Identity Theft vs. Business Identity Theft
Almost everyone is familiar with identity theft. A criminal obtains your personal information, and uses that information to steal, leaving you to mop up your decimated credit. Business identity theft can also involve criminals using private business information to create fake financial accounts to defraud third parties. Not all business identity theft requires the thief to obtain your private business information or set up fake financial accounts. There is a growing trend of cybercriminals spoofing small businesses, using publicly available information to create look-alike or sound-alike businesses to steal customer information.
The Spoof and the Scrape
Spoofing involves criminals mimicking various aspects of a legitimate business to mislead people into providing the criminal with personal information. A criminal may spoof a legitimate company’s name, its trademark, its website, its advertising or any other public presence the legitimate business has. The criminal may steal, or scrape, the pictures, text and layout from the legitimate business’ website and post that information to a fake website. With a seasoned spoofer, it can be very difficult to distinguish the spoofed website from the real thing. The criminal may even set up a phone number using a local area code or a brick and mortar address to fool the small business’ customers. The criminal relies on lazy customers who might not notice the website they are visiting, or the yellow page advertisement they are reading is just a knock-off. Customers may contact the criminal, thinking it is the trusted business, and provide personal or financial information, that the criminal then exploits. The criminal may even offer to supply sub-standard goods or services under the legitimate company’s name.
Stopping the Spoofing
With ordinary identity thieves, freezing financial accounts usually curtails the ongoing damage. With spoofers, the ongoing damage may not be so easy to stop. Since spoofers are only using publicly available information, and are not using the legitimate businesses’ private information, or creating financial accounts using the legitimate business’ credit, it can be difficult to convince law enforcement to take action. As no private information is being used, law enforcement may view the spoofing as a civil matter, rather than a criminal one. Adding to the problem are privacy laws, that can prevent a legitimate business from finding out who or where the spoofing identity is. This forces the legitimate business to seek out an attorney with experience in this area to bring an end to the ongoing fraud.
Get Your Ducks in a Row
The best time to defend against business identity theft is before a problem arises. Be sure you have the appropriate trademark and copyright registrations in place. If you wait until a criminal starts spoofing your business identity and defrauding your customers, you may have to wait months to obtain a copyright or trademark registration. Registering your trademark prior to an attack allows you to sue in federal court, and to ask a federal judge to order any phone numbers and domain names associated with the spoofer be turned over to you. Registering your copyright prior to an attack and registering your Digital Millennium Copyright Act (DMCA) agent with the Copyright Office allows you to shut down any website using copyrighted material scraped from your website.
Time is of the Essence
As businesses become more adept at addressing existing criminal threats, criminals continue to innovate novel scams, stealing tens of billions of dollars every year. Many businesses are simply not prepared for a scam that law enforcement refuses to pursue. By the time an unprepared business takes remedial action, so many of its customers may have been scammed that the company may never recover from the long-term damage done to the company’s goodwill. Thwarting business identity spoofing theft is not as hard as it seems. Small business identity spoofers tend to prey on the weakest and least knowledgeable victims. Simply protecting your trademarks and copyrights, and indicating the protection on your website, may be enough to convince a cyber identity thief to pursue a less well-prepared and less knowledgeable victim.