You don’t have to be an international cybercriminal to become the kingpin of an unemployment insurance fraud ring; all it requires is a laptop, an internet connection and an up-front investment to buy stolen Social Security numbers by the dozen.
Some of the massive fraud spawned by injection of pandemic relief benefits into state unemployment insurance systems can be traced to organized crime, such as the Nigeria-based scammers who bilked millions from Washington state’s jobless benefits program last year. At the same time, anyone with a bit of computer savvy and the morals of a scorpion can sign on to what is known as the “Dark Web.” There, they will find not only “how-to” guides for ripping off unemployment benefits, but also shop for stolen identities and buy phony ID documents for each of them.
“(Using the Dark Web) is not that hard,” said Phillip of Reno, who didn’t want his last name used. “You download a Tor browser and route it through a good VPN (Virtual Private Network) and that’s it; you’re in… There’s a lot of nasty shit on the Dark Web.”
An invisible browser
Tor is a secure browser that keeps users anonymous online by encrypting all data and routing the internet connection through a maze of servers. The browser isn’t illegal, Phillip said, but it raises eyebrows among internet service providers, who may refer the account to their security department or even tip off government agencies that something nefarious is going on.
The VPN, he said, routes data through another encrypted pathway and disguises the user’s internet address. “That way, you’re invisible,” Phillip said. “Nobody needs to know your business.”
If the business is unemployment fraud, the Dark Web is its graduate school.
A how-to-scam handbook
Researchers have identified sites that act as bulletin boards where bad actors exchange information about how to pull off unemployment fraud in different states and how to craft the claims applications to qualify for pandemic-related assistance. Some sites are marketplaces of stolen Social Security numbers and other identifying information, including dates of birth, addresses and the mothers’ maiden names of ID-theft victims.
The Dark Web also hosts vendors who will tailor identification documents to the specific stolen IDs. Scammers may buy the identities by the score and file dozens of claims simultaneously. Even if the fraudulent claims are quickly discovered, just a few weeks’ worth of payments can show a substantial profit, particularly with federal subsidies tacked on to state payments during the pandemic.
Nevada and other states have installed tighter security measures over the last several months to thwart fake claims, but scammers often engineer ways around the failsafe systems. “It’s an arms race,” Phillip said, about any effort to secure data. “The only way to win is not to play.” He said fraud can be eliminated only if benefit systems shut down. “They can’t catch all of it without a lot of (real claims) getting caught up in the net,” he said.
Epidemic of bogus claims
Unemployment claims reached a historic level during the COVID-19 pandemic.
As virus infections spread through the U.S., so did an epidemic of fraud aimed at grabbing large chunks of the money flowing from the CARES Act. Under that law, freelancers and gig workers for the first time became eligible for jobless payments. Because contract workers don’t have full-time employers, it was relatively easy to make up job and income histories. State unemployment systems usually could not verify those claimants’ employment records.
A Nevada state strike force last year analyzed computer claims data at the Nevada Department of Employment and Training and found that claims were pouring in from all over the nation and the world. Of 9,000 “questionable claims” sent to a security firm for validation, less than 1% proved to be valid. Another firm, ID.me, sent out 109,814 identity verification requests to people claiming Nevada benefits and 102,288 cases were deemed to be fraudulent.
Public employees data stolen
In one case, 2,000 fake claimants listed the same mailing address in Las Vegas. In Southern Nevada, more than 2,300 public employees had their identity information appear on bogus unemployment claims. In December, the FBI arrested a man in a case involving 24 Nevada unemployment insurance debit cards in different names and notebooks containing the personal identifying information to go with those cards as well as detailed ID data for about 60 other people.
In that case, 60 claims had already been filed with the state in an effort to snag at least $1.1 million in unemployment insurance benefits.
Nevada’s ID theft problem
None of the ID-theft victims interviewed for a Reno News & Review story about unemployment insurance fraud could determine how their Social Security numbers and dates of birth found their way into the hands of scammers. Those numbers may be among the massive pool of stolen identities available for sale on the Dark Web.
Some of those stolen IDs came from “phishing,” a technique in which scammers fool consumers into turning over personal information on the telephone or via the internet. A vast number of compromised IDs, however, are the fruits of data breaches, when hackers swipe information from company or government servers.
According to the Identity Theft Resource Center’s most recent Data Breach Report, between Jan. 1, 2005, and May 31, 2020, there have been 11,762 breaches. That translates into more than 1.6 billion records compromised. The Federal Trade Commission rates Nevada fifth in the nation per capita for identity theft cases, while the financial website Wallet Hub lists the Silver State fourth in its national survey of identity theft and fraud.
Cyber thieves often steal mountains of records in a single breach.
A wave of data breaches
In 2017, a security breach at the credit reporting firm Equifax exposed the personal information of 147 million people. The same year, 18,000 current and former employees of the media giant Gannett received notices that their identities may be at risk due to a breach in its human resources computer system. National retailers including Target, Home Depot, Neiman Marcus and Michael’s craft stores also have reported major data breaches. Nearly one in three data breach victims will also experience identity fraud, according to Javelin Strategy & Research, a national consulting firm.
And one in three victims of identity theft will experience it again, the statistics indicate.
“Once you know your Social Security number is out there, it’s free-range,” said Mike Raymond, a retired security consultant from Carson City. “It’s been compromised and you can’t call it back.” He said people who know that someone else has used – or attempted to use – their personal information needs to be on guard thereafter. “Get credit monitoring; check your credit report regularly for suspicious activity,” he said.
‘When, not if’
The rapid development of digital technology has made all computer users vulnerable. While there’s no way to be completely safe, consumers should start by knowing how to keep their data secure in an age of invisible thieves, Raymond said. “It’s a digital world and we all live in it whether we’re computer geeks or not,” he said. “Everyone has to be careful and pro-active.”
No matter how cautious people are with their own computer habits, the massive data breeches at large companies show that close-kept personal information can be compromised in ways that are beyond individuals’ control. The spread of that information over computer systems and the ever-evolving technical skills of hackers, he said, make it “a question of when, not if,” somebody eventually will get hold of a person’s identity information.
Hang on to your name
American Consumer Credit Counseling has identified six steps to help consumers protect themselves from digital identity theft:
- Secure your devices — Never leave your mobile device or laptop by a window, visible in a car or sitting in a gym locker. If you have to leave your laptop, smart phone or tablet, make sure it is locked away where no one can see it. When in public, make a habit of using a cable lock to secure your laptop to a strong, unbreakable object that won’t move. For cell phones and tablets, use passwords to prevent unauthorized access to your data.
- Register your devices with their manufacturers — Registering your digital device will “flag” a product and a manufacturer will have record of it if it is ever sent in for service.
- Review your online credit cards statements carefully — Make sure you recognize the merchants, locations and purchases listed before paying the bill. Contact your creditor if you notice any suspicious activity on your statement.
- Back up your data — You will have saved your records, even if your device is stolen.
- See how safe a site is before you click — The best way to avoid scams and dodgy sites online is to never visit them. Be wary of sites making offers that seem too good to be true, or ask you for sensitive, personal information like banking and credit card account numbers. Unsafe sites may also feature intrusive ads and pop-up windows.
- Shred, don’t just throw out, sensitive documents such as credit card statements, health records, tax returns and employment records. The Nevada Better Business Bureau offers free “shred days,” as do several local banks.