Identities in the focus of cybercriminals

Digitalisation enables the handling of many processes in virtual space. For this, it is often necessary to securely record and prove the identity of the users at the beginning of a relationship. The organisational and regulatory requirements differ according to industry and area of application. Once authenticity has been established, it is assumed that users are authorised to receive services based on this proof.

Fake identities as a business model

The threat posed by the targeted theft of personal information and the misuse of user data is currently very hight. [1] Phishing campaigns are the classic way to obtain users’ personal data and thus gain unlawful access to digital services. Data can also be stolen by means of social engineering or manipulated websites. Usually, lengthy complications for both the person whose identity is misused and the organisation where the fraud was carried out under false pretences will follow. The criminals, on the other hand, simply use the next stolen identity.

ENISA study on forged identity documents

How do cybercriminals actually go about using stolen partial information to create valuable fake identities that are good and expensive to resell? In a study, the EU Cyber Security Agency analysed both procedures and possible countermeasures.

Identity verification usually takes place via a webcam or mobile device, where users have to show their face and present government-issued documents. Criminals have developed various strategies to trick these processes. Most often, they try to circumvent facial recognition by presenting photos, videos, three-dimensional masks or “deepfake” images of the actual person created with the help of computer programmes. [2]

Possible countermeasures for identity verification

Companies that carry out such identity verification need to revise their quality and requirement standards and, if necessary, improve them. Specifically, they need to pay more attention to ensuring that the video quality is sufficiently good. Additional testing of different viewing angles, movements or even random gestures help to verify if there is a “real” person in front of the camera. Besides, more verification documents need to be checked and matched more precisely.

Tips for protection against identity theft

Users should act according to the principle of data economy: Only transmit information that is actually necessary and relevant to third parties, and only do so via encrypted channels and under no circumstances via a simple e-mail. Only forward copies of ID cards if there is no other possibility of legitimisation. If necessary, add a clearly visible watermark or a note on the purpose of use. This will at least make it more difficult to distribute and misuse the documents. Regularly check your online accounts and payment data for indications of misuse and supplement strong passwords with multi-factor authentication wherever possible. [3] Together with the principle of data economy on social media as well, this will significantly minimise your risk.

Worth reading:

Secure communication: How to encrypt and sign your emails
Security tips to protect your data and devices

Sources: