Identity Theft as a Service (ITaaS)

We’ve all heard of Software as a Service (SaaS), many of us have heard of DaaS (Data as a Service), some of us have heard CaaS (Cars as a Service), but I expect only a few of us have heard of ITaaS – Identity Theft as A Service. This is a new ‘industry’ that has recently sprung up on the dark web and basically, for a small fee (crypto of course!), provides budding criminals with the resources to steal peoples’ identities. Ultimately such sites are a veritable supermarket for those wishing to make money from fraud.

This is leading to what has been coined identity-theft-on-demand – the ability for an attacker to commit identity fraud without ever stepping foot outside or showing their face to another human. One ITaaS website states: “You will be absolutely delighted. This is by far the most comprehensive, clear, easy to follow, up to date, resourceful and thorough identity fraud guide ever written.” It could have been promoting a new financial product or chocolate bar. It feels so normal, so professional, so helpful — there are even warnings and hints about things to avoid to reduce the risk of getting caught!

ITaaS customers are able to purchase stolen information and receive a scan of their new passport containing these details alongside their own photo all for less than £1,000. This document can then be used to apply for credit, bank accounts, mortgages, loans, mobile phones, catalogues, white goods, subscriptions etc. And often the information being provided pertains to people that have passed away because the fraud tends to go undetected for longer. As a result research on the dark web shows that the personal information of the deceased commands a premium.

Identity fraud is no longer a cottage industry. Every day it gets smarter and unfortunately this means that legitimate businesses need to put greater protections into place or risk the costs associated with identity theft getting higher and higher each year.