In this week's episode, I speak with the ever-inspiring Eva Velasquez, President & CEO of Identity Theft Resource Center (ITRC).
Eva discusses the ITRC's mission to help consumers, victims, businesses, and governments minimize risk and mitigate the impact of identity compromise. She shares insights on the organization's history, its victim-centric approach, and the evolving landscape of identity crimes.
Eva also highlights the ITRC's efforts in education, research, and advocacy, emphasizing the importance of empathy and understanding when dealing with victims of identity theft and fraud.
Our conversation covers topics such as the impact of AI on fraud, the need for better authentication methods, and the importance of raising awareness about identity protection across all age groups.
RESOURCES:
Connecting with Eva Velasquez
Eva Velasquez’s LinkedIn: https://www.linkedin.com/in/eva-casey-velasquez-04a86411/
Identity Theft Resource Center’s website: https://www.idtheftcenter.org/
Companies & Resources Discussed
Identity Theft Resource Center (ITRC) is a non-profit organization established to minimize risk and mitigate the impact of identity compromise.
About the ITRC including the ITRC’s Foundations of Identity
Eva Velasquez, President and CEO, previously served at the San Diego District Attorney’s Office for 21 years and as the Vice President of Operations for the San Diego Better Business Bureau. She is a recognized leader in the field of identity compromise and crime, cybercrime, and fraud.
James Lee, COO, is a data protection and technology veteran, he is the former EVP & Company Secretary of Irish application security company Waratek and former SVP & Chief Marketing Officer for Atlanta-based data pioneer ChoicePoint (now LexisNexis).
ITRC publications include the ITRC Trends in Identity Report and Data Breach Analysis reports, among others
ITRC Identity in Practice Report seeks to understand and examine identity crime victimization across Black communities in the United States.
Unspeakable podcast, hosted by Eva Velasquez, features guest speakers coming from all walks of life – sharing stories of RESILIENCY, strength, determination, and the freedom to discuss topics that we shy away from discussing due to fear, embarrassment, shame or simply because we have deemed them socially unacceptable to discuss openly.
David Maimon is a professor and Next Generation Scholar in the Andrew Young School of Policy Studies’ Department of Criminal Justice & Criminology, directs the Evidence-based Cybersecurity Research Group at Georgia State University.
Red Table Talk is hosted by Jada Pinkett Smith. Eva Velasquez appeared on the episode titled “Anatomy of a Scam”, which aired on Facebook Watch June 22, 2022.
Ricki Lake - Eva Velasquez appeared on the Ricki Lake show in May 2013.
FULL EPISODE TRANSCRIPT
Steve Craig: Welcome to the PEAK IDV EXECUTIVE SERIES video podcast, where I speak with executives, leaders, founders, and changemakers in the digital identity space. I'm your host, Steve Craig, Founder and Chief Enablement Officer for PEAK IDV. For our audience, this is a video first series, so if you're enjoying the audio version, please check out the video recording on executiveseries.peakidv.com, where you can watch the full episode, read the transcript, and access any of the resources or links from today's conversation.
I’m very excited to introduce today's guest. She is Eva Velasquez, President and CEO of the Identity Theft Resource Center. The Identity Theft Resource Center, or ITRC, is a non profit organization that helps consumers, victims, businesses, and governments minimize risk and mitigate the impact of identity compromise.
Eva became the organization's president and CEO in 2012. Prior, she served as vice president of operations for the Better Business Bureau of San Diego and Imperial Counties after serving the San Diego District Attorney's Office for over 21 years. Eva is a recognized leader in the field of identity compromising crime, cybercrime, and fraud and she's been featured on numerous national media outlets. She is a published author, actively contributes to various advisory boards, working groups, and is regularly invited to speak at industry and policy events and briefings for organizations like the FTC, CFPB, IRS, DHS, PRAC, Department of Labor, and the US House of Representatives; it's a lot. Welcome, Eva. Thank you for making the time to be on the podcast.
Eva Velasquez: I'm thrilled to be here. I love these long form conversations. This is such a complex topic that I think we're in this space in the world where people want a 20 second sound bite and I love that we can dig in a little bit here.
Steve: Absolutely. And thank you for making the time so that we can do that. Let's jump right into the episode. I shared a bit of it about your organization in the intro, but can you tell us more about the ITRC? Like what's your typical elevator pitch.
Eva: Well, we've been around since 1999. So we have a very long history and we are a 501c3 non profit. So we're a charity organization. We're very transparent and you can get all of the information about our background, our history, where we get our funding. That's all available online. And our north star is we believe that people have a right to an unencumbered identity. And so everything that we do is in furtherance of that. And that is the-- we look at the entire spectrum from compromise to usage of identity and identity credentials to the misusage and then, which necessitates recovery. So, we do that through our toll-free contact center that's staffed by real people, live advisors that have had training, not just in how to recover an identity or how to help spot a scam, but also in-- they have a trauma informed background.
We're very victim centric. So they understand that people are experiencing some of them-- one of the worst things that they've ever experienced in their life, and we recognize that. So those folks are trained to help people and stay with them through every step of the way, every step of that journey.
We also have a lot of data from those contacts that we analyze and publish. Of course, we don't talk about specific people. We never publish data about individuals, but we look at the trends. What's really happening? We feel like we're that canary in the coal mine because we can look at our data on a weekly basis and really see what's happening. What is happening to people this week, this month, what are the emerging trends and what do we need to be on the lookout for? And what do we need to learn so we can help people recover better? We also have a lot of other research papers that are looking at the experience, the consumer impact, the business impact, our Trends in Identity Report, which I just kind of touched on and also our Data Breach Report. It's one of our most popular reports where we have the largest repository of data breaches-- publicly reported data breaches in the US and we've been maintaining that data since 2005. We do training and educational programs. We have a certificate program. It's just everything that we do is in furtherance of removing encumbrances from identities.
Steve: Wow. You really live up to the name as a resource center and 1999 is almost 25 years, 25 years since its founding. I'll be sure to link to the history, but can you share a little bit more about how it got its start? Like who was involved in helping form it?
Eva: Well, the interesting thing is, even though I've only been with the organization for 12 years, I have been leveraging them, using them. I was around when they started. I was at the DA’s office and I saw first hand investigating those cases, how few resources we had for victims of this particular crime type. I was in the economic crimes division. I did white collar crimes and fraud investigations. And my job was to get the bad guy, put the case together for prosecution and get the bad guy.
But victims needed more than just the justice. That was an important component, but a lot of them just needed recovery services. They needed peer support help. They just had a lot of needs that were unmet. And Nothing was available to them. So when the ITRC was founded in 1999, and I learned that I had a place to send my victims, I just became an evangelist for this organization. I started using them. I told everybody in the DA’s office. I did a speech at the California District Attorneys Association, the statewide conference. It's everybody has to know about this.
When I went over to the Better Business Bureau, I educated the whole system. I just said, this is such a great organization. It has that one on one component. These are crime victims who need one on one services, very expensive and hard to do. And that's why there's only one national organization that does this. But I was so thrilled when the organization was founded and so when you fast forward to when the founders needed to retire and the board was looking for new leadership, I just felt like if this organization isn't around that's going to be such a huge loss for the public, for victims, and for consumers. I need to make this leap. I'd never been a CEO before. It really wasn't on my radar. I really liked being a number two. I thought of VPs, this is good; I'm good. But I just felt like if I don't do it, who else will? And I'm very glad I did because I love working for this organization and I love what we do. It's a very purpose filled mission and I have-- my days are filled with purpose.
Steve: That's amazing. Going from being their chief evangelist to the CEO, still a major evangelist, but running the organization is pretty amazing.
Many leaders in our space that are fighting fraud and crime and identity theft have personal experiences with the challenge of it. Whether that be themselves or a close friend or family member. Do you have a similar origin story of how it impacted you beyond the district attorney's office?
Eva: Well, it's interesting because look, I have, of course, been a victim of existing account credit card takeover. Is there an adult in North America who hasn't? I've never personally experienced traditional, true identity fraud or identity misuse.
But what I have experienced, particularly in the scams and fraud area is that coercion and having your good nature used against you. And I-- this is a challenging topic to discuss. So I'm going to encourage everybody to kind of lean in and lean into the-- that's an overused word, but it's actually appropriate here-- to that discomfort and just engage with it because it's very real for me.
I am a victim of childhood sexual abuse, but it wasn't violent. It was coercion, and I was talked into doing something that was very bad for me, as it turns out, but by someone that I believed and someone that I trusted, and it was an overall an extended period of time. It was all throughout my childhood and into my early teens.
And I understand when people come to us and say, “I clicked on that link. I sent that money. I believed them when they said they were the love of my life. I believed them when they said …”, you know, insert whatever it is here. We can all be vulnerable to these types of things and coercion is real and it can have a real impact on your life.
It isn't just violent crimes that change us and change who we are and how we engage with the world. The nonviolent ones can also. And so I just feel a real kinship to this victim population, because I do feel like they're going through similar emotions and challenges and trauma responses to what I went through. However, we don't acknowledge it for this victim population; we just don't. We're very dismissive as a society. In fact, the language we sometimes use, “Oh, they fell for this or they were duped.” So how we talk to and about people who are victims, who are survivors of these types of crimes, I think is very important.
And that's the thread for me. That feeling of being coerced into doing something that wasn't in your own best interest, but you didn't know. You didn't know and you didn't find out until later. I have so much empathy in my heart for those folks.
Steve: Really sorry that had happened to you, Eva. And I can see the challenge with the victimization of the victims or they feel maybe ashamed [Eva: Oh, yes] and they don't want to tell their friends or family members because they've-- they feel like it was their fault that someone [Eva: Exactly] took advantage of them.
Eva: The shame and embarrassment are a huge issue, a huge roadblock that we have to overcome with this victim population.
Steve: In particular, in the last few years, whether they be romance scams or like you mentioned, clicking a link in the email, fraud and scams have gotten more sophisticated. [Eva: Oh, yes] So people are always aware of those attacks, which since you've been with the organization for 12 years, how would you say the organization has changed and evolved on your leadership and how has the fraud ecosystem and the scams and the attacks evolved as well?
Eva: Oh, gosh, 12 years is a long time. There's been a lot of changes. But I think that probably the two biggest ones are the use of the data that we have. We really started leveraging that a lot more to educate the public, educate the field and educate ourselves. I also think that the development of products and services is something that was a change for us. Now, traditionally, when I came on board, we were funded mostly by donations, corporate donations. And then we switched and received federal funding.
So, for a number of years, we were primarily funded by the Department of Justice Office of Victims of Crime, like, 80-- upwards of 80 percent of our funding came from that revenue stream, and that's not sustainable. It's very lumpy funding. It's very unpredictable and we are competing with-- when you look at victim services on the whole, it's only a tiny sliver of service providers that aren't working on violent crime, human trafficking, sexual assault, interpersonal violence, domestic violence, all of those crime types tend to get a lot more recognition and resources. And so we started developing products that we could then sell to the business community. So we're generating revenue that keeps us able to provide our free resources to victims and our free services to victims. But at the same time, we're still meeting our mission because we're helping businesses to reduce their risk and their customers' risk.
So it really has been a win, win, situation for us. There's a lot of vendors out there and with us, you get really great products and services, but you also get the knowledge that you're helping other people, you're helping victims.
Steve: That's amazing. You're going from a situation where you're depending on grants or you have that lumpy income from different government programs and administrations to something where you can consistently add recurring values is really powerful.
The other thing that I noticed when looking into your organization preparing for this episode is you've also assembled a really amazing team of leaders, [Eva: Oh, yes] board members, advisors. Can you share more about your key staff and maybe those involved in this organization?
Eva: I am gonna sound like such a cheerleader. I love my team. I have the best team. And that's from my executive team to everyone in the organization to my governing board, my advisory board. And to be honest, I've had a couple people-- I've actually had a number of people ask, you know, how did you do it? I don't know. I don't know why these people chose me. To get on my train and follow me. I can honestly say that oftentimes when I'm meeting with my executive team or my board of directors, I am not the smartest one in the room. They're all much smarter than I am. But I guess they see my passion for this and they know it's real. And so they want to help. They want to get on board and help make a difference.
James and Mona, James Lee is our COO. He actually, I tease him and say, blame James for anything that's happened in the last 12 years, blame James, because he actually started on the board. He was the board chair when I was hired and he served on the board for a number of years, went on hiatus and then came back about six years ago. And then we were talking about strategy and what we needed and how can we grow. And I don't know, I think it was over a number of whiskeys in Washington, DC that I twisted his arm and said, “you know, come on board.” And he did, thankfully. He is a data and cybersecurity expert. He's had a very illustrious career and now he's come back and is, you know, really, really giving back to the community. And I just love him for it.
And then Mona Terry, our Chief Victim Officer, which is a position that we created. She is-- she has such an advocate's heart and a servant's heart, but a tactical brain and I worked with her at the Better Business Bureau. She was my number two there and we just meshed. We worked so well together. And so she had gone on to other things and I went to ITRC and when I had an opportunity to bring her back, I picked up the phone and, you know, God bless her, she came halfway across the country and came back with her family.
And that's-- it's been seven, eight years now. And I can't imagine that we would be where we're at without this dream team of three people with all the same ethos and like mindedness, but very different skill sets.
Steve: Yeah. Well, I love that slogan, blame James, but in a positive way, right? Like blame him for all the good ideas and the works. We'll make sure we tag that pretty heavily in this episode.
The other thing Eva that I found on the website that was pretty unique that I hadn't seen elsewhere was this concept of Foundations of Identity. It read to me like a bill of rights, so to speak, for identity. Can you share how that came together and what the foundations are? And I'll be sure to link it as well.
Eva: Well. You know, during strategic planning, we, over the years, we're talking, we always talk about our north star and I just felt like there was a little bit of a disconnect with these principles that we believe and you know, what we were sharing with with funders and with decision makers, lawmakers, policymakers. And so we started to put together this sort of what are these foundations that we believe from a victim and consumer perspective that we believe are the most important foundation and everything feeds into that.
And so a lot of it had to do with-- I can read them off. There's only 5 of them. You have a right to an unencumbered identity. That's our north star and we believe it's a right. It's not something that's nice to have, or it's only for some people, we use identity and everything that we do and you have a right to have no encumbrances on that identity.
You have the right to be notified when your identity credentials and data are used, compromised, or misused.
You have a right to remediate or recover your identity without an undue burden, financial or otherwise.
You have a right to be acknowledged as a victim of a crime. I want to spend some time on this one because I do think this is fundamental. It may almost sound like a no brainer, “well sure you're a crime victim.” But something changes in your mindset when you step back and go, “yeah, that's a crime and that person is experiencing victimization and all of the things that go along with that,” that person is experiencing. That becomes fundamentally important.
And it's been very important in our work with the Department of Justice and our work with the White House, trying to remind them that this particular crime type affects more Americans than violent crime. Absolutely 1000%. It's not on the UCR, on the Uniform Crime Report because fraud has its own report that nobody looks at, except us fraud geeks. And so just that statement, you have the right to be acknowledged as a victim of a crime was really important to us.
And then the last one, you have a right to access a digital off ramp, a non digital process when you're authenticating, verifying, or recovering your identity also crucially important. Because as much as we believe in leveraging technology to solve a lot of these problems, we have to realize that not everyone can make-- has access to, or can make effective use of some of this technology for whatever reason. And frankly, I don't care what the reason is. If they can't or they choose not to, we need to have options for people. I mean, that's consumer protection 101. We need to have options. So that digital off ramp is really important in a lot of the conversations that we have with industry and tech companies.
Steve: That last one really resonates with me mostly because I always think digitally and it's really important to think those that are in the analog world, either by choice or by economic means, a lot of vulnerable populations don't have access to the latest versions of technology. Internet access sometimes is still challenging for people. So I think that one's really key.
Eva: It's even the-- here's a use case that might resonate with your… well, I'll give you two because we did a lot of work with the blind, low vision, and the deaf, hard of hearing communities. And I had some ‘aha’ moments that were really simple. But they resonated with me. The first one being that we realized that just having closed captioning or using the teller relay with the deaf community was not as powerful as having a sign language interpreter.
And they reminded me-- they're like, “English is not our first language. You have to treat us like we're non-native English speakers because American Sign Language is different. It's its own language. And for a lot of us, that's our first language.” That just made my head explode. I was like, how I knew that as soon as I heard it, I went, “of course, that's the case,” but I didn't have that right in front of me.
And then the other piece was with the blind-- low vision community, just things like taking a selfie. We take for granted what a simple step that is. And then we think, “well, if you don't have access, that may be the reason.” They-- there's plenty-- they have plenty of access to digital technology and they use screen readers, but taking a selfie requires sight. It requires you getting the box in the right place and doing all of that, which they cannot do themselves. They would need assistance with that. That's just another way that we have to remind ourselves that not everybody navigates the outside world the same way we do.
Steve: I really like that example. One of the previous guests that I featured on this was a founder of an accessibility consulting company to be able to move the web standards into an environment where those with vision disability or hearing disability could interact. Thank you for adding that.
I want to go a little bit deeper into the recovery aspect of it. When I was looking, again, at your site-- and I invite anyone who's listening or watching this to go to your website, you know, prevent, recover and protect the main pillars of your offering. What does someone do when they're a victim? Like, how do they begin to leverage your services? Can you take us through that user journey or experience?
Eva: We want them to reach out to our advisors and they can reach out to them through a variety of means. So we have a toll free number. We have live chat on our website. You can email us. You can send us a direct message on social media. I'm trying to get, you know, carrier pigeon. In any way people want to engage with us, we're here for them. And I encourage people to not try to figure it out on your own. Just contact us because if you explain to us what you're experiencing, we'll not only give you a recovery plan for that issue, we can also look at what happened, what credentials were used to perpetrate that, where are your vulnerabilities. And then the second step, we give you a risk minimization plan as well. And it applies to all different identity crimes. So scams, you know, techno-- cyber crimes, data breaches. People have a lot of questions about data compromises and even not just the breaches, but self compromise. We are equipped to help with all of that. So that's the recover portion
Steve: For those advisors, what's the typical background? Because I imagine you need to be very empathetic, almost like a counselor. Can you share more about what your typical advisor looks like?
Eva: Well, because our training is so specialized, we actually aren't looking necessarily for, okay, we need, you know, social workers or something like that, we're looking for people that can leverage the technology. So they have some kind of customer service skills and telephone service provision. And then we train them because we have sort of our ITRC university. And it's a very robust training program that-- where they get a certificate of completion.
And we look at the steps for, you know, understanding identity, understanding recovery, and then there's also the trauma informed training, which we do a lot of. And that's in conjunction with a lot of other service providers, just getting involved with those service providers. But because it's such a dynamic space, we also meet three times a week.
We meet three times a week in the morning, and we talk about the landscape, what's changing. And one of those meetings is dedicated solely to the contact center, telling us, what are you hearing? What did you have questions on? What was one that was unusual or really got to you because sometimes they also-- it's called vicarious trauma. They also have to have a platform to release some of that pain.
These people every day are bearing witness to the pain of other people. They need an outlet too. So there's just a lot of ongoing training, education, communication, and frankly camaraderie that keeps that process flowing so that victims aren't left behind. But also my staff, the team that's providing the services isn't left behind.
Steve: Training sounds really powerful. And when you bring in the element of having outlets, there's like a methodology of releasing those pressure valves. Do you make these programs available to the commercial market, to banks, to marketplaces, is that…?
Eva: I am so glad you asked me that because we will. It's been one of our ongoing efforts for the last two years because so many-- a lot of banks were asking me and a lot of other recovery-- identity recovery providers were going, “what is your secret sauce? Because wow, you guys do this so well.”
And we thought, you know what, “this is part of our education mission. We need to train the other people who are interacting with these people on a regular basis and show them how they can do it better.” I'm not saying they were doing it badly, but just show them how they can do it better. So we took our internal training program and we have put it together. We added some different modules and we've put it together to allow individuals to become a certified identity recovery specialist from the ITRC.
We're in proof of concept right now. The feedback has been overwhelmingly positive from the organizations that have taken the class. We've got a couple of different ways that you can do it. There's the online version, which is just strictly online through the platform. We've got instructor led versions. One is a virtual version. One is in person and it's accelerated, so over two days. And the feedback from all of them has been overwhelmingly positive. The trauma informed victim centric training, what we're hearing from everyone has taken it is I've never seen anything like this before because we're marrying victim services with that customer service, which hasn't been done yet. And the feedback I-- we had someone that was like, “I have been in this space for 25 years and this is the first time I've seen any of that.” So it's been really very satisfying for us to know we've been onto something and now it's time for us to share that.
Steve: I might be biased because I absolutely love education, I have PEAK IDV Academy. But when I think about the curriculum that you're offering, I've been a victim of account takeover. A couple of months ago, my hotel loyalty account was breached. And when I called the customer service team, they acted like, well, that was something you must have done because we have protections and there's a bit of skepticism, there was no empathy. There was almost a defense and a deflection. I feel like every team that does customer service should have that kind of training.
Eva: Oh, I couldn't agree with you more. That was part of the genesis. We were even seeing that with breaches. We-- I can-- I hope we have time for this story. There was a hospital breach and it was actually patients-- breast cancer patients.
And part of the breach was their pre- and post-op picture pictures-- photographs. So these patients who are already in probably the worst situation of their life, literally life and death now are dealing with very intimate pictures and records of them, the threat of them being published online.
Well, the bad actors did end up publishing them online because the hospital wouldn't pay the ransom. And I make no judgment about pay the ransom, or don't pay the ransom. I don't think there's a one size fits all there, frankly. But when the victims started calling, they were really dismissed and met with no empathy.
And because of that lack of training for the people who are answering the phones, it resulted in a class action lawsuit. And that was brought up, that was one of the actions was that we're told that, “well, there's nothing you can do about it. Just deal with it. Here's credit monitoring.” And they're going, I don't need credit monitoring for pictures of my body pre- and post-op just being out there on the internet. They needed a different level of services and empathy that they weren't getting.
So I think it was a big wake up call. Anybody who's dealing with this-- I mean, you wouldn't necessarily think hospitals-- you'd also think they would have that level of empathy, but you know, this was a different team. These were not the people providing patient care. This was the people behind the scenes working with the digital records. So it's just case in point for how everybody needs this mindset and this training.
Steve: Our identities are at the center of everything, whether it's healthcare or travel, financial records, things we do on social media, and it's not just about getting a fake credit card account opened in your name, there’s [Eva: There’s so much more, so much more] so many different ways.
Eva: Criminal identity theft, child identity theft, student loans, ghost students identity is that thread that impacts so many different facets of our lives. But if you're not in this space, you don't think about it. It's this machine that's working in the background and you only acknowledge how big this machine is when something goes wrong.
Steve: Absolutely. Well, one of the things that's inspired me about your organization, Eva, is how much you put out into the wild with respect to your publications, your impact studies, working groups, you have the data breach reports. You mentioned earlier that your victim services, you track data anonymously and that. Can you share more about your methodology and how you produce such amazing assets with such a small, mighty team?
Eva: We do punch above our weight class. I think part of it is being very thoughtful about what we're going to publish. Sometimes-- you know, we're a nonprofit-- so sometimes we will get funding for a special project, which makes it a lot easier. So one of our research publications-- recent ones-- was, Identity in Practice where we looked at how identity crimes impact the black community. And thankfully, that was a special project that was paid for by some other grant funders. But it allowed us to really take our methodology of looking at certain data points and knowing where the ‘ahas’ are, what are these things that are these trends that are bubbling to the surface? And I think that just comes from years of working with the public and also years of knowing that it's not-- there are a lot of reports about the impact of data breaches or identity crimes that ask, you know, how much time did you spend and how much money did you lose? And those are important things. By far not the full picture.
Under-- we understand there's this domino effect. There can be-- once one piece falls, depending on how many resources that individual has to recover, it can paint a completely different picture for their future, their life. You know, one person, they lose $500 or a $1,000 in an identity crime or a scam or something like that and they go, “oh, that really hurts and that stings and I don't have that money, but I'm going to be okay. I'm not going to lose my house. I'm not going to lose my job. I'm not going to lose my car. I can put food on the table.” And then you have other people where that money being gone, even if eventually they do get it back, maybe it was their debit card that was compromised and their bank account was drained. But there's a lag between when that money gets-- the investigation is conducted and they are reimbursed for that money. They can't pay their rent. They're evicted. They can't make their car payment. They don't have money for gas, so they can't get to their job. So all of this domino effect happens where they're absolutely devastated.
And these are crime victims. If it was another type of crime, there would have been resources. There's-- there are-- there's bridge funding, there's emergency funding. We don't have it for this population. Because we know that we know what questions to ask, and we know what issues to highlight that we think will resonate with the decision makers who are making policies about how do we protect people and how do we help people recover?
Steve: Yeah, it seems like the scams and the fraud have only accelerated in the last few years coming out of the pandemic. I know you participated in the pandemic response group. Part of this podcast, the last few episodes, the concept of artificial intelligence and deep fakes and generative media attacks come up more and more.
Are you starting to see these attacks? Part of that narrative as victims call in? Are they getting-- I don't want to use the word duped because we talked about that-- but are they getting… [Eva: Are they being impacted by them?]
Eva: That's a good question. And the answer-- I think the answer right now is, juries out. And there's a couple of reasons for that. First of all, we've actually been hearing about these attacks for years. So, I remember the first time we heard about a voice cloning attack from a victim was seven years ago. So it's been happening. Our concern is scalability. How is this going to scale and impact more people? I am not sure that it's as-- that the scalability is there and that it's as lucrative.
But the other part of that equation is people don't often know what the root cause of their situation is. Sometimes they do, but it's a rare occasion. It's more often, they go, “this thing happened, this account was opened in my name. I lost access to this account. I can't move forward in my life. I can't do this thing. I'm 18 and went to apply for college for student loans, and I found out that I've got a work history from when I was six years old.”
They don't necessarily know what the root cause was. So I don't know that the use of AI and deep fakes and voice cloning that we're necessarily going to be able to tie it back and go, “Oh, that was that particular incident was AI generated.”
I will tell you that just anecdotally from my own observation, I can see that the-- particularly phishing is getting so much more sophisticated. So the use of AI to leverage these attacks and create more legitimate looking types of incoming communication, whether it's text messages or job postings, we've seen a huge rise in job scams, imposter scams looking to, you know, trying to look like your bank or a government agency or legitimate business.
AI is definitely going to help those things look more legitimate. I just-- we just don't know yet what the real direct impact is going to be. If it's just more, if we're going to get fatigue because we're just being deluged, I didn't think it could get worse, but it did.
Steve: Yeah, yeah. We've had some situations that make the mainstream media around like there was one in Hong Kong where there was $25 million. [Eva: Yeah,the $25 million deep fake video] That was the event heard around the world and every company in the space that provides solutions had mentioned it. But then I've heard locally in the news, there are situations where you get these voice clones that are kind of like ransom or, “Hey, I'm down in Tijuana, send me $500.” And it's in the voice of your kid and trying to sift through those.
But you make a really good point about the large language models and the ability to defraud or scam at scale, because you can run these through these GPT type services. You've got data breach data, so you can even customize them and the fraudsters aren't always these individuals that are in basements by themselves that they're organized crime groups... [Eva: They're sophisticated.]
Eva: There's a lot of sophisticated-- well, I mean, it really does run the gamut. I think we tend to focus on the very well heeled, sophisticated, multinational fraud groups because they are having the biggest impact. But, there's also your-- we still have domestic mom and pop fraudsters. We've seen street gangs are moving more into identity theft and those types of crimes because less likely that you're going to get caught. You don't even have to leave the house. And if you do, the punishment is less severe. So there is a-- I do think there's a-- the ecosystem and the perpetrators are very broad. And if you listen to a professor David Maimon, who is looking at, I mean, he is analyzing all of the chatter, not just on the dark web, but increasingly on the public web, on YouTube.
There's now this younger generation and domestic younger generation that thinks it's really cool. There's a cool factor to stealing and committing fraud and then showing what you were able to do. “Look at this apartment, I rented this, you know, awesome penthouse” in someone else's name. “Look at this car that I bought.”
So I think there's a lot of factors that are feeding into the increase. AI is a big one, but it is just one.
Steve: I'm always surprised to see in the media and on LinkedIn, these groups that flaunt their fraud, they're flashing cash or to your point, they're showing, you know, a new apartment and they talk about, “well, this is how you do it too.”
And it just creates awareness of like, “wow, it's that easy to scam someone, you know, why not? They'll get their money back or they're, they're better off than I am. I'm just robbing from the rich and, you know, giving it to the poor.”
How do you think that that, you know, that combination of the AI activity where these tools are getting democratized with the awareness of these is going to change in the next few years. Like, do you think we're going to see an acceleration or do you think we've got the tools in place to fight back?
Eva: You know, we're always on the treadmill. I've been in this space for decades and we are always running to catch up. And I don't think that that's going to change anytime soon. I do think that if we can make a few shifts into better authentication and verification, but not just industry dealing with their customers. Very often I hear, you know, everybody, “Oh, we've got a industry has to do a better job. So that these credentials aren't being misused by someone who isn't them.” And I agree with that statement, but that's only one part of the puzzle.
I feel like we have a fundamental problem. People do not know who they're talking to online, not just businesses, individuals. I don't know if that really is a bot or someone that I'm dating on this dating website. I don't know if that really is someone offering to sell something I want on Facebook Marketplace or if that's an account that's been taken over.
I don't know if that really is the Department of Homeland Security that's calling me or texting me or this is the website that they sent me to, and it's a fake website. We're just not-- I swear, we're going to look back at this the way we all look at the wild west with people out shooting each other in the street and go, “how did society even function then?”
I swear, people are going to look back at this and be like, that was the wild west for, you know, a hundred years. There was just not enough-- I hate to use the word policing, but truly policing and going that website is legitimate, that one isn't. That sender is legitimate, that one isn't. We need to know who we're engaging with.
And to me, that's the biggest problem that if we can make inroads there, I think we'll solve a lot of other problems. But, you know that I don't have the solution for it. I help the victims. I'm going to let industry, you guys duke it out and please figure that out. But we need better authentication and verification tools, not just in the hands of businesses, but in the hands of end users.
Steve: Most definitely when I think about your organization in this conversation, there's this. overarching theme of-- of course supporting victims and recovery, but awareness, helping to educate people on these topics and making it okay to talk about them and not feeling like you have to go off and fight it alone. How can we better serve our kids, our parents, our friends, our neighbors on letting them know that these situations can happen and what to do?
Eva: I mean, I think it's just teachable moments, sharing what you do. I think we all-- anybody who's in this space, I think we all kind of have an obligation to not bore people because sometimes we can get too technical, but just to, you know, bring it up, “I saw this new scam today.” I mean-- and it's different with different relationships, right? With kids, I always encourage parents to just kind of talk about what you do so that kids get used to hearing it. “Oh, that's a…”-- you know, you're answering your emails while you're eight year old is watching TV and I don't even know what's on TV for kids anymore. My kids are all in their thirties. So I was going to say Cocomelon, but is that for little kids? I don't remember. But anyway, you're, you know, your kids, you're in the same space. Your kid is doing something else, you might be checking your email, you can even say out loud, “Oh, I just got a scam email. Well, I'm not responding to that. I need to delete that.” You're planting that seed now, they may not ask you anything about it at that moment, but they heard you. And if they do ask you, be prepared to say, “yeah, well, unfortunately, you can't trust every email that comes in every phone call that comes in. That's why we have these protections. You don't know.” I mean, you just kind of use those moments to touch on these topics that are sort of like getting to the core of you don't always know who you're talking to online and you can, you know, do that with anybody. I visit my 81 year old mother every Sunday and it's funny because she'll be like, what's new in the world of scams.
“What do I have-- what do I need to be terrified about this week, honey?” And, you know, and I'll just tell her, “well, it's these things and these things.” And, you know, we talk about instant payments and how “you will never have a need for instant payments, mom. If anybody ever tries to pressure you into that, you hang up and call me.”
And she's lucky because she does have that direct line, right? If something weird comes up, and it has, she calls me, and I don't make her feel bad about it or feel like, “oh, you know, you're asking me for help because you can't manage your own affairs because you're old.” That's the worst thing we can do. In fact, I think a sign of being able to properly manage your affairs as a senior is asking for help because you know, you're not an expert in everything. And I just think we need to keep getting that messaging out to people.
Steve: Yeah. Well, whether it's the older population or the younger population, my son, he's 11. He plays Roblox. He recently got his first taste of a scam or fraud. Someone had messaged him pretending that they would do something for him in the game. All they needed was some file. They showed him how to get it. And that file happened to be an authentication file that he should not have sent, which gave them complete access to his account, locked him out. We had a whole situation there that I recently wrote about. I like that advice though, Eva, that it was teachable moments because often it's like, well, you don't want to go out and just share recommendations. You want to share stories and experiences and people learn from those.
Eva: And I, well-- and for kids, modeling that behavior, I am, you know, I practice good cyber hygiene. I am aware that these are issues and I'm aware that I'm vulnerable. I'm not perfect. I'm not impenetrable. So that's why I have to pay attention to it. And. That's why you have to pay attention and you have to come to me and, you know, we have to have those conversations. Oh, and I'm so sorry about your son. Talk about learning firsthand, oh.
Steve: Well, when you think about the victimization, his first reaction to that happening was, “Oh my God, I want to die.” And it's like, as a parent, you don't want to hear that, but I know that people have had worse and they do commit suicide. They do feel like the world is over. And for an 11 year old, losing all your virtual stuff that you've collected over the last few years, that is a pretty big hit to him. But at all levels, like fortunately, this was a teachable moment and the impact-- we, you know, we resolved the situation, but it could be worse, you know, as people interact out there.
Eva: Well, 16 percent of the victims that we've surveyed told us that they had thoughts of suicide post victimization, 16 percent. And that's doubled in the last two years. So that number is increasing and it's going up exponentially.
And we are hearing from family members who are reaching out to us after a loved one has died or committed suicide and they couldn't really figure out why. And then as they get through the paperwork and start to uncover the paper trail, they learn that they've been a victim of some kind of scam or fraud or investment scheme or something that caused them to think that the only way out was to end their life.
And, you know, if we can just stop one more person from feeling that way and thinking that way-- you know, Steve, you made a great point. Acknowledging whether you think it's a big deal or not, whether you think it's worth losing your mind or your sanity over or not -- not relevant. It's how that person feels.
So, acknowledging that this was a really big deal to your kid and he had those strong feelings and helping him through them. I think that's such a good life lesson for all of us.
Steve: Yeah, it created that fear for us just to understand where the impact was. But you're absolutely right.
Well, Eva, we're almost at time. In preparing for this episode. I watched a lot of the media that you've done in the past. I really admire your evangelism and just the passion. I understand now why you're-- you've got the team that you do. I watched an episode of, it's called the Red Table Talk. It's hosted by Jada Pinkett Smith, the actor. And I thought your appearance on that was amazing. It's only available on Facebook Watch though. I couldn't find it on YouTube, but I'd love to hear how you got connected with that team and what it was like to record with Jada.
Eva: It was actually a really great experience. That team treats their guests with such respect and dignity. And I was very impressed by not only how they treated me. I came on as the expert to provide, you know, advice, but they actually did have victims of various scams and identity crimes coming on and telling their story. They treated them with such dignity and respect. It was like a model for us to watch how you can educate the public. Go through something really challenging, but be a witness and understanding and compassionate for these folks that had that experience.
And I've done a number of talk shows. The first national talk show I ever did actually was Ricki Lake. And so I know-- remember, I'm old, I've been doing this for a long time. But there, you know, every once in a while, these shows will-- it will come into their radar that, “Oh my gosh, identity crimes are kind of a big deal that impact everybody.” And then when they see that, they go, “Oh, we got to, we got to talk about this.” And I also think by virtue of the fact that we have really stuck a flag in the ground about building awareness.
And so we put a lot of our energy into it. It's a big part of my job that, that's one of those virtuous cycles. The more people look for who are the experts in the space who can speak to these issues in a way that maybe is unique and interesting and helps people, then we get more of that. So they found us. I get a lot of those where I just, someone reaches in and we check it out and go, yes, it's valid. And then we make it happen. But I probably spend a good 40-50 percent of my time doing things just like this for all various types of outlets.
Steve: Well, I'll be sure to link that particular episode. Again, if you're watching this, you'll need Facebook to watch it, but I thought you did an amazing job.
And I'll also look for Ricki Lake. I didn't find that one. Maybe it's not on.
Eva: I mean, it may have been. I think pieces of it might still be on YouTube. Yeah, and you'll see what I looked like all the many, many, many, many moons ago. If I find it, I'll send it to you.
Steve: Please do. Amazing. Well, I've got just a few final questions to close it out. If you've seen any of the episodes of EXECUTIVE SERIES, you know I like to go a little bit beyond the LinkedIn profile, and share more about the person behind the press releases. And I think we've done a lot of that today. When you're not helping victims of identity theft and fighting identity theft, crime, where do you focus your time? Are there hobbies or organizations or causes that are important to you?
Eva: I'm kind of that-- a generalist and a jack of all trades. I love novelty. So, you know, I have hobbies. I love being outdoors. I'm so lucky to be in Southern California. So I go on hiking and nature walks and beach walks and ocean swimming. But I, you know, I love to be with my family. My kids are all grown and they're all kind of all over the place. So I definitely have to make time to hop on a plane and go and visit them and just spend time. Just got back from visiting my daughter in Dallas. And we went to the movies. We went and had a spa day. And then we drove to Oklahoma and went to a casino to go check out the world's biggest casino.
So I love anything that's novel and that I haven't had that experience before, but you can also just take me to go play a game of darts or pool and I just might win.
Steve: Nice. Are you telling me the world's largest casino is in Oklahoma?
Eva: Allegedly according to them. I don't know if that's puffery. I don't know if it's false advertising, but WinStar Casino in Thackerville, Oklahoma. It's right over the state line. They had a good buffet
Steve: I'll have to check that one out. Well, thank you Eva for sharing everything you've shared today. To close out, are there-- how can individuals or organizations support your, your nonprofit and your mission?
Eva: Well, I would encourage everybody to sign up for the newsletter. It's only once a month. We don't, you know, bombard you with content. But it's a great way to keep it-- that reminder and to remember that we're here if you ever need us. And of course, you know, we are a charity organization, so we do accept donations. If anybody would want to donate to us, they certainly can. And for the folks with industry, look, we have a lot of products and services, collaborative agreements. Anybody in law enforcement, we have referral partnerships with multiple law enforcement agencies all across the country where you can send us your victims. Really, if you're in this space and you have a challenge, there is probably something that the ITRC can do to help you alleviate that challenge and help support you. All you need to do is visit our website, reach out, call us, email us. We're super easy to get in touch with.
Steve: Excellent. I'll be sure to include all of those links. I know you also have a podcast series, so I'll put both of those podcast series in this.
Eva, thanks again so much for the time today. I'm really inspired by all the work that you do, and I'm sure those that are watching or listening will be inspired too.
Eva: I really enjoyed it. Like I said, I was looking forward to it and you did not disappoint. So this was fun. Thanks for the opportunity.
Identity Theft Protection with Eva Velasquez