Security experts have long warned that legal identity verification should not just be linked to knowing four pieces of personal information: a person’s name, address, birth date and Social Security number.
Yet, many companies rely on this data as their primary way to identify their customers. Thousands of people lose control of their phone numbers every month, for example, because fraudsters are able to use the four pieces of information to convince wireless providers to transfer or forward phone numbers.
The situation will only worsen following credit-history firm Equifax announced Sept. 7 that hackers were able to breach its systems, losing names, addresses, birth dates and Social Security numbers on 143 million U.S. citizens — or about 51 percent of all U.S. adults.
While financial firms and other companies targeted by cyber-criminals and fraudsters have begun moving away from using such “knowledge-based factors” to verify their customers, most companies are not so sophisticated, Dwayne Melancon, vice president of product for fraud-prevention firm iovation, told eWEEK.
“Companies that are relying on knowledge-based assessments—they may need to add additional factors,” he said. “They need extra safeguards— some which will be burdensome, such as proof using documentation—others could use some sort of device-based check.”
The Equifax breach will cause repercussions for years and could change the way that identity is verified online. Name, address, birth date and Social Security number have long been the litmus test for people to open accounts. That will have to change, experts say.
Otherwise, U.S. citizens should expect a variety of financial crimes—such as new account fraud and attempts to take over accounts—to increase. Paired with sophisticated phishing attacks, the widespread availability of people’s sensitive information could lead to unprecedented account fraud, Simon Taylor, vice president of products at email and document security firm Glasswall, said in a statement sent to eWEEK.
“Even if users weren’t immediately affected, it’s likely that this attack will have a ripple effect for months or even years to come that will pave the way for new waves of attacks.”
And many of these cyber assaults will involve malicious attachments, which remain the most popular and successful mode of phishing for cyber-criminals.
The European Union’s General Data Protection Regulation (GDPR) could help by forcing companies to more strictly handle verification, as well as customers’ data. While the regulations only apply to EU citizens, it will likely have a ripple effect in the U.S., iovation’s Melancon said
“I think a lot of this information is out there from pervious breaches, but just the scope of this breach and the timing—running up against GDPR—this could be one of those bellwether events that triggers everyone to change how they verify and validate who their customers are,” he said. “I’m hoping it leads to a better situation, where people are using stronger identity proofing and stronger authentication, because that will make it better for all of us.”