect obtain a driver’s license under the victim’s name/information?

Privately Operated Databases

Services like Auto Track XP http://atxp.choicepoint.com/, Lexis/Nexis, http://www.lexisnexis.com/ or ChoicePoint http://www.choicepoint.com/ offer paid subscribers access to billions of records with easy search functionality, and Black Book for Investigators http://www.blackbookonline.info/ provides easy access to public records free of charge.

Techniques

The Preliminary Investigation

Identity crimes are rarely contained in one jurisdiction. Every case requires investigators to determine the point of compromise of the victim's identity – that is where the offender may have obtained the victim's identification information. This will help lead to possible suspects, and often to additional victims.

Properly structured preliminary investigation saves investigative time, involves the victim in resolution of the theft, and lays the foundation for prosecution.

The investigation starts with the victim's report of the crime. As mentioned in previous sections, victims need to help prepare for the investigation by gathering the following:

  • Date of birth, driver's license number, Social Security number, telephone numbers (work, home, and cellular), and e-mail addresses of every victim in the household;
  • A recent copy of at least one of their credit reports generated since the crime occurred;
  • Account numbers involved in the theft and the names of primary and secondary account holders;
  • When and how the fraud or theft was discovered, and under what circumstances the victim became aware of the identity crime;
  • Exact locations (addresses, businesses, persons involved) where fraudulent use of the identity occurred;
  • Name, addresses (home and work), phone numbers, date of birth of every person involved in the incident;
  • Names of financial institutions the victim has notified of the theft, along with the names, addresses, and phone numbers of customer service representatives or investigators who accepted the report, the dates and times of the reports, a brief summary of the conversation, and copies of any e-mail messages or faxes sent to or received from the financial institutions;
  • Photocopies of any letters, account statements, and other documents associated with the case;
  • A chronological log of the theft and the victim's actions since discovering it, to include information about the discovery of theft or fraud, possible locations of the theft, and names or descriptions of persons around when the theft might have occurred.

The Federal Trade Commission has created a Universal ID Theft Complaint Form to record most of the details listed above that the victim knows about the crime. This form can be completed online at www.ftc.gov/idtheft.

During the early stages of the investigation it is important to determine the motive. The motive will help direct the investigation. The motive for financial crimes is usually greed, drugs or revenge. Determining the motive requires investigators to conduct a detailed interview with the victim.

The U.S. Secret Service has developed a questionnaire filled with a variety of useful information to the investigator for victims to fill out that can be used as a valuable tool at this stage of investigation. It is available as part of Appendix A of this toolkit.

The Continued Investigation

Next steps taken by the investigator should be to examine all financial and credit bureau documents. These documents are useful and vital pieces of evidence to tie suspects to the crime and eventual prosecution. For help with this step, the investigator can contact appropriate state and local agencies, as well as the following federal agencies:

  • Federal Bureau of Investigation
  • Secret Service
  • Social Security Administration
  • Postal Inspection Service
  • Bureau of Immigration and Customs Enforcement

The Secret Service has a program called the eInformation Network, an intranet site that is available, for free, to law enforcement agencies and investigators. It is an important tool for investigators in accessing bank and credit card information. For more information, go to www.einformation.usss.gov. The resources available on the Secret Service eInformation Network include the following:

  • Bank identification number search
  • Credit card and skimming information
  • Counterfeit check database
  • Genuine and counterfeit identification document database
  • Cyber crime resources
  • Fraudulent document database

Financial Crimes Enforcement Network (FinCEN) is another excellent network for investigating identity crimes and other financial crimes. FinCEN links databases maintained by the law enforcement, financial and regulatory communities. Its purpose is to collect, analyze, and share information with law enforcement agencies. FinCEN accesses approximately 37 different and independent databases in three main categories: law enforcement, financial and commercial. The databases include AutoTrack, LexisNexis, the Social Security Administration Death Master File, and the Drug Enforcement Administration, Federal Bureau of Investigation, and Internal Revenue Service databases, to name a few. Visit the FinCEN Website at http://www.fincen.gov.

Another valuable tool for investigators is the use of informants. Investigators should develop informants from potential suspects during the investigation. Investigators should also identify possible informants by using intelligence from other law enforcement agencies or the private sector. A good technique to develop informants is using other people who participated in some capacity in the identity crime, such as a store employee who sold goods knowing the suspect was using someone else's identity.

Investigators should consider using other means to gain access to privileged information, including obtaining federal cooperation and funds, seeking state and federal RICO statute investigations, or using forfeiture statutes to gain access to financial records. Above all, investigators should always follow the money – this is an appropriate investigative technique in any financial crime.

Other things to remember:

  • Contact the FTC Consumer Sentinel Network and search the database for investigative leads. www.ftc.gov/sentinel.
  • Contact other involved or potentially involved law enforcement agencies for collaboration and avoidance of duplication.
Obtaining Financial Information

Accessing financial information for any fraud case can be a daunting task for the investigator, especially when cooperation is lacking. It is imperative that the investigator gains cooperation from both the victim and the financial organization.

There are three ways of getting the financial information needed for an identity theft case: (1) search warrant, (2) subpoena power (3) consent. Consent is the simplest and most cost-effective.

Ask the victim to begin gathering and providing documentation to include the following:

  • Bank and credit card statements
  • Letters from creditors
  • Merchant account statements
  • Any other financial documentation related to the crime

Ask the victim to obtain and voluntarily provide the credit reports from the three major credit bureaus (Equifax, Experian and TransUnion). Under the 2003 amendments to the Fair Credit Reporting Act, the victim must contact their creditor’s fraud or security department in writing to request that they send transaction records related to the crime to the investigator. Otherwise, a subpoena is needed from the courts.

Advise the victim to keep a log or a diary of everything they do or everyone they talk with regarding the crime. This can be used as part of the victim impact statement during any subsequent court proceeding. The FTC or ID Theft Resources Center provides valuable information on how victims can organize their identity crime cases.

The investigator should contact the financial institution or merchant security departments and ask for (or subpoena) documentation on all fraudulent or suspect accounts.

Identifying Additional Victims

There are many reasons why an investigator should locate and identify additional victims, but among the most important is to ascertain if there is a larger, organized ring victimizing the community. One way of doing this is by querying the FTC Clearinghouse for other reported complaints that may be related to the case. Investigators can also contact other agencies in the area to determine if there have been similar crimes reported and possibly connected. If that is the case, these agencies can combine resources and personnel into a task force to combat the crime.

Case Preparation

Filing the case criminally can be another daunting adventure. However, if the case is well prepared, the criminal prosecutor will be better equipped to file the case. As noted earlier, the best way of preparing the case is having the victim play a role by taking and keeping notes or a diary, requesting and collecting financial information regarding the crime and taking an overall interest and partnership in the case.

The key to getting an identity crime case filed and getting a successful conviction is organization. It is also helpful if the investigator has an outline of the particular law that is sought for filing when dealing with district attorneys who are unfamiliar with the law. List the requested charges and enhancements on the charging sheet, along with any additional charges.

A case synopsis is also a good way to give the prosecutor a summary of your case. It is your case’s “facts-at-a-glance” sheet. Tailor this sheet to match what the prosecutor looks for in a case. This is helpful when your prosecutor is trying to decide on whether to prosecute your case, and also when you share your case information with other agencies.

18Federal Trade Commission – 2006 Identity Theft Survey Report - http://www.ftc.gov/os/2007/11/SynovateFinalReportIDTheft2006.pdf.

Return to top of page

Tools

In identity crime, it is rare that the perpetrator is caught on his/her first offense and is highly likely that the crime the victim is reporting is not an isolated incident. It may also be helpful to remember that the victim often knows the perpetrator and/or has provided him/her with the information in the first place, believing it was to be used for a legitimate purpose.

According to an FTC survey from 2006, in 16% of all cases, the victim personally knew the person who had misused their personal information. Of those who could personally identify the perpetrator, 6% said a family member or relative had misused their personal information; 8% named a friend, neighbor, or in-home employee; and 2% said the thief was a co-worker.18

The first step will be identifying the perpetrator. To aid in identification, study the crime and determine the two weak points for an identity crime - the contact point, or means by which the perpetrator contacted the victim, and the drop point, or physical location where an item, record, card or merchandise was sent. For example, if the victim information was used at a bank Web site to open a credit card account, the bank site will record the IP address of the computer used to open the account, and will have a verified e-mail to send account information. A search warrant for records can help reveal the suspect’s Internet service provider and physical location of access.

If the account was opened over the phone, most bank sites will record the ANI or caller ID number of the call made to open the account. The telephone number provides a basic place to start the investigation.

Drop points can be shipping addresses for merchandise, mailing addresses for statements, stores where the cards were or are being used, or ATMs where money is withdrawn. The drop point helps to identify the physical location of the thief and can provide valuable working points for search warrants. Don’t forget to check these locations for video of the transactions or for the records of delivery.

In addition, it is important that in any investigation all of the computer forensic evidence is gathered and analyzed. The hard drive of a computer (and other digital media) offer important evidence that can be quite fragile. It is helpful to reach out to specialists to help with the seizure and analysis of such evidence. Contact the National White Collar Crime Center for help online http://www.nw3c.org or by calling (804) 273-6932.

Many of the investigative techniques useful in other criminal investigations can serve to gather evidence in identity crimes as well. Important information can be found in:

  • Suspect’s trash
  • Suspect’s residence or automobile
  • Suspect’s computer, cellular phone, PDA or other wireless device
  • If you are able to get IP addresses linked to the application for fraudulent new accounts, it may be possible to get a court order for the subscriber information from the financial institution.

Investigators should not overlook using officers from other agencies as a resource when they hit a roadblock in an investigation. Each identity crime case has different nuances, and working collaboratively can leverage the collective wisdom, skills and experiences of many of your colleagues in neighboring agencies.

Sometimes identity crimes are deceptively low-tech. Consider the suspect who writes down a credit card number and name, then uses the phone book to get a matching address, then uses that information to buy things over the telephone.

Investigators may also want to pay special attention to mapping the small crimes in a jurisdiction. Using a pin map, it may be possible to see patterns in where credit information is routinely swiped, stolen and used. Postal inspectors can be brought in to help as well.

Other agencies can help to gather information leading to the suspect:

National Crime Information Center (NCIC)

Has the suspect been arrested using the victim’s identity? Has he/she been arrested for any other identity crimes? A check of NCIC, a computerized index of criminal justice data such as criminal record history, fugitives, stolen properties, missing persons, etc., may provide useful information. It is available to federal, state, and local law enforcement and other criminal justice agencies and is operational 24 hours a day, 365 days a year: http://www.fas.org/irp/agency/doj/fbi/is/ncic.htm.

U.S. Postal Inspection Service

A mail cover is the process by which a nonconsensual record is made of any data appearing on the outside cover of sealed or unsealed mail; or by which a record is made of the contents of any unsealed mail, as allowed by law, to obtain information to protect national security; locate a fugitive; obtain evidence of the commission or attempted commission of a crime; obtain evidence of a violation or attempted violation of a postal statute; or assist in the identification of property, proceeds, or assets forfeitable under law. A mail cover may be helpful in investigating identity crimes. Visit this Web site for more information on requesting a mail cover: http://www.usps.com/privacyoffice/intelligentmail.htm.

Postal Inspectors can also help with information about change of addresses the suspects may have made using the victim’s information or their own. Also, if the suspect is using a Post Office Box at either the Post Office or with a Commercial Mail Receiving Agency (CMRA), a Postal Inspector will be able to help you obtain the information used to open the P.O. Box.

Registry of Motor Vehicles

Did the suspect obtain a driver’s license under the victim’s name/information?

Privately Operated Databases

Services like Auto Track XP http://atxp.choicepoint.com/, Lexis/Nexis, http://www.lexisnexis.com/ or ChoicePoint http://www.choicepoint.com/ offer paid subscribers access to billions of records with easy search functionality, and Black Book for Investigators http://www.blackbookonline.info/ provides easy access to public records free of charge.

Techniques

The Preliminary Investigation

Identity crimes are rarely contained in one jurisdiction. Every case requires investigators to determine the point of compromise of the victim's identity – that is where the offender may have obtained the victim's identification information. This will help lead to possible suspects, and often to additional victims.

Properly structured preliminary investigation saves investigative time, involves the victim in resolution of the theft, and lays the foundation for prosecution.

The investigation starts with the victim's report of the crime. As mentioned in previous sections, victims need to help prepare for the investigation by gathering the following:

  • Date of birth, driver's license number, Social Security number, telephone numbers (work, home, and cellular), and e-mail addresses of every victim in the household;
  • A recent copy of at least one of their credit reports generated since the crime occurred;
  • Account numbers involved in the theft and the names of primary and secondary account holders;
  • When and how the fraud or theft was discovered, and under what circumstances the victim became aware of the identity crime;
  • Exact locations (addresses, businesses, persons involved) where fraudulent use of the identity occurred;
  • Name, addresses (home and work), phone numbers, date of birth of every person involved in the incident;
  • Names of financial institutions the victim has notified of the theft, along with the names, addresses, and phone numbers of customer service representatives or investigators who accepted the report, the dates and times of the reports, a brief summary of the conversation, and copies of any e-mail messages or faxes sent to or received from the financial institutions;
  • Photocopies of any letters, account statements, and other documents associated with the case;
  • A chronological log of the theft and the victim's actions since discovering it, to include information about the discovery of theft or fraud, possible locations of the theft, and names or descriptions of persons around when the theft might have occurred.

The Federal Trade Commission has created a Universal ID Theft Complaint Form to record most of the details listed above that the victim knows about the crime. This form can be completed online at www.ftc.gov/idtheft.

During the early stages of the investigation it is important to determine the motive. The motive will help direct the investigation. The motive for financial crimes is usually greed, drugs or revenge. Determining the motive requires investigators to conduct a detailed interview with the victim.

The U.S. Secret Service has developed a questionnaire filled with a variety of useful information to the investigator for victims to fill out that can be used as a valuable tool at this stage of investigation. It is available as part of Appendix A of this toolkit.

The Continued Investigation

Next steps taken by the investigator should be to examine all financial and credit bureau documents. These documents are useful and vital pieces of evidence to tie suspects to the crime and eventual prosecution. For help with this step, the investigator can contact appropriate state and local agencies, as well as the following federal agencies:

  • Federal Bureau of Investigation
  • Secret Service
  • Social Security Administration
  • Postal Inspection Service
  • Bureau of Immigration and Customs Enforcement

The Secret Service has a program called the eInformation Network, an intranet site that is available, for free, to law enforcement agencies and investigators. It is an important tool for investigators in accessing bank and credit card information. For more information, go to www.einformation.usss.gov. The resources available on the Secret Service eInformation Network include the following:

  • Bank identification number search
  • Credit card and skimming information
  • Counterfeit check database
  • Genuine and counterfeit identification document database
  • Cyber crime resources
  • Fraudulent document database

Financial Crimes Enforcement Network (FinCEN) is another excellent network for investigating identity crimes and other financial crimes. FinCEN links databases maintained by the law enforcement, financial and regulatory communities. Its purpose is to collect, analyze, and share information with law enforcement agencies. FinCEN accesses approximately 37 different and independent databases in three main categories: law enforcement, financial and commercial. The databases include AutoTrack, LexisNexis, the Social Security Administration Death Master File, and the Drug Enforcement Administration, Federal Bureau of Investigation, and Internal Revenue Service databases, to name a few. Visit the FinCEN Website at http://www.fincen.gov.

Another valuable tool for investigators is the use of informants. Investigators should develop informants from potential suspects during the investigation. Investigators should also identify possible informants by using intelligence from other law enforcement agencies or the private sector. A good technique to develop informants is using other people who participated in some capacity in the identity crime, such as a store employee who sold goods knowing the suspect was using someone else's identity.

Investigators should consider using other means to gain access to privileged information, including obtaining federal cooperation and funds, seeking state and federal RICO statute investigations, or using forfeiture statutes to gain access to financial records. Above all, investigators should always follow the money – this is an appropriate investigative technique in any financial crime.

Other things to remember:

  • Contact the FTC Consumer Sentinel Network and search the database for investigative leads. www.ftc.gov/sentinel.
  • Contact other involved or potentially involved law enforcement agencies for collaboration and avoidance of duplication.
Obtaining Financial Information

Accessing financial information for any fraud case can be a daunting task for the investigator, especially when cooperation is lacking. It is imperative that the investigator gains cooperation from both the victim and the financial organization.

There are three ways of getting the financial information needed for an identity theft case: (1) search warrant, (2) subpoena power (3) consent. Consent is the simplest and most cost-effective.

Ask the victim to begin gathering and providing documentation to include the following:

  • Bank and credit card statements
  • Letters from creditors
  • Merchant account statements
  • Any other financial documentation related to the crime

Ask the victim to obtain and voluntarily provide the credit reports from the three major credit bureaus (Equifax, Experian and TransUnion). Under the 2003 amendments to the Fair Credit Reporting Act, the victim must contact their creditor’s fraud or security department in writing to request that they send transaction records related to the crime to the investigator. Otherwise, a subpoena is needed from the courts.

Advise the victim to keep a log or a diary of everything they do or everyone they talk with regarding the crime. This can be used as part of the victim impact statement during any subsequent court proceeding. The FTC or ID Theft Resources Center provides valuable information on how victims can organize their identity crime cases.

The investigator should contact the financial institution or merchant security departments and ask for (or subpoena) documentation on all fraudulent or suspect accounts.

Identifying Additional Victims

There are many reasons why an investigator should locate and identify additional victims, but among the most important is to ascertain if there is a larger, organized ring victimizing the community. One way of doing this is by querying the FTC Clearinghouse for other reported complaints that may be related to the case. Investigators can also contact other agencies in the area to determine if there have been similar crimes reported and possibly connected. If that is the case, these agencies can combine resources and personnel into a task force to combat the crime.

Case Preparation

Filing the case criminally can be another daunting adventure. However, if the case is well prepared, the criminal prosecutor will be better equipped to file the case. As noted earlier, the best way of preparing the case is having the victim play a role by taking and keeping notes or a diary, requesting and collecting financial information regarding the crime and taking an overall interest and partnership in the case.

The key to getting an identity crime case filed and getting a successful conviction is organization. It is also helpful if the investigator has an outline of the particular law that is sought for filing when dealing with district attorneys who are unfamiliar with the law. List the requested charges and enhancements on the charging sheet, along with any additional charges.

A case synopsis is also a good way to give the prosecutor a summary of your case. It is your case’s “facts-at-a-glance” sheet. Tailor this sheet to match what the prosecutor looks for in a case. This is helpful when your prosecutor is trying to decide on whether to prosecute your case, and also when you share your case information with other agencies.

18Federal Trade Commission – 2006 Identity Theft Survey Report - http://www.ftc.gov/os/2007/11/SynovateFinalReportIDTheft2006.pdf.