In case of an identity theft, an attacker pretends to be someone else, which means that they use information about another person in order to act on their behalf. For this purpose, data such as the date of birth, address, credit card or account numbers is used, for example, to log in to an Internet service provider at the expense of others or to gain another type of advantage. In many cases, identity theft also results directly or indirectly in damage to the reputation of those concerned, but also leads to huge amounts of time required to clarify the causes and avert adverse consequence for the victims. Some forms of identity fraud are also referred to as masquerade.

Identity theft occurs particularly often in cases in which identity checks are carried out carelessly, especially if expensive services are based on it.

A person who has been deceived regarding the identity of their communication partner may easily be led to disclose information requiring protection.

Examples:

• For different e-mail providers and auction platforms in the Internet, it was initially sufficient to made up an invented name and combine it with a suitable address from the telephone book. At the start, attackers could also register using an obviously invented name, for example using the name of a cartoon character. Once stricter plausibility tests were introduced, names, addresses and account numbers of real persons were also used for this purpose. The victims only discovered this when they received the first payment requests.
• The sender addresses of e-mails can be easily corrupted. Users are commonly deceived into believing that an e-mail comes from a trusted communication partner. Similar attacks are possible by manipulating the calling line identity presentation (CLIP) for voice connections or by manipulating the sender ID for fax connections.
• Attackers may use a masquerade to attempt to intrude on an already established connection without having to authenticate themselves, since this step was already performed by the original communication partners.

Powiązane zgłoszenia

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)