knowledge of how the identity theft was carried out. A deeper understanding of this knowledge is likely to improve future detection methods. Because service disruption is a key detection event in most identity thefts, it is possible that service providers are unable to detect an identity theft event because they cannot tell a legitimate service disruption from an illegitimate service disruption. One explanation for this observation relates to how service providers deal with customer profiles: if they are used to seeing each customer as a portfolio of potential actions and activities, then it becomes difficult to determine a real activity from a fabricated activity. Table Methods of Identity Theft Detection Detection Method n Self 3592 Bank or Financial Institution 253 Another Business/Agency 131 Police and Law Enforcement 47 Utility 45 Debt Collection 43 Member Organisation 20 Credit Bureau 17 Family member/Friend/Acquaintance 14 Media Data Breach Alert 13 Other 5 Duration of the Identity Theft Attack It is difficult to assess the duration of the attack, for various reasons. First, analysis of the time taken to detect and act on a suspected identity theft compromise is challenging. On average, 43 days elapsed between when the victim first discovered the suspected identity theft, and when they called IDCARE for assistance. However, this figure is not necessarily a true indication of the contact events. First, in 2439 cases (57%), the victim contacted IDCARE on the same day that they noticed the potential compromise. A further 613 cases (14%) contacted IDCARE within two days of discovering the potential compromise. In total, approximately 84% of cases contacted IDCARE within a week of the potential compromise. Inconsistent detection methods, and the fact that most detection is by victims themselves, mean that identity theft reports do not always clearly identify the time at which the attack took place. Second, some identity thefts require a long time to enact and it can be difficult for a victim to correctly recall the date at which the attack first began. Third, identity thefts may proceed along non-linear lines, such that a successful first attack may eventually give rise to successful subsequent attacks: an attacker may come to better know their victim and may subsequently enact the specific attack types that are likely to be most successful. An attacker may also later identify a use for earlier identity documentation.
knowledge of how the identity theft was carried out. A deeper understanding of this knowledge is likely to improve future detection methods. Because service disruption is a key detection event in most identity thefts, it is possible that service providers are unable to detect an identity theft event because they cannot tell a legitimate service disruption from an illegitimate service disruption. One explanation for this observation relates to how service providers deal with customer profiles: if they are used to seeing each customer as a portfolio of potential actions and activities, then it becomes difficult to determine a real activity from a fabricated activity. Table Methods of Identity Theft Detection Detection Method n Self 3592 Bank or Financial Institution 253 Another Business/Agency 131 Police and Law Enforcement 47 Utility 45 Debt Collection 43 Member Organisation 20 Credit Bureau 17 Family member/Friend/Acquaintance 14 Media Data Breach Alert 13 Other 5 Duration of the Identity Theft Attack It is difficult to assess the duration of the attack, for various reasons. First, analysis of the time taken to detect and act on a suspected identity theft compromise is challenging. On average, 43 days elapsed between when the victim first discovered the suspected identity theft, and when they called IDCARE for assistance. However, this figure is not necessarily a true indication of the contact events. First, in 2439 cases (57%), the victim contacted IDCARE on the same day that they noticed the potential compromise. A further 613 cases (14%) contacted IDCARE within two days of discovering the potential compromise. In total, approximately 84% of cases contacted IDCARE within a week of the potential compromise. Inconsistent detection methods, and the fact that most detection is by victims themselves, mean that identity theft reports do not always clearly identify the time at which the attack took place. Second, some identity thefts require a long time to enact and it can be difficult for a victim to correctly recall the date at which the attack first began. Third, identity thefts may proceed along non-linear lines, such that a successful first attack may eventually give rise to successful subsequent attacks: an attacker may come to better know their victim and may subsequently enact the specific attack types that are likely to be most successful. An attacker may also later identify a use for earlier identity documentation.
ACCAN_ANU_ID%20theft%20and%20Aust%20telecoms_Case%20analysis.docx