Identity theft is a form of fraud in which someone pretends to be someone else by assuming that person's identity. Fraud is defined as the unlawful and intentional making of a misrepresentation which causes actual prejudice or which is potentially prejudicial to another. The purpose of identity theft is predominantly to access resources or to obtain credit or other benefits in the victim’s name. Identity theft may also be used to facilitate or fund other crimes such as illegal immigration, terrorism and espionage.
In South Africa, identity theft is rife for various reasons and is the white collar crime of choice because it is so easily done. In order to obtain employment in South Africa, one has to present an identification document. Foreign nationals often, in order to obtain employment in South Africa, resort to acquiring false ID documents. Because of the state of poverty in our country, many people use identities of others to claim social grants. Identity theft is also used by criminals to escape criminal prosecution and by people in need of medical aid. People also resort to forging death documentation in order to collect on life insurance policies or engage in ghosting, which is the assumption of the identity of a deceased person.
In the case of criminal identity theft, the identity thief poses as another person when apprehended for a crime. Provided the scam works, charges may be placed under the victim’s name thereby keeping the true criminal charge free. Victims usually only learn of such incidents by chance and it is then very difficult for the victim to clear his record. The victim would have to seek an expungement of court records but various data aggregators could collate the incorrect information, which would remain in their databases even after court and police records are corrected.
In the case of medical identity theft, personal and insurance information may be stolen to obtain medical services. This form of identity theft often results in erroneous entries being put into existing medical records, which may in turn lead to inappropriate and potentially life-threatening decisions by medical staff.
How identities may be stolen
Identities may be stolen in a number of ways. Today, the traditional methods of stealing personal information have been expanded to incorporate theft over the internet. Thieves may steal personal information obtained from your rubbish, computer, bank cards or public records, by the use of spyware, or hacking into computers. Thieves may exploit insider access or may themselves infiltrate organisations. Alternatively computer techniques such as phishing and pharming may be used.
Phishing is a technique used to acquire sensitive information, such as usernames and passwords, in an electronic communication. Usually the acquirer masquerades as a trustworthy entity. This is often seen in the context of banks. The thief sends an official looking email to the bank’s clients, pretending to be an email from the bank. The email requests that certain information be updated to continue with the service. The email usually contains a link to a different webpage that requires financial information. This webpage is usually the fake webpage that collates information from individuals that ought to be secure and private.
Pharming is an advanced form of phishing. It involves setting up a fraudulent website that contains copies of pages from a legitimate website in order to capture confidential information from users. Usually a computer hacker hacks into a server and redirects a legitimate website’s traffic to the fake website. An example of this is where the domain name for a large New York Internet Service Provider (Panix) was hijacked to a site in Australia in 2005.
What to do if you are a victim of identity theft
- Report the matter to the police;
- Contact the fraud units of all credit bureaus;
- Close your existing bank accounts and get new accounts and PIN numbers.
- Notify your creditors, close all accounts, including the accounts the thief has opened.
- You could also report the incident to South African Fraud Prevention Services (SAFPS) at http://www.safps.org.za
South African initiatives to prevent identity theft
The South African Department of Home Affairs is in the process of implementing the Home Affairs National Identification System (HANIS). This system aims to replace the current paper system with a digital database. HANIS holds the ID numbers, fingerprints and photos of South African citizens. HANIS can only work as well as those feeding information into it. If the levels of corruption are high within the department of home affairs, then false information can easily be fed into the system.
A partnership has been concluded between the South African Banking Risk Information Centre (SABRIC) and the Department of Home Affairs in terms of which the banks will be granted real time access to HANIS for the verification of the identity of prospective and current clients.
The project is being implemented in phases, with the first phase completed in 2009. The first phase proved the feasibility of online fingerprint verification. The second phase determines the prerequisites for implementing the system and the third phase estimates the costs involved for various stakeholders. A possible fourth phase addressing IT related issues is expected. It is hoped that this system will make it difficult for people with fraudulent identification documents to use them.
How to prosecute identity theft
In order to prosecute identity theft, some countries have created statutory offences while other countries prosecute the crime in terms of the common law of fraud. The USA prosecutes identity theft in terms of a statutory offence and South Africa prosecutes the offence in terms of the common law of fraud.
The USA has provided for a statutory offence in the Identity Theft and Assumption Deterrence Act. Section 1028(a)(1) and (7) of US Code 18 provides that where a person “knowingly and without lawful authority produces an identification document or a false identification document” or “knowingly transfers or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or constitutes a felony under any applicable State or local law shall be punished as provided in subsection (b) of this section”. The prescribed punishment, as stated in section 1028(b)(1) of US Code 18, for the above offences is a fine or imprisonment for not more than 15 years, or both.
In South Africa, identity theft is prosecuted in terms of the common law. A person guilty of identity theft may be found guilty of fraud, forgery and uttering a forged document, depending on the circumstances of the case.
The misrepresentation of identity may take the form of written or oral words or even conduct such as the nodding of a head to signify consent. The misrepresentation may furthermore be express or implied. Thus a person buying goods implies that she is willing to pay for the goods at that time or in the future. The misrepresentation may be made through a positive act or by omitting to disclose a fact where a legal duty exists to disclose such a fact.
The mere telling of a lie is not punishable as fraud. Actual or potential prejudice must be suffered. Potential prejudice means that the misrepresentation, looked at objectively, involves some risk of prejudice. There need not be a probability that prejudice will be suffered. A mere possibility is sufficient but it must be a reasonable possibility. The prejudice may be suffered by a third party and need not be suffered by the person to whom the representation was made. The fact that the person to whom the representation was made is not misled by the misrepresentation is irrelevant. The prejudice suffered also need not be monetary.
The person making the misrepresentation must be aware of the fact that the representation is false. Such awareness exists where a person has actual knowledge of falseness, and also where one has no honest belief in its truth or if one acts recklessly or carelessly with regards to the truth or untruth of a fact. In the case of identity theft, the thief will no doubt have actual knowledge of the falseness of his representation.
Forgery is the unlawful and intentional making of a false document to the actual or potential prejudice of another. This crime is complete the moment that the document is falsified and knowledge thereof by a third party is not required. Uttering a forged document is the unlawful and intentional passing off of a false document to the actual or potential prejudice of another. It is irrelevant whether the person to whom the document is uttered is misled by its falsity.
In terms of section 51 read with Part II of Schedule 2 of the Criminal Law Amendment Act 105 of 1997, certain minimum sentences are imposed for the offences of fraud, forgery and uttering a forged document where the amounts involved exceed R500 000. In the case of a first offender, the punishment is 15 years or more. In the case of a second offender, the sentence is 20 years or more and in the case of any subsequent offender, the sentence is 25 years or more.
Identity theft may be performed by syndicates. Should the members of such a syndicate be caught and their fraud involve more than R100 000, the same punishment as stated above applies to them.
