You receive a phone call from your bank. At first glance, it appears to be just like any other. However, once the caller on the other side starts asking questions (e.g., regarding a car loan you didn’t apply for or a credit card you’ve never opened), it becomes clear that someone else is using your personal ID (date of birth, address, etc.) as if they were that person.
This type of identity theft is quite invasive and usually leaves victims struggling to prove that some entity claiming to be them isn’t really them. The effects of identity theft are far-reaching: bank accounts, credit reports, government records, and more extreme forms can lead to police involvement.
Usually, the theft occurs long before the fraud begins.
Not All Cases Begin With a Data Breach
Most identity theft crimes do not occur due to a major cyberattack. The thief could gain personal information via email phishing schemes, stolen mail, hacked accounts, discarded documents, or information published online that someone shares willingly.
Michael Porter is a senior private investigator with Haywood Hunt & Associates Inc. in Toronto , works in an investigative field where piecing together scattered information is often central to understanding how fraud occurred. “Today’s fraud investigations can include reviewing online activities, public records, financial documentation, and the connections between people to look for patterns and to understand how identities might have been used.” Haywood Hunt’s investigative services include fraud investigations and open-source intelligence work concerning identity theft.
Mr. Porter points out that “Fraudsters don’t need everything about a victim. A name, date of birth, and an address can be enough, along with information acquired elsewhere. Photocopies of identification can also be changed or modified so that the genuine information is linked to another person’s photo.”
Identity Theft/Fraud Involves Two Separate Crimes
Canada defines two crimes within its Criminal Code: 1) obtaining/possessing another person’s identification for a fraudulent purpose (identity theft), and 2) fraudulently pretending to be another person (personation).
Criminal Code Section 402.2 concerns identity theft. This provision applies when someone acquires or possesses another person’s identity information with the intention of using said information to commit an indictable offence (i.e., false pretences, deceit, falsehood). Identification information includes names, addresses, dates of birth, signatures, usernames, banking information, passport numbers, SINs, and passwords.
On the other hand, Section 403 of the Criminal Code provides for personation. Personation refers to fraudulently representing oneself as another individual for purposes of obtaining an advantage, acquiring property, or causing loss to another party.
Akash Dhillon is a criminal defence lawyer with A. Dhillon Law in Brampton and frequently deals with offences involving fraud, theft, and those that relate to identity. Dhillon explains that “the manner in which identification was collected, whether the identification was used for a legitimate reason, and ultimately what the offender intended to accomplish can become crucial factors in these types of offences. Depending upon what is alleged to have occurred, police may also investigate related offences, including forgery, fraudulent credit cards, possession of goods obtained by crime, and/or various other charges.”
A Potential Piece of Evidence: Your Real Information
Perhaps one of the most disconcerting aspects of identity fraud is that your legitimate identification will likely appear in multiple places during the transaction.
A loan application may list the victim’s actual address. A victim’s credit history may be associated with a new, fraudulent account. Accurate information and fake photos may both be included in a forged document. Emails generated from each transaction, account records, video surveillance, device logs, etc., will be created.
Separating the Legitimate Owner From the Thief Using the Legitimately Owned Identity
An investigator will typically compare any signatures provided with prior examples of those signatures, examine the timing and location(s) of similar transactions, review account access history, and review any surveillance footage showing the victim physically located at an entirely different location than the business being defrauded by a third party using his/her name.
Digital evidence may reveal that devices were used to carry out transactions at times and locations that were not accessible to the victim. An email message, login record, or software application may provide compelling evidence to support an allegation. However, without sufficient context, it will remain ambiguous.
Evidence Volume Does Not Equal Proof
While allegations related to identity theft can result in the accumulation of an extensive quantity of documentation, this does not equate to proof.
Rupin Bal is a criminal lawyer with Rupin Bal Law Professional Corporation, having experience in many fraud and financial offence cases in Ontario. Mr. Bal notes that “in fraud cases, much of the prosecution will rely upon the documentation and testimony of witnesses to demonstrate who made a transaction, what that person knew, and/or what that person intended when making such a transaction.
This differentiation is critical where there are common addresses, family relationships, co-workers, and/or other individuals who could have had legitimate reasons for having access to another individual’s personal information. Police and prosecutors will need to demonstrate a connection between the defendant and the alleged misconduct and prove all elements of the offence beyond a reasonable doubt. Digital evidence can create numerous issues concerning control of an account or device at specific times. While a login, message, or application may be relevant evidence of identity fraud, such evidence can only be evaluated through consideration of the surrounding circumstances.”
What Can Victims Do?
Time is critical once your identity has been compromised.
The Office of the Privacy Commissioner of Canada suggests that victims contact the bank(s) and/or credit card company(s) involved in the compromised identity information, immediately update passwords, report crimes committed against them to their local police department, and report scams or fraud to the Canadian Anti-Fraud Centre. Any missing identification should be reported by the victim to the organization that originally issued the identification document.
Victims should also verify their credit reports and maintain documentation regarding all suspicious transactions, phone calls, and emails, as well as all steps taken by them. Screenshots, correspondence, and reference numbers can also serve as possible means of establishing a timeline.
Finally, victims should resist the temptation to rectify the initial fraudulent account and believe they have completed their obligation. When a single piece of identification is compromised, it is highly likely that it has been utilized elsewhere.