Upload
lecong
View
213
Download
0
Embed Size (px)
Citation preview
PARIS & Identity Theft
Jessica Brinks
IP Locator Analyst
Michigan Department of Health & Human Services
Office of Inspector General, Investigative Analytics Unit
Ohio Identity Theft Case: Caught in the Act
u Mr. and Mrs. Smith move from West Virginia to Ohio to live with Mr. Smiths cousin,
Misty, who has 4 children, including a newborn
u Mr. Smith gets caught when Mrs. Smith finds out that Mr. Smith is the father
of Mistys newborn
u Mrs. Smith leaves Mr. Smith and returns to West Virginia
u Mrs. Smith applies for and receives assistance using the identities of Misty and
her children in West Virginia
u PARIS match occurs for Misty and the children between Ohio and West Virginia
u Mrs. Smith gets caught
Michigan Identity Theft Case:
Its weirdI actually believe her
u Started with a PARIS Interstate Match
u Client #1 receiving benefits in Michigan and Texas
u OIG Agent spoke to Client #1 who stated shed never lived in Michigan
u Agent found no other information to substantiate Michigan residence
u Contacted OIGs Investigative Analytics Unit for assistance
Client #1: Application Phone Number
Applications placed using 123-456-7891
Cases using 123-456-7891
IP Addresses of recipients using 123-456-7891
Michigans Internet Protocol (IP) Tracking
u IP Addresses are captured when someone visits MI Bridges
u Whether an:
u Application is submitted
u Or an individual checks on, or changes, some aspect of a previous application or current assistance case
u Michigan uses MaxMind to identify the location and the Internet Service Provider (ISP) of the matched IP address
u These two in combination are key to identify positive hits
u https://www.maxmind.com/en/geoip2-isp-database
u GeoIP2 City & ISP Databases
https://www.maxmind.com/en/geoip2-isp-database
Michigans Internet Protocol (IP) Tracking
u These IP addresses can be used to:
u Identify individuals who are applying from out of state (or country)
u Weve had someone apply from Turkey!
u Identify individuals who are students, but not reporting
u Individuals who have not placed an application, but have left the state and continue to check on their benefits
u Identify/link together Identity Theft/Identity Theft rings
u Identify recipients on social media
MI Bridges Account Information
u MI Bridges account information is captured when an account is created and/or information is updated by the individual
u Account Data:
u Username
u First & Last Name
u Phone number
u Email address
u Security Questions
MI Bridges Username Pattern 5522
If a username was forgotten, a second username
was created
First name & 5522
Last name & 5522
Partial name & 5522
Variations of 5522 552211 2255
Additional Connections: Email Addresses
It looks like you want to commit fraud.
Id recommend not putting your name in the
email address
Additional Connections: Physical Addresses
Multiple addresses were used
Recipients did not just stay at one address for the life of their case
Addresses were modified
PO Boxes sometimes looked like apartments
Customer Service Call: Receiving mail-PO BOX
Side Note: UPS P.O. BOXs
Initial Findings
u Over 120 recipients were found to be linked via a combination of:
u Phone numbers
u Email addresses
u IP Addresses
u Physical Address
u MI Bridges Username patterns
PARIS Matches
u Of the 120+ recipients, 14 hit on PARIS Interstate matches with the below states:
Alaska California District of Columbia Florida New Jersey New Mexico North Carolina Ohio Pennsylvania Texas Vermont
Suspect
Identified!Via: Email addresses Phone numbers Physical addresses IP addresses Facebook Store video footage Multiple subpoenas.
A Joint Operation
u Partnered with:
u USDA-OIG
u United States Department of
Agriculture-Office of Inspector General
u AUSA
u Assistant United States Attorney
Question #1: How do you find someone who is living as
someone else and constantly moving?
Answer #1:Facebook!
Question #2: How do you make sure theyll be home
when you serve your warrant?
Answer #2: Facebook & Hotels.com
http:Hotels.com
Findings of the Search Warrant
u List of 700+ stolen identities
u Names
u DOBs
u SSNs
u State of residence
u Employment information
u Banking information
u Background checks
u EBT cards
The Damages
u300+ Food Assistance applications using stolen identities
u$518,000+ in Total Fraud
Customer Service Call:When you cant keep track of where your card goes
The Outcome
United States v. Pamela TribbyCase No. 15-CFR-20497
u Plead guilty to:
u Identity Theft: 18 USC 1028(a)(4)
u Theft of Public Money: 18 USC 641
u Sentenced to:
u 70 months in prison
u 3 years probation
u Full Restitution of over $518,000
u Lifetime disqualification from Food Assistance
Structure Bookmarks12345678910111213141516171819202122232425