This has come up twice that I’ve seen in relation to the Equifax breach. I suppose we must be overestimating the ease with which it can be done on a large scale, even with scripts, but is that really why we haven’t seen a million people or more have their accounts drained of cash at roughly the same time, especially since I understand that the info can be bought in bulk?
The IRS says almost 700,000 taxpayers complained they’d been victims of identity theft in 2015. By that, I’m guessing they mean someone filed a false tax return in their name.
Not 1,000,000 but certainly enough to call it large scale. It happened to me, so it’s large enough!
I was thinking about this the other day, and I thought: “At some point, if you steal everyone’s information, it’s effectively like you stole no one’s information”. Even the most ambitious criminal can’t fake 150,000,000 transactions, can they? At least, not all at once.
It’s not going to be so much a matter of people having their accounts drained as it will be having credit accounts created with their information that are used for fraudulent purchases. As well as the IRS identity thefts shown by kunilou. I’m betting there will be a significant spike in those when the IRS gets around to releasing the figures.
ETA: You’ll probably find them being sold off in lots of 10 or 100 thousand on the dark net to criminals who will then set up the fraudulent accounts. It’s not likely to be one group processing the whole pile.
I would not be surprised at all if we find out within a few months that the ‘hack’ was actually the work of Vladimir Putin’s "patriotic’ Russians. I’ve been fearing this for a while now. As it is with the election hacks, the Russians didn’t necessarily want to inflict pain at this moment, they just wanted to let us know that they could whenever they want to.
Or maybe Chinese hacks just to keep up with the Russians …
Stealing money electronically is tricky. You need to get cash, which is hard to do for a million accounts at the same time, or goods, ditto, or transfer it somewhere, which leaves a trail.
It’s much easier to sell the credit card information to people who then use it to do smaller scale identity theft than it is to organize a massive heist. It also means you aren’t the single target of a big investigation. (Which the Equifax perpetrators already are, of course, but using the information would give the investigation more leads to work with.)
I think part of the reason they don’t make The Big Haul is that they don’t want to push it to the point where someone will decide that maybe the problem should be eliminated permanently. Several thousand low-to-middle class individuals are very unlikely to band together to do anything, but if major corporations are hit for too much, they might hit back.