Most people think they have nothing worth stealing, but they'd be wrong. We talk to the founder of a company that helps organisations find out which employees pose a security risk because they're likely to fall prey to social engineering traps and other cons. He explains just how easy it is to commit ID fraud.
Roberts then ran a LexisNexis report, and a few other reports, on this person and fairly quickly obtained their Social Security number. He is married and has kids.
"So we then did a lot of digging around at a few of the local schools pretending to be this person's secretary. We found out where the kids went to school."
From there, Roberts had one of his guys go around and do a Bluetooth assessment and see if any other information could be picked up. "We were able to pull a Bluetooth signal from the residence. Now we can drop some software on it, monitor where he is, match the GPS tracking, listen to his calls and conversations."
Roberts now knows his email, his office and mobile number, his home address, his mortgage information, his Social Security number, where his kids go to school and how to monitor his calls and comings and goings.
"It took us half a day to do this work and I essentially own this person. I own him and can do whatever I want with him. I could go open up bank account in his name, assume his identity or act on his behalf, say to reserve a suite at a hotel," Roberts said.
Once Roberts obtained his information, identity and bank account, he realised he could go on a spending spree. However, the two employees working on this account realised not only that they don't look like the person, but they were aware that his own security team knew them and where they were.
"We spent about 20 minutes laughing about buying an island somewhere in the middle of nowhere, having the Ferraris shipped out and getting a large stash of weaponry to defend our ill-gotten-gains!"
Roberts says thinking back, the first time he 'became an instant millionaire' by doing an assessment, it was a total rush, a cool feeling. But the honesty chip cuts in and the 'yay!' feeling is short-lived, because "you then spend 30 minutes debating how you could get away with it".
"That's when you realise there's others out there like me who are equally good at finding me. But it's always fun to work out how you could get away with it!"
The reaction from him and his team? Surprised, of course. Surprised, angry, annoyed.
"All of the reactions one might go through when you realise you are naked. There is an expectation of privacy with these kinds of people. This is an executive of a company who has put many layers between himself and his staff to get a level of protection and anonymity," Roberts says.
"When some guy passed him on the street and handed him a laptop that said 'I own you', it gave him a definite feeling of shock and horror."
See also: The 8 best privacy downloads for Firefox
- Think you've got nothing worth stealing?
- Finding out about your family