01 February, 2003
category: Biometrics, Library
A growing problem globally and on our campuses
Capt. David Myers has seen his share of fake student ID cards, counterfeit drivers licenses and fraudulent credit cards. He and his four officers are members of the elite Fraudulent Identification Unit of Florida’s Division of Alcoholic Beverages and Tobacco. It’s a unit that’s so good it is used to train even the FBI in how to spot bogus IDs and credentials.
In a two-year span Captain Myers conducted training for more than 200 different law enforcement agencies. He has spoken at numerous conferences and has testified before the U.S. Congress.
Why all this attention? It is certainly due in part to the fact that Florida sees a lot of fraudulent IDs because of its reputation as a haven for spring breakers. Last year alone, his office collected 20,000 fraudulent cards. Florida is also is a mecca for those seeking to make a lot of money off fraudulent bank cards and other IDs.
“I have four agents assigned full time to investigate those who sell fraudulent IDs, university cards, passports, etc.,” says Captain Myers. He has a well-equipped lab at his Tallahassee, Fla. office that includes “any equipment that might be used to test ID documents,” he said.
“We also test electronic scanning devices” and he adds there are now skimmers (instruments used to capture credit card numbers without the customer’s knowledge) that can transmit the numbers to a vehicle waiting outside the establishment.
“Anything you put on an ID card or smart card we can counterfeit. You can get blank (smart) cards off the Internet for $6 to $10 apiece,” and, he adds, nearly every other piece of ID counterfeiting equipment.
“It’s all legal until authorities make it illegal,” he said of the Internet sales of ID components. A statewide grand jury in Florida, meeting on ID theft and fraud, recommended earlier this year that the state Legislature enact laws to make this process more difficult for the counterfeiters.
“A couple of years ago when Florida came out with its new driver’s license (with a hologram) there is small printing in the state’s outline that they said was too small to copy. Well, guess what. I have some counterfeit licenses and that printing is in there.”
So it is clear from Captain Myers experience that ID cards are prone to counterfeiting. But how common is this practice for college and university IDs? Simple cost-benefit analysis would suggest that other cards are likely more attractive targets for counterfeiters. Bank cards could yield many thousands of dollars in fraudulent purchases and drivers licenses are more official documents for identification purposes.
So it would seem that student IDs are less likely to be counterfeited. But we have often pointed out in this publication the authentication chain whereby a lower form of identification is used to gain a higher form (e.g. campus card used as one form of ID in the process to obtain a drivers license). And, as the uses and financial opportunities available via campus cards rise, the attractiveness to fraudsters increases. The following examples layout levels of fraud that are occurring with campus cards. While these cases are not yet commonplace, neither are they isolated occurrences.
Instances of campus card fraud
Just this week, an example of just how real counterfeiting of campus ID cards has become came to light in Boston. A student at Boston College was arrested and charged with intercepting student ID numbers and account personal identification numbers (PINs). Using this data, the student was able to gain access to secured facilities and steal money from card accounts.
But is this common? More common, certainly, are cases like that of the North Carolina State University student who was arrested for using another student’s ID card to make purchases in campus vending and laundry machines. This crime, while seemingly minor, is likely more common than any would suspect.
If this is the least sophisticated type of campus ID fraud, the next step up would be the case that occurred last fall at Rice University. A man came into the campus security office requesting a new ID and produced a badly worn ID that was illegible. The man provided a valid ID number and was issued a new card with his picture. The valid number was, in actuality, a number assigned to a prospective student. Using this fake Rice ID, the man obtained access to dorms and restricted buildings, ate in the cafeteria, and even walked on to the University’s track team. He was not caught until he went to an administrative office to complain that his card was not working properly. He was charged with theft for the meals that he consumed using the fake card.
So we must contend with stolen cards as in the North Carolina State case and with cards obtained through fraudulent means as occurred at Rice, but the Boston College case takes campus ID fraud to a new level of sophistication. The student at BC actually stole PINs, bought sophisticated equipment, and re-encoded magnetic stripes with information stolen from other cardholders.
How did he do it? To begin, he loaded special software onto public access computers on the campus. This software tracks and logs all keystrokes entered at the computer. While the specific software used to track the keystrokes has not been named, several commercially available products can accomplish this task.
Next, he accessed these logs and extracted individual identifiers such as card ID numbers, PINs, and SSNs. With hardware purchased from the Internet, he re-encoded his real Boston College Eagle Card with stolen card ID numbers.
By encoding a faculty or staff ID number onto his magnetic stripe, he was able to obtain access to a variety of secured facilities. By encoding student ID numbers he was able to make purchases at the bookstore, dining hall, and laundry facilities. Because he had stolen PIN numbers to match the ID numbers, even PIN-protected locations were within reach. According to the Massachusetts Attorney General’s Office, the man made more than $2,000 in fraudulent purchases. Charges are pending.
Conclusions
Campus administrators must recognize that fraud surrounding ID cards is a very real problem. It is essential that steps are taken to deter fraud, identify it when it occurs, and take action against offenders. ID theft and counterfeiting, like all forms of fraud, is more easily prevented before it occurs than prosecuted after it occurs.