Case 1
A teen fraudster was recently arrested by the cyber cell of the Ahmadabad Crime Branch for allegedly using US credit cards in a fraudulent manner. It was later learnt that the fraudster earned Rs 1 lakh per month by selling online iTunes gift certificates to customers from Germany and other countries.

The fraudster used to purchase iTunes certificates online from the US for $100 each using other people's credit card details and sell them for $110. Inquiries revealed that the he operated a virtual savings account with PayPal on eBay, where he used to deposit his earnings from online transactions.

Case 2
A computer intrusion into a Citibank server that processes ATM withdrawals led to two Brooklyn men making hundreds of fraudulent withdrawals from New York City cash machines in February. The fraudsters ended up withdrawing at least $750,000 in cash, according to federal prosecutors.

Earlier Citibank was also involved in data breach incidents. In May 2005 workers at a call centre in Pune, were arrested for looting $3,50,000 from the accounts of Citibank's US customers.

Case 3
A 32-year-old senior media executive in Mumbai was recently pick-pocketed while he was on his way to work. The thief stole his purse which carried both the debit card and the credit card but even before he could call the banks, the thief had already bought goods worth Rs 40,000 and withdrew Rs 88,000 in cash from his accounts.

An identity theft insurance policy generally covers one for the expenses they may incur if their identity is stolen

The whole process of calling up the call centers and the verification process took the executive about 45 minutes to block just one card.

Wondering what these instances have to do with you? Well, identity theft can happen to anyone from the upwardly mobile social strata, which includes you.

So, as a solution provider (SI) you may need identity theft insurance either for your own business or for your personal usage. Besides, if your business garners, stores or handles customers' or employees' confidential, personal or financial data, it is critical that you consider business identity theft insurance.

Highlights of the policy
Unlike abroad, banks and financial institutions in India are yet to offer identity theft insurance policy to its customers. While HDFC is in some way offering the services others are yet to formulate a policy. But given the rate at which cyber crimes are on the rise in the country, soon many banks and insurance companies will join the fray.

Karthik Sahani, Regional Director-India and SAARC, MacAfee opined, “The reasons why banks in India are not yet offering the policy is that the credit card penetration level in the country is the lowest when compared globally. There are just four million credit card users for a population of and billion in India whereas comparatively in US there are 40 million credit card users for a population of over 50 million. However, on the contrary cyber crimes are on the rise and hence there will be a need for such an insurance policy in future.”

An identity theft insurance policy generally covers you for the expenses you might incur if your identity is stolen. These might include anything from legal fees for defending criminal charges associated with identity theft; telephone calls; postage; or rejected loan application fees and lost wages if you have to take time off work to reclaim your identity. So if you cannot afford to pay these expenses, you can look to buy the insurance.

All one needs to do is pay a monthly or annual fee for your identity theft protection policy. Most of these policies include access to your credit report and will notify you if any changes are made to your report.

Throwing light on the same, Rajat Khare, CEO and Director, Net Appin Group mentioned that the policy ensures coverage when loss of customer information occurs, including costs associated with legal defense, loss notification, restoration of business reputation and identity theft assistance.

“It is not prevalent in India and is most popular in US but with increase in phishing crimes and identity thefts using Orkut and other social portals it will soon come to India as well. It provides reimbursement to businesses and their customers who are victims of identity theft for example banks. Identity theft insurance coverage includes liability damages, victim-notification costs, crisis-management expenses and costs associated with theft-recovery services for victims,” he reiterated.

Vikas Desai, Lead Security Architect-India and SAARC, RSA opined, “Business identity theft insurance is an insurance instrument that business could buy to hedge against identity theft. This is very similar to car/house/asset insurance policies which would require the insures to have taken adequate measures to secure those assets. Negligence in securing is normally the reason for insurers not paying up for the insured's loss.”

What's in it for SPs?
So as SP you may be wondering whether you can safeguard your or your employee's assets with the insurance in place? Well, the good news is that you can.

Khare stated, “Employee's assets can come under this policy. Data privacy laws are big in US and the trend is coming to India. At the same time we have to comply with federal laws.” However, Desai added, “As of now identity insurance is not a very effective measure because it does not stop you from becoming a victim it just helps you cover some of the monetary costs in recovering what you have lost.”

Karthik of MacAfee on the other hand had a word of caution for people looking to buy the policy. “While going for the policy, one should weigh the risk against insurance premium and if the premium is high when compared to the risk it is the individual's choice whether he wants to go for the policy or not,” he opined.

Leveraging on the trend
Although one cannot provide the insurance policy but the partners can leverage on this trend by way of providing solutions around data protection.

Sriram Vishwanathan, Channel Manager-India & SAARC, RSA opined, “Yes, there is a lot of scope for channel partners to leverage this space. Partners can provide solutions and consulting services around data protection, encryption technologies and key manage-ment. In addition to this, there is a lot of associated work with securing the storage of this information.”

RSA has been undertaking a number of exercises to educate its partners and have also done workshops for them in this area.

Sriram further elaborated, “RSA has been informally involved in educating and training SPs in this area. However, RSA is now in the process of formulating and conducting training programs to better equip partners in educating and selling our products to their end-customers.”

The SPs take
On speaking to the SPs few did suggest that they had a vague idea about the trend but at the same time were not aware of the highlights of the policy. Hence, as an SP if your business does not store critical information on server or back office then you may consider buying the policy only for yourself and not for the company.

Harison Sharma, CEO of Mumbai-based Solus Software Systems indicated, “I am aware of the terminology and the trend revolving around the same. If there is such a policy that covers expenses for stolen identity and covers cost associated to legal fees for defending criminal charges associated with is offered, I would like to buy it. This seems the best possible solution given the fact that security is always one of our key concerns.”

Ajay Khurana, CEO of Kolkata-based Microteck Software stated, “Though I don't think that such a policy exists in India but identity theft is a concerning issue. However, if offered, companies irrespective of its size will consider buying one.”

Delhi-based Sanjeev Bhavnani, CEO, Visesh Infotecnics added, “Given the rate at which cyber crimes are increasing companies won't mind buying such a policy if offered.”

Pooja Sharma
poojas@cybermedia.co.in

Page(s)   1