PIs Selling Phone Records Sued By The FTC

carl writes "According to an MSNBC article, the FTC has sued five different background investigation firms for selling confidential phone records." From the article: "In the lawsuits announced Wednesday, the FTC charged the companies used 'false pretenses, fraudulent statements, fraudulent or stolen documents or other misrepresentations, including posing as a customer of a telecommunications carrier' to get the phone records. The companies advertised on their Web sites that they could get the confidential phone records of any individual and make them available for a fee, the agency said."

Re:PLS...

[Kapsar]

private investigators

You can't really secure against social engineering

[necro2607]

Heh, social engineering is a technique that essentially all humans are vulnerable to. Also, phone companies are actually one of the top targets of social engineering. That combination makes for a pretty high likelihood of peoples' phone-line-related data to be effectively public domain...

There isn't really much way to be "secure" against social engineering because it exploits the one system you can't secure - the human mind. I know people who do this sort of stuff (I don't mean theft though heh) for fun on a fairly regular basis and they can all screw with pretty much any person. It's really amazing how easily you can manipulate someone of any personality type, actually. heh.

The only people who I've found to be highly resistant to any sort of social engineering are the type of people who know how to do it as well. It requires a certain mindset to be able to catch on to when a person might be trying to manipulate you. Unfortunately that sort of mindset usually involves always having a certain amount of suspicion towards peoples' statements all the time...

Some reading material:

http://www.securityfocus.com/infocus/1527 [securityfocus.com]

http://www.morehouse.org/hin/blckcrwl/hack/soceng. txt [morehouse.org]

http://www.kuro5hin.org/story/2004/6/3/223758/2267 [kuro5hin.org]

http://rf-web.tamu.edu/security/secguide/V1comput/ Social.htm [tamu.edu]

etc. etc..

Re:Selling private information?

[brjndr]

Under the Free File Disclosure Rule of the Fair and Accurate Credit Transactions Act (FACT Act), each of the nationwide consumer reporting companies -- Equifax, Experian, and TransUnion -- is required to provide you with a free copy of your credit report once every 12 months, if you ask for it.

The three nationwide consumer reporting companies are using one website, one toll-free telephone number, and one mailing address for consumers to order their free annual report. They are:

www.annualcreditreport.com
1-877-322-8228
or complete the Annual Credit Report Request Form and mail it to:
Annual Credit Report Request Service
P.O. Box 105281
Atlanta, GA 30348-5281. (The form is at ftc.gov/credit)

Under federal law, you're entitled to a free report if a company takes adverse action against you, such as denying your application for credit, insurance, or employment, and you ask for your report within 60 days of receiving notice of the action. The notice will give you the name, address, and phone number of the consumer reporting company. You're also entitled to one free report a year if you're unemployed and plan to look for a job within 60 days; if you're on welfare; or if your report is inaccurate because of fraud, including identity theft. Otherwise, any of the three consumer reporting companies may charge you up to $9.50 for another copy of your report within a 12-month period.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Buy Instead

[The Angry Mick]

Your Government's surveillance programme hates competition.

But they do love shopping in a free market:

FBI buys illegally acquired phone records for investigations [arstechnica.com]

Re:Don't forget

[Anonymous Coward]

I do consulting work for some private investigators, and have a fairly good handle on this as a result. PIs can get at a lot of data online, usually with a simple (paid) database search. The good database vendors verify that the PI has a valid license before granting access, and typically charge a dollar amount per search. Results are mostly public record: property ownership (house, vehicle registrations, etc.), outstanding warrants, convictions and similar. It's also trivial to obtain credit reports from offshore credit reporting groups (who, by being offshore, don't have to comply with US privacy requirements).

Offline, you do see PIs using social engineering to get phone records and other data - but there is enough concern over the legality of this process in the PI community that many PIs stay away from this.

That said, in probably 90% of the cases I've seen, the useful data is obtained the old fashioned way: through subpoenas (issued as part of a case for which the PI is doing investigative work), going through suspect's trash (it's public property if it's out on the street), tailing/observation, and interviews.

It's amazing what you can find in people's rubbish; most people don't shred phone records, bank/credit card statements, and other personal data. A PI, just like an identity thief, can benefit from this. You just need to be able to stomach handling refuse, which is often quite unpleasant and malodorous.

There is a strong debate in the PI community about who the results of searches should be given to. No PI (I hope! Certainly no PI I've conversed with) wants to assist a stalker or other miscreant. In some cases it's relatively clear cut - they are assisting an attorney or law enforcement with an investigation, and the results will be given the same confidentiality as other evidence obtained in a case. In others it may seem clear cut, but suspicions may arise regarding the motives of a client - at which point the hard decision has to be made between not getting paid, and potentially (without solid evidence) assisting someone in a misdeed.