Best Practices: Security
Inside Jobs
Eileen P. Gunn
01/01/2007

To paraphrase Mark Twain, the news of Paul Vance’s death was greatly exaggerated. Last September, the Associated Press reported the passing of Vance, who cowrote the pop hit, Itsy Bitsy Teenie Weenie Yellow Polka Dot Bikini. The trouble was the real Vance was still alive and living in Florida. The deceased, who also lived in Florida, had spent much of his life posing as the songwriter, even to his wife.

The imposter seemed more interested in notoriety than financial gains, but the mix-up still caused Vance, then 76, some grief. A thoroughbred owner, he saw his horses scratched from races based upon "news" that he had passed away, and he worried that the fiasco would jeopardize his future music royalties.

Vance was relatively lucky that his counterfeit self did not cause more trouble. Identity theft plagues a growing number of affluent individuals today, pummeling their financial and professional lives and causing them years of hardship. Identity theft complaints made to the Federal Trade Commission rose nearly 19 percent between 2003 and 2005, to more than 255,500. It takes, on average, more than 600 hours—and more than 14 to 16 months—for a victim to clear his record, notes James Kane, president of Hub International Personal Insurance.

Criminals will target anyone with a social security number and a good credit score, but the ultrawealthy are primary targets, says Paul Viollis, CEO of Risk Control Strategies, a New York firm that specializes in the security needs of affluent families. Individuals who lead a quasi-public life—by sitting on boards, making large charitable donations, running a company—can be even more vulnerable because their affiliations often require them to reveal valuable information, such as their place of residence or net worth. Prevention is key, and many effective steps don’t have to be major intrusions into your life, Viollis says.

At Home
Viollis worries most about the people who immediately surround his clients. According to the FTC, only one-quarter of victims uncover a thief’s identity. But when serious crimes are committed—opening fraudulent accounts, for example—more than half of the victims who identify the criminal find out the thief is someone they know.

When serious crimes are committed, more than half of the victims who identify the criminal find out the thief is someone they know.

Viollis urges his clients to ask anyone working in the home, including temporary hires for seasonal work or a special event, to allow a background check. Employees who routinely work inside the house and gain the most intimate knowledge of the family should receive the most scrutiny. "Negative behavior migrates to the path of least resistance," he says. "So if you do a background check and I don’t, a person with a questionable background is going to come to me for a job, and not to you."

One New York couple learned this lesson the hard way in 2004. Reuben Borman and Cherin Perelmen took shortcuts in the usual checks and scrutiny during their haste to hire a nanny to care for their colicky infant. According to the New York Times, the nanny, who dropped her résumé at a placement agency while the couple was there seeking help, lasted only a few days before disappearing with Perelmen’s cash and a stolen blank check.

Police who investigated the incident eventually discovered that the nanny, Adrienn Kohalmi, had worked for several families in New Jersey and had accumulated a trove of stolen credit cards, social security numbers, passports and even bank accounts over time. She was subsequently convicted of fraud.

Viollis suggests renewing background checks every 12 to 24 months. Look for personal problems, sudden debts, a child in legal trouble or other factors that can create acute financial need and tempt a housekeeper or cook to sell an employer’s personal information. Viollis also advises clients to be wary of changes that suggest a recent windfall. "For example, the chauffeur is suddenly driving a Mercedes," he says.

"At the end of the day, the computer needs to be turned off and nothing should be on your desk."

"We just had a case where a thief wiped out two bank accounts while the family was on vacation," Viollis notes. He traced the breach back to a nanny who had sold the account numbers and other key information to someone else who did the actual damage. "She had personal debt and this was a way to wipe that out."

Beyond threats inside a family’s inner circle, Viollis worries about the criminals they do not know at all, "trollers who cyberstalk the wealthy," he says. These predators may begin scouring websites for names of philanthropists and their donations. From there, a Google search can turn up their board memberships, hometown, place of business and even, perhaps, the location of their family office. With this data, thieves can estimate a target’s net worth and look for access points: computers to hack, cell phones, PDAs, wireless networks or cordless phones to intercept for credit card numbers, bank accounts and passwords. "Clients always tell me they can’t give up their cordless phone or their Treo. I tell them they don’t have to," Viollis says. Instead he recommends using Internet-based phone services, installing software on home computers that encrypts data or buying a small file server where information can be encrypted before it leaves the home.

Families should also be sure to secure second or vacation homes. The first step is to avoid leaving important documents—spare credit cards, checkbooks or old bills—lying around a house that is often empty, particularly if workers will be coming and going or guests will be staying there while you are gone. Homeowners should take all personal records with them when they leave, or put them in the safe.

Robert Oatman, a veteran of the Baltimore Police Department whose firm, R.L. Oatman & Associates, performs corporate and personal security assessments, says that his clients often neglect to keep track of who has access to seasonal homes. "I had one client recently do a key count for his house in Palm Beach. The number of keys floating around was amazing," he says. "Four employees who no longer worked there had never returned theirs, and a few others were missing completely, never to be found."

Oatman recommended a new system in which only one employee has a key and keeps a log of who uses it, accompanying the visitor when it is appropriate. "A plumber who visits the home once in a while might not know where to look for important documents, but nannies, housekeepers and friends have the opportunity to do some searching," he says. "You have to have one person who is accountable for the home and checks on it regularly," so that if something does go missing it is found out sooner rather than later.

Houston-based consultant Michael Guidry worked in the security field for 25 years in nearly 100 countries. He discourages clients from having mail sent to a second home where it can lie around the house, or even sit in the mailbox for weeks at a time, waiting for a stranger to gather it up. He advises clients who live between several homes or who travel often to use a mail forwarding service that receives all mail year-round and delivers it to a family’s current location, or better yet, scans it and emails it, destroying the hard copies.

Business
Viollis recently took an emergency call from a client after computers at the family office had been hacked. "The social security numbers, dates of birth and account numbers for five different families were vulnerable," he says, noting that like many small businesses, family offices often lack security measures such as network firewalls and encryption technology.

TOP VIEW
Affluent individuals present choice targets for identity thieves, both because their assets make them more desirable and because their lifestyles, such as a second home left empty for most of the year, or personal information disclosed when giving to charity, leave them more vulnerable. Families must take protective steps to keep themselves one step ahead of scammers, who may lurk within their circle of employees.

When a family hires Viollis for a home security assessment, he often recommends scrutinizing the family office as well to make sure the people who work there and the technologies they use have been well vetted.

Oatman adheres to "a strict clean-desk policy for my office" and suggests his clients do the same. "Think about all the things people leave around their desk—bills, travel itineraries with credit card information, open computers, even family photos," can tell visitors more than you want them to know, he says. "At the end of the day, the computer needs to be turned off and nothing should be on your desk."

Oatman also works with corporate security to improve control over access to executive floors. He says that while other executives are usually thoroughly checked out, cleaning and maintenance staff, mailroom clerks and administrative assistants often are not. According to the FTC, among those who suffer more serious incidents of business-related identity theft and track down the thief, 13 percent trace the crime back to someone they work with. "Some of these people have access to the office when no one else is around, so you really need to know who they are," Oatman says.

Travel
Credit card theft is far more likely when individuals travel because they use cards more often and hand them off to more strangers. They are also more apt to visit small, less-secure businesses—even ones that use hard-copy imprints of a card rather than electronic systems that show only part of the number. Thieving clerks can then use imprints to access credit card accounts. "This is why we’re big fans of local currency," Oatman says. "People have a tendency to pull out their credit card for the most minor things. We recommend saving it for big purchases at established places and using cash for everything else."

Children
Children have social security numbers and spotless credit records, making them ideal candidates for identity theft. When they reach high school and college, they present appealing targets: They are alone more often and armed with credit cards. They rarely shred documents and constantly meet new people who can quickly learn about their personal lives. Predators even prowl Internet chat rooms or social websites such as MySpace to search for personal information. "The best thing parents can do is limit the damage children can do to themselves," Guidry says. He suggests giving them a credit card with a small limit and linking it to a parent’s account, as an adult is more likely to notice quickly if problems arise.

Oatman encourages parents to routinely coach children on discretion as well. "You need protocols. This is what you can and can’t say about yourself in certain situations, this is what you can and can’t put on your Web page. Don’t reveal these family details until you’ve gotten to know a person to a certain extent," he says.

When children travel abroad, parents should encourage them to be more discreet and leave status symbols at home. "When kids come off a plane, sure, they’re all wearing jeans and T-shirts, but I can look at the backpacks, wristwatches, jewelry, manicures and know immediately which kids are wealthier," Oatman says. Scammers pinpoint these young people at cafés, clubs and museums. "They start asking, ‘Where do you live, where do you go to school, what do your parents do?’ These are more of the little pieces people are trying to put together about you." In the end, he says, securing personal identity requires keeping enough of these little pieces separated and protected so no criminal can assemble the entire puzzle.

Art by Isabelle Arsenault.

Eileen P. Gunn, based in Brooklyn, is a senior correspondent for Worth.