Tag Archives: Financial Fraud Prevention

ID.me says it uses more powerful facial recognition than previously claimed

Posted on by

The CEO of ID.me, a service used by dozens of states to verify unemployment benefits claimants as well as several federal agencies, has walked back previous claims that the company does not use a more powerful method of facial recognition.

"ID.me uses a specific '1 to Many' check on selfies tied to government programs targeted by organized crime to prevent prolific identity thieves and members of organized crime from stealing the identities of innocent victims en masse," Blake Hall said in a statement. "This step is internal to ID.me and does not involve any external or government database."

That contrasts with comments Hall made earlier this week. "Our 1:1 face match is comparable to taking a selfie to unlock a smartphone," he said. "ID.me does not use 1:many facial recognition, which is more complex and problematic."

The 1:many approach involves matching images against those in a database, whereas 1:1 is a case of ensuring someone matches their own photo. For 1:1 matching, ID.me compares a user's selfie against a piece of government ID that they upload.

Privacy advocates have criticized both approaches. Research has indicated that some facial recognition systems struggle to identify people with darker skin tones, and concerns have been raised about the security risks of storing biometric data.

Hall said ID.me's 1:many check "occurs once during enrollment, and exists to make sure a single attacker is not registering multiple identities. This step is not tied to identity verification. It does not block legitimate users from verifying their identity, nor is it used for any other purpose other than to prevent identity theft."

He claimed data shows that dropping the 1:many check "would immediately lead to significant identity theft and organized crime. The 1:1 Face Match step is the only step used to verify identity as explained in our earlier reports."

According to Cyberscoop, some ID.me workers expressed concern that the company's public statements didn't align with what it was actually doing. "We could disable the 1:many face search, but then lose a valuable fraud fighting tool. Or we could change our public stance on using 1:many face search,” an engineer is said to have posted to an ID.me Slack channel this week. “But it seems we can’t keep doing one thing and saying another as that’s bound to land us in hot water.”

“If companies and the government have to lie about facial recognition in an effort to avoid public scrutiny, they shouldn’t be using it,” Fight for the Future campaign director Caitlin Seeley George said in a statement. “We already know this company is willing to say anything in order to get more government contracts. The CEO of ID.me has been peddling erroneous numbers about unemployment benefit fraud, but the fact that the IRS knew about this discrepancy is a big problem. The only responsible thing for the IRS and any other state or federal agency using ID.me to do is to stop these contracts immediately.”

ID.me came back under the spotlight recently after cybersecurity reporter Brian Krebs tried to set up an account, which will be required to log into the Internal Revenue Service's online portal by this summer. Krebs ran into difficulties during the verification process, and ID.me placed him in a queue to join a video call with a live agent. The system gave Krebs an estimated wait time of three hours and 27 minutes.

Hall said ID.me works with 10 federal agencies, 30 states and 540 companies. Last year, some users reported having to wait months to receive their benefits after the system failed to verify their identity. In some cases, folks said they had no success with the video chat system either.

ID.me says it uses more powerful facial recognition than previously claimed

Posted on by

The CEO of ID.me, a service used by dozens of states to verify unemployment benefits claimants as well as several federal agencies, has walked back previous claims that the company does not use a more powerful method of facial recognition.

"ID.me uses a specific '1 to Many' check on selfies tied to government programs targeted by organized crime to prevent prolific identity thieves and members of organized crime from stealing the identities of innocent victims en masse," Blake Hall said in a statement. "This step is internal to ID.me and does not involve any external or government database."

That contrasts with comments Hall made earlier this week. "Our 1:1 face match is comparable to taking a selfie to unlock a smartphone," he said. "ID.me does not use 1:many facial recognition, which is more complex and problematic."

The 1:many approach involves matching images against those in a database, whereas 1:1 is a case of ensuring someone matches their own photo. For 1:1 matching, ID.me compares a user's selfie against a piece of government ID that they upload.

Privacy advocates have criticized both approaches. Research has indicated that some facial recognition systems struggle to identify people with darker skin tones, and concerns have been raised about the security risks of storing biometric data.

Hall said ID.me's 1:many check "occurs once during enrollment, and exists to make sure a single attacker is not registering multiple identities. This step is not tied to identity verification. It does not block legitimate users from verifying their identity, nor is it used for any other purpose other than to prevent identity theft."

He claimed data shows that dropping the 1:many check "would immediately lead to significant identity theft and organized crime. The 1:1 Face Match step is the only step used to verify identity as explained in our earlier reports."

According to Cyberscoop, some ID.me workers expressed concern that the company's public statements didn't align with what it was actually doing. "We could disable the 1:many face search, but then lose a valuable fraud fighting tool. Or we could change our public stance on using 1:many face search,” an engineer is said to have posted to an ID.me Slack channel this week. “But it seems we can’t keep doing one thing and saying another as that’s bound to land us in hot water.”

“If companies and the government have to lie about facial recognition in an effort to avoid public scrutiny, they shouldn’t be using it,” Fight for the Future campaign director Caitlin Seeley George said in a statement. “We already know this company is willing to say anything in order to get more government contracts. The CEO of ID.me has been peddling erroneous numbers about unemployment benefit fraud, but the fact that the IRS knew about this discrepancy is a big problem. The only responsible thing for the IRS and any other state or federal agency using ID.me to do is to stop these contracts immediately.”

ID.me came back under the spotlight recently after cybersecurity reporter Brian Krebs tried to set up an account, which will be required to log into the Internal Revenue Service's online portal by this summer. Krebs ran into difficulties during the verification process, and ID.me placed him in a queue to join a video call with a live agent. The system gave Krebs an estimated wait time of three hours and 27 minutes.

Hall said ID.me works with 10 federal agencies, 30 states and 540 companies. Last year, some users reported having to wait months to receive their benefits after the system failed to verify their identity. In some cases, folks said they had no success with the video chat system either.

Flexbooker online appointment service breach exposes data of 3.7 million users

Posted on by

A group of hackers is trading a database of stolen information from FlexBooker, a cloud-based tool for scheduling appointments, containing sensitive customer data. According to BleepingComputer, the company suffered a security breach before the holidays and notified its customers about the attack in an email, where it revealed that its Amazon AWS servers were compromised on December 23rd. It also admitted that its system data storage was accessed and downloaded.

Based on information from Have I Been Pwned, the breach compromised 3.7 million accounts containing email addresses, names, passwords, phone numbers and partial credit card numbers. BleepingComputer says a group called Uawrongteam took credit for the attack and shared links to archives with the stolen data, which the group claimed also include users' drivers' licenses, other IDs, password salt and hashed passwords. FlexBooker's typical customers are people who need to be able to quickly schedule appointments with clients, such as doctors, lawyers, dentists, gyms, mechanics, salons, trainers, therapists, so and and so forth. 

In Flexbooker's email to users, it said the infiltrators failed to get "any credit card or other payment card information." We're guessing the company didn't take the stolen partial credit card numbers into account. Before Flexbooker, Uawrongteam previously claimed other data breaches and also traded databases with stolen information from its previous targets. They include data from Racing.com, a digital TV network that broadcasts horse racing, and from rediCASE Case Management Software solution for health services and other businesses. 

 

T-Mobile says it blocked 21 billion scam calls in 2021

Posted on by

T-Mobile announced that scam call traffic more than doubled in 2021 with attempts hitting an average of 425 million calls every week, Bleeping Computer reported. It also said that it blocked over 21 billion of those calls for T-Mobile customers through December 2021 (over 700 calls per second) via its Scam Shield service.

Over half the 21 billion calls were related to fake vehicle warranty scams, while others impersonated Social Security employees, wireless providers, car insurance companies and package delivery. Scammers' preferred locations were Texas, Florida, Arizona and Georgia, with the most targeted area code being the Dallas/Fort Worth area. 

T-Mobile launched its Scam Shield service last year, promising protection for all users regardless of their plan. You can choose to either screen calls as "scam likely"' when a call comes in, or block them altogether using a variety of methods, as T-Mobile details in its blog post. 

AT&T and Verizon also released stats for scam calls, with AT&T saying its ActiveArmor service has blocked over 16 billion suspicious calls since 2016. Verizon, meanwhile, revealed that around 78 million of its customers were protected from 13 billion unwanted calls by its Verizon Call Filter service. 

FCC proposes new rules to combat SIM swapping scams

Posted on by

SIM swapping scams have been on the rise these past couple of years, and since most online services these days are tied to people's phone numbers, the technique has the potential to ruin victims' lives. Now, the Federal Communications Commission is seeking to create new rules that would help prevent SIM swapping scams and port-out fraud, both of which are techniques designed to hijack people's phone numbers and identities. 

The commission said it has received numerous complaints from consumers "who have suffered significant distress, inconvenience and financial harm" as a result of both hijacking methods. SIM swapping is a technique wherein a bad actor convinces a wireless carrier to transfer a victim's service to a phone they control. When a bad actor successfully transfers the victim's service and number to another carrier, that's called port-out fraud.

To make it harder for scammers to gain control of potential victims' phone numbers, the FCC wants to amend the Customer Proprietary Network Information (CPNI) and Local Number Portability rules. In particular, it wants to require providers to adopt more secure methods in authenticating a person's identity before agreeing to transfer their service to a new phone or to another carrier. The commission also proposes a rule that would require providers to notify customers whenever a SIM switch or a port-out request is made on their accounts. 

As part of the FCC's rulemaking process, the public can now comment on these proposals. The commission still has to read those proposals and offer the public another chance to make their voice heard before it can decide whether to amend the aforementioned rules. 

FCC proposes new rules to combat SIM swapping scams

Posted on by

SIM swapping scams have been on the rise these past couple of years, and since most online services these days are tied to people's phone numbers, the technique has the potential to ruin victims' lives. Now, the Federal Communications Commission is seeking to create new rules that would help prevent SIM swapping scams and port-out fraud, both of which are techniques designed to hijack people's phone numbers and identities. 

The commission said it has received numerous complaints from consumers "who have suffered significant distress, inconvenience and financial harm" as a result of both hijacking methods. SIM swapping is a technique wherein a bad actor convinces a wireless carrier to transfer a victim's service to a phone they control. When a bad actor successfully transfers the victim's service and number to another carrier, that's called port-out fraud.

To make it harder for scammers to gain control of potential victims' phone numbers, the FCC wants to amend the Customer Proprietary Network Information (CPNI) and Local Number Portability rules. In particular, it wants to require providers to adopt more secure methods in authenticating a person's identity before agreeing to transfer their service to a new phone or to another carrier. The commission also proposes a rule that would require providers to notify customers whenever a SIM switch or a port-out request is made on their accounts. 

As part of the FCC's rulemaking process, the public can now comment on these proposals. The commission still has to read those proposals and offer the public another chance to make their voice heard before it can decide whether to amend the aforementioned rules. 

Man charged for allegedly selling insider trading tips on the dark web

Posted on by

The Department of Justice and the Securities and Exchange Commission have charged a man they claim sold insider trading tips on the dark web. Apostolos Trovias allegedly used anonymizing software, pseudonyms (he is said to have gone by the nickname "The Bull") and bitcoin to mask his identity.

According to the complaint, Trovias sold stock information individually and on a subscription basis on defunct black market AlphaBay and other sites on the dark web. He's said to have styled himself as a “hedge fund insider” who worked in a trading branch as an office clerk.

In 2017, not long before authorities seized and shut down AlphaBay, Trovias allegedly sold an undercover Internal Revenue Service agent pre-release earnings report information for at least one publicly traded company. He is facing one count of money laundering (which has a maximum penalty of 20 years in prison) and one count of securities fraud, which could lead to a prison sentence of 25 years if Trovias is convicted.

The complaint was filed in February but kept sealed until after Trovias was apprehended. He was arrested in Peru in May, according to a filing spotted by PCMag, which notes the US Government was working on extraditing him.

Others have been charged or convicted in connection with AlphaBay activity. In February 2020, feds charged Larry Harmon for allegedly running a $300 million bitcoin money laundering scheme. Last September, Bryan Connor Herrell was sentenced to 11 years in prison. Herrell was a moderator for AlphaBay and resolved disputes between vendors and customers. He pled guilty to conspiring to engage in a racketeer influenced corrupt organization.