This article is written by Paridhi Goel, a student from Symbiosis Law School, NOIDA. This is an exhaustive article which deals with the explanation of what are the different aspects of Identity theft and how it is a growing threat to families today.
Has the idea of someone else impersonating you ever crossed your mind? Have you thought about what all can happen if someone steals your identity and uses it for his own gains? This situation is described by the term Identity Theft and it has become a huge problem of privacy invasion and breach of trust. Identity is an important part of our lives because it gives an individual a form of recognition and helps in establishing social and economic relations. In the modern era, everything is linked to a person’s identity including all information about his personal and professional work, financial statements, medical records, taxes, and family background as it helps that person in accessing and verifying his own information easily. This is an age of digitalization where every individual wants his personal and professional data on his fingertips and every detail is made available through online networks so that they can be accessed anywhere, anytime. Although it is assured to us that our details are safe online, it is our duty to stay vigilant about the information that we share with others and that we do not leave any sensitive information unsupervised. When we do, it becomes a cause for Identity Theft as such a theft is a crime of opportunity done by impersonating a victim to obtain his valuable information like credit cards, bank account numbers, and personal life data.
In a simple language, Identity Theft can be defined as obtaining the personal or financial information of another person so that the thief can use the name or identity of that person to make certain purchases or transactions or to commit fraud. Stealing someone’s identity can also destroy his image or credit rating as the thief gets all the personal information as well. This personal information obviously poses a threat to an individual but more importantly it is also a threat to that individual’s family and close ones. It jeopardizes the privacy of the entire family and the thief can use this information to steal the identities of other members of that family too. You might hear in the headlines every alternate day about some credit card fraud or loss of money due to Identity Theft but, we do not often hear about how it is also a growing threat to families. This article highlights an important side of Identity Theft taking place among families or impacting families in large numbers which are ignored or suppressed in most of the cases as it is an ‘inside family matter’.
Identity Theft in India
According to the annual findings of ‘Norton LifeLock Report’- nearly four in ten respondents in India that is about forty percent have experienced Identity Theft. Five percent of these cases that have been reported are of Identity Theft in families. To cope up with the ongoing digitalization, India has asked all its citizens to make use of the online facilities for storing and sharing any kind of information. Since this technology is created by humans, there is a possibility of some loopholes in the process of safeguarding the online information of millions in the country. The Identity thieves find these loopholes and work through them to extract the information they need for their gains. The work of these thieves becomes quite easy when the user who is sharing information is easily influenced to share it to unknown sources, or he does not keep a check on his data and leaves them unattended or even when the user is ready to give away personal information when asked without conducting any cross-checks.
The prevalence of illiteracy among the majority of the population in India is a drawback to this technology. Most of them are not aware of what an identity theft or a security breach is and often end up helping the thieves to take their information easily. Many of them can be fooled in the form of calls, emails, and online advertisements, asking for their bank details and financial statements directly. Many people do not get to know that their identity is stolen until many false transactions are already made under their name. This is the reason why India ranks in the top ten of the countries facing the threat of Identity Theft.
India is also a hub of joint families where they prefer to stay connected even when it comes to online networking. When one member of the family becomes a victim, it poses a threat to the entire family as anyone of them can be the next to experience fraud. Also, family Identity Theft becomes a matter of shame and dishonour in the family which is why most of the cases are not even reported.
Types of Identity Thefts
Identity theft can be of different types depending on the motive of the thieves. While the common ground is stealing the identity of a person, the information extracted or for what purposes the stolen identity is used is what makes the thefts different from each other. Any of these thefts can affect the families of the victim or pose a threat to its members. The common types of identity thefts are as follows-
Financial Identity Theft
The majority of the identity thefts that occur are financial in nature. In this kind of theft, the identity is stolen to obtain the financial statements of that person like credit card details or bank account numbers so that this information can help the thieves to obtain loans, withdraw funds from the bank accounts, make purchases or payments or even open new lines of credit under the stolen name. Not only does this pose a threat to the money records of the individual whose identity has been stolen but also, his close ones and family members to whom transactions are made become a part of this threat.
Criminal Identity Theft
Even though stealing someone else’s identity is a crime in itself, criminal identity theft occurs when the person who stole the identity has committed an offence or is caught by the police for some violation of the law and he uses the personal information from the stolen identity to present himself by the name that he stole. Thus, the criminal record is filed under the name of such a person who neither committed the offence nor is aware of that crime. Sometimes the person does not even realize this theft until the police arrive at his doorstep. In this case, the victim faces a lot of difficulty in clearing himself of all the false charges and proving that his identity was stolen. Moreover, this causes emotional distress to the family members of the victim and the thief walks free until identified.
Synthetic Identity Theft
In this kind of identity theft, the stolen identities are either partially or completely forged to make a new document with fake details. It is mostly used by the criminals who combine the fake credentials with the stolen ones thereby, legitimizing a part of this document and using it to apply for a loan, obtain a duplicate license, apply for credit, etc. They can commit various kinds of frauds with this new fake identity and also there are fewer chances of it being detected this way. This theft affects both the person whose identity was stolen and the creditors or banks that gave loans to these thieves.
Identity Theft in Filing Taxes
The thieves steal the personal information of a person to file tax returns with his details or they can steal the identity to use his name for receiving tax returns and other benefits. This is not a very popular form of identity theft in India however, it does create a lot of troubles for the victim and his family as the thieves can meddle with all forms of taxes and not just focus on the individual ones.
Medical Identity Theft
In today’s time, the medical services opted by the people are accessed online when required. Stealing information like medical records and using the identity to acquire the health care services of that person is a common form of identity theft. They can avail of all the medical benefits from that stolen identity. This kind of theft turns dangerous when the thieves use the identity to get the prescription of certain drugs that are needed for illegal activities. Due to the introduction of online prescriptions, it becomes easy for the criminals to get the drugs that they want without getting detected. This also happens among families when someone has a drug addiction or has to cover a medical emergency without letting the other members know.
Employment Identity Theft
An employee gets certain benefits from the place he works at and after committing an employment identity theft, the thief can also avail of these benefits. Moreover, thieves can steal the social security number of that person to apply for jobs. It can also give access to all the information that the person holds regarding the company he is working in or his job. Mostly employment identity frauds happen to employees who hold a high rank or hold sensitive and private information about some project, deal, or business that the criminals are interested in.
Child Identity Theft
This involves stealing the identity of a child or a teenager and using it for some illegal gain. Child identity thefts are popular as criminals use the identity to create new lines of credit. They are an easy target and quite approachable. Among teenagers, such theft can also take place to destroy someone’s image or extract sensitive information that will negatively affect the reputation of the individual and his family.
Ways in which it can Happen
There are different ways in which an identity can be stolen by the thieves. The method that a criminal uses to steal, depends on the type of information that he wants to gather or the type of person he is stealing the information from. The common methods of Identity Theft are as follows-
Phishing and Email Scams
Phishing refers to the process of gathering personal and professional information by sending deceptive emails to the recipient. The recipient is made to believe that the email sent is from an authorized source thereby fooling the recipient to open that email. This is the most common method used by criminals to steal identities and information. It is also quite easy as people frequently open their emails, especially emails from work.
In this method, the identity and personal information can be stolen through text messages sent to the receiver. The message sent is designed in such a way that it influences the receiver to open it. It can be in the form of an offer that would be valid only for a short time, a lottery, or some damage in the phone that needs instant repairing. By using these techniques, the criminal fools the receiver and directs him to either a link or a phone call. Once the instructions are followed, it becomes extremely easy for them to steal the available information.
As the word suggests, ‘Vishing’ is a combination of Voice and Phishing which means that this method uses phone calls to steal the required information. The thieves usually make fake caller IDs and profiles that seem legitimate to call a person and place an offer in front of him or a query that needs immediate attention. Once the caller is fooled, they get the information that they need and change their number for the next call so that they do not get identified. In rural areas of India, this method of Identity Theft is quite popular and the thieves make a lot of money through fake phone calls. They take advantage of a lack of awareness among the rural population regarding the safety of bank accounts and false lotteries. The victims are mostly elder people who lack knowledge of Identity Fraud.
In the method of Pharming, the thieves scam the computer user by first installing malicious code on the personal computer of the server and then misdirecting the users on the fraudulent website which looks quite real to the user. This is done without the knowledge or consent of the user and he submits all the information to the hacker thinking it to be a real website. Thus, the thieves grab personal and financial data by disguising the websites as original.
Hacking is the use of someone else’s computer without his knowledge or consent. The cybercriminals hack into the computer or laptop of the victims and retrieve all the information. They can also control the activities of the user as long as the user remains hacked. In many cases, the criminals can hack the accounts of the user thereby getting all the private information of his life as well.
Credit Card Skimming
In this method, the criminals use a small device known as the skimmer to steal the credit card information of a person while the card is in possession of its owner. When a person mistakenly swipes his credit card on the skimmer then all the essential data stored on the magnetic strip of that credit card like the credit card number, expiry date, the full name of the cardholder, etc. is captured by the skimmer and this information is used by the criminals to withdraw cash, make fraudulent transactions and other illegal activities. The criminal can also make a cloned credit card with the help of the skimmed information and use it as he wants. Apart from skimming, a hidden camera in an ATM booth also does the work.
Often the cybercriminals make use of unsecured websites to gain access to the user’s personal and financial information. The users are influenced to open these websites and fill out their details which are then received by the hackers. The websites marked ‘Http’ are not secured as compared to websites marked ‘https’. These websites can also open when the users click on certain advertisements that pop up on their computer.
Malware refers to malicious or corrupt software that gets installed on the computer of the user when he clicks on an unauthorized link or downloads any movies or games for free from an unknown source. These links and downloads are a way to trick the users into opening a website or a link that directly installs malware on the computer which then helps the criminals to hack into the computer and fetch all the essential personal details of the user.
The thieves create false advertisements like the user has won an iPhone or the user has won a cash price to lure the users into opening the link which either asks for the personal information of the user to avail the offer or installs malicious software that gives the thieves access to the user’s computer. These advertisements are designed in a specific manner to attract the user and trick him into giving all the required information.
Most of the victims are not aware of the possible signs that act as indicators of an identity threat taking place. One should keep a check of any possible signs of warning as it can later become a huge threat to the person. These signs are as follows-
- A warning or notice from either the bank or the service provider.
- Verification calls from the bank or the service provider.
- Warning messages online regarding an undetected virus on the computer.
- Messages saying ‘site not secure’.
- Credit report showing unexplained entries.
- Small amounts being debited from the bank account at short or regular intervals.
- Showing unidentified purchases on the card statement which have not been authorized.
- Receiving a statement or a bill for a service or a product that has neither been purchased by the identity owner nor used by him.
- Caller applications marking the suspected calls as a scam.
How is Family Identity Theft Different
We read about the common types of identity thefts that take place in our country however, Family Identity Theft is different from the others. Although it involves stealing the identity of a person and obtaining all the personal as well as professional information of that person, the difference lies in who commits this theft? While in the common types of identity theft, there are cybercriminals, hackers, or thieves that steal and commit fraud, in family identity theft it is the family members that steal the identity of another member for personal gains. since family members share a close relationship, it is easy to extract the required information and also no one detects the family first when the theft comes to the knowledge of the victim. This might not be a common kind of theft but it is surely a growing threat to the families because when the member who committed the theft gets caught, it causes mental and emotional distress to the other members especially the victim.
The forms in which family identity theft take place are as follows-
Use of an Elderly Person’s Identity
An elderly person of the house has his financial statements, credit cards, bank accounts, health facilities, and other benefits that he has earned during his working period. Once such a person retires or is taken care of by another adult member of the family, the elderly person does not lose his money or his data. Access to such data or passwords to his computer and mails are available with the adult member taking care of the elderly person and such a member can take advantage of his close relations to obtain some personal information or money from the elderly person. He can easily commit identity theft for his gains and also cover his steps so that his actions are not detected. For example- a grandparent being cared for by one of his sons who wants to use his credit card to make payments can commit identity theft controlling the grandparent’s mails and other communications.
Use of Spouse’s Identity
A married couple shares a close relationship where mostly both of them are aware of each others’ passwords to emails and bank accounts and other private folders. They also share personal information which only makes spousal identity theft easy and convenient. A spouse can steal the identity of the other spouse to obtain information that helps him or her to open new credit accounts, withdraw cash, make purchases or payments in the name of others. Many times this kind of identity theft is ignored as it is regarded as a matter between the husband and the wife. However, it indeed is a form of identity theft which can be reported as an individual’s identity is independent even after marriage and no one has a right to use it without consent or knowledge.
Use of Sibling’s Identity
Brothers and sisters share a special bond where they know every personal information about each other and if not then it is quite easy for them to guess. Siblings who are of a similar age are more likely to know the passwords to emails and computers and also they know which details can be found where and how. Financial, medical, employment, and criminal identity theft can take place among siblings. Some seemingly innocent forms of identity theft can also take place among siblings like the younger brother stealing the identity of his elder brother to buy alcohol or get entry into a club as he is underage.
Use of Child’s identity
Families have children under the age of 18 who cannot get access to credit cards, obtain loans, or any form of money without the consent of their parents. However, it is known to the family members that after attaining the age of 18, how much credit a child will have thus, a few identity thefts take place before the child turns 18 but this child or his parents get to know about the theft only after he has turned 18 and starts using his credit cards, bank accounts, and other benefits.
Impact on Families
The consequences of identity theft can be physically, psychologically, and economically depressing for the victim. He can lose his identity, his reputation, his money, his personal details, and other records that are online. When cybercriminals, hackers, and thieves steal the identity of an individual, it poses a threat to his family. Impact of identity theft on the families can be of two types- one where the families are affected due to a theft or identity fraud committed by criminals or thieves and the other are the consequences faced by the family members due to identity theft committed amongst the family. This impact is as follows-
Consequences of Common Identity Thefts
- It makes the victim and the family members emotionally unstable.
- They feel threatened and violated.
- They feel angry, helpless, and scared as the family members cannot help the victim.
- Threatens the reputation of the family members of the victim.
- The families lose a lot of benefits that were available to them.
- It creates financial problems for the families as a lot of money is stolen by the criminals.
- They also take the money that is kept by the families for future use affecting the retirement plans and education of the children.
Consequences of Family identity theft
- The credit score gets lowered which makes it harder to obtain new forms of credit. Further the rate of interest increases, the credit lines get lowered and also affects the chances of the individual to get a job.
- The relations with the creditor are bound to suffer because when someone steals the identity of a person to open a new credit card, the company needs the charges of the card paid. The collection agencies have the power to file lawsuits for the recovery of funds. It is on the victim to prove that his credit card bills are a result of identity theft else he has to make the payment.
- Both the victim and his family suffer from financial losses. Losing money is the biggest threat to families today and while the families have to face financial difficulties, the thief walks free with the money obtained.
- Such an identity theft can not only make the victim lose his tax refund but also, can lead to the payment of higher tax bills. If the identity thief finds a job with this stolen identity, the person will just have to pay more income tax.
Steps for Recovery
Regardless of whoever committed the identity theft, all the victim knows is that his identity has been stolen along with most of his personal information thus, he needs to take immediate action to discover the theft and how to protect his privacy from getting invaded by the thief. When the thief has been identified as a family member the recovery process becomes easier but it significantly destroys the relationships among families. After an identity theft, it is suggested to report it instantly and try to follow a certain procedure to safeguard the information of the victim. The steps of recovery are as follows-
Review the credit reports that are received annually by a person. It is important to check the reports so that any items that cannot be recognized or any credit lines that do not open indicate identity theft. The victim should make sure that he fixes the errors in the credit report.
Immediately the passwords to all the online sources of the victim should be changed and this time the password should be a combination of letters, numbers, and symbols so that it is strong enough to not get hacked. Also, there should be some variation in all the passwords that are being changed to improve the security of the accounts.
The victim should freeze all his credits by contacting all the credit bureaus preventing them from opening any new credit lines in his name. After the situation has been tackled, the companies can unfreeze the credits by paying a small fee for the same.
Place a fraud alert on all of the credit reports of the victim so that all the potential lenders can be careful if they come across someone who is using a stolen identity to open new credit lines. Contact the creditor and the bank so that they can handle it when someone arrives with a lot of money.
Remedies for Family Identity Theft
It may seem obvious that for theft of someone’s identity and information, the criminal should be sentenced to some form of punishment. However, in cases of identity theft, people can choose some other forms of punishment as well. It depends upon the victim who suffered the losses. The remedies are as follows-
Reporting it or not
In many cases, the victim decides not to report the incident of identity theft. The reason behind this can be reputation. The victim and his family might feel threatened and reporting the theft can also affect their image or in some cases, it might affect some important deals in business as well. The other reason can be family identity theft, that is when one of the family members commits the offence and steals the information for personal gains, the victim decides to keep the matter in the family itself. They can resolve the situation by talking and asking the thief to pay the victim back. They can also draw basic contracts writing the terms of repayment. The victim might forgive the thief asking him to not repeat the act. Keeping the situation private is done so that the relationship between the family members is not ruined.
Civil law as against the criminal law does not offer jail time or punishments for the thief; instead, it asks for damages that are compensation for the loss that the victim and his family suffered. If the victim decides to report the matter however, the thief is a family member or a close relative then punishing him or sending him to jail can seem a bit harsh. In this situation, the victim can file a civil lawsuit to force the thief to compensate or help recover the damages incurred.
Filing a police report initiates the criminal justice process where the victim can get compensated for his loss and the thief gets punished for his offence. The victim needs to understand that filing a criminal suit means he has no control over the investigation and the charges against the criminal. If found guilty, the Court can order restitution that is compensation and the convicted person can face probation, fines, and jail.
Laws for Identity Theft
Since identity theft is constantly increasing and becoming a threat to families as well, the Government of India has decided to take certain measures to protect the people from cybercrimes and also ensure the privacy of the citizens is not threatened. According to the government, there are two ways in which identity theft can happen-
- Wrongful collection and stealing of personal identity of an individual.
- Wrongful use of the personal information of an individual with the intention of causing legal harm.
Identity theft is a crime that involves both theft and fraud therefore, the provisions provided under The Indian Penal Code, 1860 (IPC) is often invoked along with the Information and Technology Act, 2000.
Some of the sections of the Indian Penal Code such as Forgery under Section 464 of IPC, Making False Documents under Section 465 of IPC and Reputation under Section 469 of IPC can be coupled along with the Information Technology Act.
The Information and Technology Act, 2000 deals with the legislation in India governing cybercrimes. The sections dealing with Cyber Theft are as follows-
- Section 43– punishment by way of penalty and compensation for damage to computer.
- Section 66– Computer-related offences.
- Section 66B– Punishment for dishonestly receiving stolen computer resource or communication device.
- Section 66C– punishment for Identity Theft.
- Section 66D– punishing a person for cheating by impersonating another through a computer resource.
Two new sections have been incorporated by the Government in the Indian Penal Code, 1860 which are-
- Section 147A– deals with cheating by using any unique identification feature of any other person shall be punished with imprisonment for a term that may extend to 3 years or with fine or both.
- Section 419A- deals with cheating by impersonation using a network or computer resource shall be punished with imprisonment for a term which may extend to a period of five years or a fine, or both.
State of Tamil Nadu vs. Suhas Katti
The case of State of Tamil Nadu vs. Suhas Katti is an important case of cybercrime and cyberlaw as this is the first case filed under Section 67 of the Information and Technology Act, 2000 related to posting obscene, defamatory, and annoying messages about a divorced woman in the Yahoo message group. The accused was a known family friend of the victim who was interested in marrying the victim. She, however, married another person and after this marriage ended in a divorce, the accused started contacting her once again. The victim was reluctant to not marry the accused which is why he harassed her through the internet to defame the victim. He not only forwarded emails to the victim to gather personal information about her but also, opened a false email account on her name which he himself controlled. The posting of the defamatory and obscene material online led to annoying phone calls to the lady in the belief that she was soliciting.
In February 2004, the woman filed a complaint in the police department reporting the matter and the police arrested the accused in a few days. The defense had argued that the demeaning emails could have been sent by the ex-husband of the complainant or the victim herself to convict the accused as the accused alleged that he was the one who turned down the offer of the lady. Further, the defence pointed out that some of the documentary evidence was not sustainable under Section 65 B of the Indian Evidence Act.
The Court, however, relied upon the expert witnesses and other evidence that was produced before the Court including the witnesses of the Cyber Café owners, and it was concluded that the crime was indeed committed by the accused.
The accused was found guilty of offences under Section 469, 509 of the Indian Penal Code and Section 67 of Information and Technology Act, 2000. He was also sentenced for the offense to undergo Imprisonment for a term of 2years under Section 469 of the Indian Penal Code and to pay a sum of Rupees 500. This judgment came at a relatively quick time of 7 months after reporting to the police.
The Bank NSP Case
In the Bank NSP Case, a management trainee of the bank was engaged and was going to get married. The couple used to exchange a lot of emails using the computers of the company. After a while, the two broke up and it was seen that the girl created a fraudulent email id with the name ‘India Bar Associations’ and sent annoying emails to the foreign clients of the boy. Since she had been close to the boy, she had business information about the boy and the details of his clients. She used the bank’s computer to send these emails. This resulted in a loss of many clients of the boy’s company and the company took the bank to the Court. The bank was held liable for sending the email through its server.
Nasscom Vs. Ajay Sood And Others
In the case of National Association of Software and Service Companies (NASSCOM) vs. Ajay Sood and Others, ‘Phishing’ was described as an illegal activity on the internet involving an injunction and recovery in the form of damages. The plaintiff, in this case, was the National Association of Software and Service Companies (NASSCOM) which is India’s premier software association. The defendant was the placement agency that was hired by NASSCOM for headhunting and recruitment.
It was alleged that the defendants had sent emails to third parties in the name of NASSCOM itself to obtain confidential information that could be used for headhunting. Phishing was described as the method to obtain personal data and details by impersonating someone else in the form of sending emails for personal benefits. In this case, an internet fraud that is Phishing was committed as the agency pretended to be NASSCOM and tried to withdraw personal information from the customers such as passwords, access codes, names, etc. so that it could help them in their headhunt.
The Court ordered a committee to be set up that could look into the premises of the accused agency and the committee found two hard drives from which the emails were sent by the agency to the customers. The emails found were offensive in nature and the committee downloaded them to be held as evidence. The accused had used different fictitious identities to avoid getting recognized or caught. Later the defendants admitted their guilt and both the parties wished to settle the dispute through a compromise. The accused had to pay a sum of Rupees 1.6 million to the company for the damages and violation of the trademark rights.
This case is quite important in the history of cybercrime as it highlighted the method of Phishing as an illegal internet crime and proves that any person who violates Intellectual Property Rights will have to pay damages. The case restored faith in the judiciary and showed that cybercrime is open to new suggestions.
How to Prevent Identity Theft
Identity Theft takes place because of the loopholes in digital technology that hackers and the criminals take advantage of. However, if the users of this technology are cautious enough then these thefts can be prevented from happening. The various steps through which an individual can be protected from Identity Theft are as follows-
- All the personal and professional information that is stored online on the computer, laptops, and phones should be password protected. All the digital accounts made by the individual like social media accounts- emails and Facebook, etc., financial accounts like bank accounts and credit cards and other business accounts should only be made accessible to the owner and not anyone else thus, they should be protected by a password.
- The password used to protect the online networks and digital accounts should be strong so that it cannot be hacked easily. The criminals are smart and they understand the basic psychological nature of humans of keeping passwords of either their birthdays or their loved ones which makes it easy to hack the passwords. To create a strong password, one must combine letters with numbers and symbols.
- One must not give away any personal or important work information to anyone without proper verification of the website, company, or person asking for these personal details.
- Monitor all the financial transactions that take place in the accounts of an individual. One must not ignore the warning signs that are received in the form of messages, calls, or online pop-ups as they are primary indicators of Identity Theft.
- More awareness should be raised regarding Identity fraud and online theft. The people should be explained how identity thefts take place and how one can prevent them. Warning notices should be spread by the government telling people to safeguard their personal information and if they receive calls, messages, or offers from unknown sources, they should report it immediately and not respond.
Identity theft is a huge invasion of privacy for an individual which affects the victim both mentally and socially. But the impact of identity theft is not limited to the individual, it also poses a threat to the families of the victims. Then there are cases where the theft is committed by one of the family members which then raises a question on the values of the family as a social institution. A family is built on the foundation of trust and criminal activities such as fraud and theft destroy this foundation thereby threatening the core of this institution. Similarly, when a family member becomes a victim of a theft that could be either personal or financial, the whole family has to suffer as it can damage the reputation of the entire family and also cause financial losses to them. In order to put an end to these cybercrimes and protect the privacy of the families, every individual should stay vigilant and follow the necessary steps for preventing Identity Theft.
LawSikho has created a telegram group for exchanging legal knowledge, referrals and various opportunities. You can click on this link and join: