evil-looking character using innocent-looking sock puppet

You don’t know who you’re really talking to on the Internet — and anyone can pretend to be you

Summary

Creating an identity on the Internet or impersonating somebody else is often just a matter of a few clicks. Currently, there is no foolproof way to match a real person with their online identity. This means that you can never be sure who you are talking to, and that someone could steal your identity and impersonate you!

Overall Advice

Before you share any information online, consider the risk if the other party was not the person you thought they were.

Case Study 1: Identity Can Be Forged

A Real-World Example

Scammers use fake package tracking text to coerce credit card information out of unsuspecting users (FOX43): Scammers sent fake text messages to people saying that a FedEx package was on the way and that they needed the person’s credit card information to pay for shipping. Unsuspecting users were tricked into giving up their credit card information. Due to the nature of the crime, law enforcement officials were unable to identify the culprits.

Here’s How It Works

On the Internet, malicious people can pretend to be your friends or relatives, or official representatives. They can also pretend to be you, and use your identity to trick sensitive information from your loved ones. On the Internet, we often trust people’s identities, even when the information we see is limited to just a name, an email address, and perhaps a photograph.

Unfortunately, each of these identifiers is easily forged. Names can be made up, email addresses can be faked, and photos can be copied and edited. Most social-networking sites lack a solid mechanism to verify identity, making it easy to create a fake one. Furthermore, passwords can be guessed or stolen, and accounts can be broken into through “password recovery questions”; this means that anyone can use that account and thus assume your identity.

What You Can Do About It

Customize the Technology:

  • Don’t open attachments and links from unknown senders. Make sure your email program scans all attachments you do open for viruses. Use anti-malware software and keep the software up to date. Anti-malware software scans for and removes malicious programs from your computer, such as viruses and spyware.

Use Your Imagination:

  • Be wary if anyone asks you for identifying information or an account password by phone, email, or instant message; most legitimate services would never contact you out of the blue and demand you verify your identity in this way. Don’t respond to the caller on the phone or by replying to the message. Instead, directly contact the Help or Customer Service department to ask about the issue. You can use the contact information on the service’s public website or on the back of their card.
  • Make sure you can verify that people are who they say they are. For example, if a friend contacts you on social media asking for money, perhaps try calling them to confirm.

Put Safety First:

  • Do not accept friend or connection requests from strangers on social media. If you are meeting with someone that you only know through online communications, suggest a public, well-trafficked area to meet up. Also try to go with friends or a group rather than going alone.

Case Study 2: Identity Can Be Stolen

A Real-World Example

Criminals are using ‘Frankenstein identities’ to steal from banks and credit unions online (CNBC): Criminals craft a fake identity using stolen social security numbers, fake names and birthdays, and other personal data, to defraud lenders. They use these synthetic identities to apply for loans at various banks, then never pay them back. This type of fraud is estimated to cost U.S. banks approximately $6 billion a year.

Here’s How It Works

Identity theft is another way you can lose control over private information, either by someone breaking into your accounts, or by being coerced by someone with a false identity. Identity theft can frequently occur on social platforms such as online forums. The elderly are often targeted for such attacks because the thieves assume they have significant retirement savings. Do not accept arbitrary friend requests or invitations to connect, and don’t share important information (such as contact details, numbers from your identifying documents, passwords, etc.) if you cannot be sure of a person’s identity.

What You Can Do About It

Use Your Imagination:

  • Use secure passwords to ensure that your identity isn’t compromised! Secure passwords should be at least 8 characters long and contain a combination of lower-case letters, capital letters, numbers, and special characters.

Keep Account Information Secure:

  • Don’t disclose any information that can be used to verify identity, such as credit card numbers, birthdays, and social security numbers. Be especially careful with sensitive information like your social security number. It is relatively easy to get a new credit card number, but it is much harder to get a new social security number — or a new birthdate!
  • To the best of your ability, do not tell anyone your passwords for sensitive accounts, not even an IT representative! We recommend keeping your passwords in a secure “password manager” program, which can generate random passwords and store them. Most browsers have built in managers, or you could use third-party managers such as LastPass, DashLane, or Bitwarden.