Mr. Goldmann

Security & Safety

How to Investigate Identity Theft When Your Properties are Targets

By Peter Goldmann, President, FraudAware Hospitality

The news is full of reports about Americans falling victim to identity theft and fraud and about how difficult it is to recover from this devastating crime. For good reason: According to the Federal Trade Commission, approximately 270,000 complaints of identity theft are received each year-up dramatically from 215,000 as recently as 2003.

Less widely reported is the growing threat to corporations-especially ones processing large volumes of credit card charges-of identity theft and fraud.

The problem for hospitality companies, among others, is that thieves have found more and more ways to steal customer credit card and other personal information in order to create counterfeit credit cards in the victim's name.,..or to use the credit card information to fraudulently purchase goods over the Internet with the victim's identity.

In addition, restaurant and front desk point-of-sale locations are common "hang-outs" for dishonest employees armed with credit card "skimmers" that record guest credit card data for later use in identity fraud.

For hospitality companies seeking to protect themselves and their guests from the growing threat of identity theft and fraud, securing confidential employee and customer data is the obvious first step to mitigating risk.

This is often easier said than done. For that reason, says Judith Collins, PhD, former Director of the Michigan State University-Business Identity Theft Crime and Research Lab and author of the recently published book, Investigating Identity Theft: A Guide for Businesses, Law Enforcement and Victims, most hospitality organizations wisely retain the services of an experienced information security consultant to achieve this goal.

However, according to attorney, Diana S. Barber, founder of Lodge Law, you don't need an expert to train your employees to avoid throwing paperwork that contains personal guest information into the garbage...or to advise your guests to always secure personal computers and other electronic devices that may contain personal data.

Beyond securing data, however, investigating incidents of identity theft and fraud that target your properties can result in apprehension of perpetrators and can be a powerful deterrent to other criminals who learn that your company takes active steps to protect its guests from identity thieves instead of just handing these cases over to the local police where they can languish indefinitely.

PREPARING TO INVESTIGATE

According to Collins, whose research in the area of identity theft and fraud is widely acclaimed, the following steps often result in the successful conclusion of a hotel company identity theft/fraud investigation..

Step 1:
Authenticate the victim and the crime. Sometimes hotel or restaurant patrons who complain to management that someone fraudulently charged goods or services from your property to their credit card or account are the perpetrators themselves and use this ploy to keep investigators off of their trail of actual identity frauds.

To avoid this trap, review the "victim's" credit report. If you are obtaining the credit report directly from the "victim," be suspicious if information is missing or has been altered. Legitimate victims of identity theft don't make such changes or omissions.

By contrast, if the report contains several variations on the victim's name (such as A. Smith, Andrew Smith, A.B. Smith, Andy B. Smithe, etc.), it may be a sign that a criminal is in fact using your hotel or restaurant guest's name to apply for fraudulent bank accounts, credit cards or other financial services.

Step 2:
Interview the victim(s). An interview is effective whenever inconsistencies such as multiple aliases or inaccuracies appear on the victim's credit report.

Prepare for the interview by formulating questions based on the specific inaccuracies and/or inconsistencies you've discovered.

Have the questions posed randomly in two different interviews, on two different days and by two different investigators. While the vast majority of identity theft victims are honest, the few who aren't can be easily identified if you find inconsistencies in the comparison of interview answers.

Step 3:
Conduct a detailed analysis of victims' credit reports for evidence of fraud. If multiple customers are complaining that they are noticing credit card charges from your hotel, restaurant or other retail outlet, that they didn't make, obtain and analyze copies of their credit reports from each of the four major credit agencies-Experian,Trans Union, Equifax and Innovis.

These agencies do not share credit data. To obtain a full and accurate picture of a victim's identity fraud details-and potential leads on perpetrators-you must review all four reports. Key information to gather:

The objective of this exercise is to determine patterns of fraudulent activity.

It is essential to investigate all entities listed in the "unauthorized" access section of victims' credit reports.

Step 4:
Analyze credit card, bank loan, retail account and other financial statements. Though most of what hear about the identity theft problem in America is negative, there is a ray of positive news: identity thieves usually slip up in one way or another when submitting bogus applications.

Typically, the address is phony or the telephone number is a cell phone number.

Add all chronological data from these applications to your flip chart. Next, call the fraud departments of all credit card companies, retail stores or banks, other than your own organization, where unauthorized applications were made. Build a rapport with these fellow fraud investigators to obtain their help in searching relevant computer databases or paper documents associated with the identity fraud you're investigating.

PUTTING THE DATA TO USE

Step 5:
Surveillance. Once all available credit report, credit card and other fraudulent application data and documents have been analyzed and charted, it's time to start surveillance of postal, apartment or other suspicious addresses.

According to many experienced identity theft investigators, the best move is to use the "present" address(es) gathered from the investigation so far, and use the Internet to locate the addresses and print maps with directions to get there.

It is also prudent to search for the owner of the building with the "present" address-if it is not a post office. This information may prove essential not only for surveillance, but also for an eventual search and seizure operation.

Step 6:
Create a new flow chart. Post another large flip chart that will show all new information that has been gathered.

This will help you to graphically show all geographical locations involved in the identity fraud so that efficient surveillance and search and seizure plans can be mapped out.

In addition, such flow charts will prove critical as evidence for potential search warrants, subpoenas and court proceedings if and when law enforcement authorities are called in to help in the investigation.

Peter Goldmann is the Developer of FraudAware/Hospitality, the first on-line fraud awareness training course for hospitality managers, supervisors and line employees. He is is the publisher of the monthly newsletters, White-Collar Crime Fighter and Cyber-Crime Fighter. His company, White-Collar Crime 101 LLC also is the developer of FraudAware/Hospitality, a customizable Web-based fraud awareness training course for managers, supervisors and line employees. He is a member of the Association of Certified Fraud Examiners, and The International Association of Financial Crimes Investigators. Mr. Goldmann can be contacted at 203-431-7657 or pgoldmann@wccfighter.com Extended Bio...

HotelExecutive.com retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by HotelExecutive.com.