Is a full name and address all that's needed for identity theft?

Question

It seems knowing a person's name and address is pretty much all that's needed for identity theft, no?

Couldn't those two variables enable one to pose as another person successfully? Given so, it makes it much, much easier to steal someone's identity with such easily obtainable things than would be for other difficult means (like phishing, hacking someone's personal account/computer, etc.).

Simply knowing an address where a person lives and their full name seems to be all that's needed to kickstart identity theft, and from what I can tell both of those things can be extremely easy to get.

So is a name and an address linked to that name all that's needed to steal a person's identity?

Imagine, for example, that you call a bank to say that you forgot your account number, but you provide the name of the person's account you're looking for plus their address and account type. Isn't that halfway to accessing someone's account already? I'd imagine not much else would be needed. They can't ask for social security number over the phone, and this sounds like a thief's dream.

Answer 1

How much is needed in order to perform "identity theft" largely depends on what you're qualifying as "identity theft". Regardless of this, it also depends upon what a given service provider requires for identification & authentication when someone contacts them for service on an account or to open new accounts.

Sometimes, name and address are indeed all that's needed. Sometimes, it's more. Sometimes, it may arguably be even less.

As for jump-starting identity theft, you don't even need that much. Just a person's first and last name can be enough. For some publicly-searchable databases - government-provided ones, no less - that's all you need to look up records which will contain ridiculous loads of additional PII. You might have a hard time nailing down a particular individual by name alone if theirs is common, like "John Smith". But it's a pretty fair bet that you can easily find whatever you want on a (hypothetical) "Joaqim Sikowicz" without knowing anything else about them.

As a particular example, I recently had to search for certain records regarding a traffic incident. Using only a person's first and last name, and a government-provided, publicly-accessible website that requires no registration, I was able to find:

• Full Name (First, Last, Middle, Suffix)
• Physical Address
• Date of Birth
• Telephone Number
• Driver's License Details (Number*/Class/Expiry)
• Physical Description (Race/Gender/Height)
• Vehicle Description (Year/Make/Color/Style)
• VIN
• License Plate (Number/Expiry/State)

*-About the Driver's License Number, it's worth noting that these can often be simply derived from other trivially-obtainable PII. A quick Google search will turn up several sites where you might be able to do this with as little as: Name, DOB, Gender.

Also be aware that there are (or at least appear to be) zero restrictions against asking for one's SSN over the phone. I've had it done to me several times. Usually this is during a first-time account setup, but occasionally it's also happened for verification purposes where I have a pre-existing account. Where there's already an account established though, it's generally more common to just get asked for the last four digits.

Answer 2

The question needs some clarification in terms of the specific risks being discussed. Threat analyses apply to very specific risk profiles. In each case there are many points at which vigilant, honest business people can and do stop fraud attempts.

Do you mean "what does it take for someone to commit some type of fraud in your name?" In this broad case, someone can pose as you by just using your first name and no address. But often these people do not have the necessary ID documents to commit serious fraud.

Perhaps you mean Internet fraud, where a person opens a social media account pretending to be you. In this case, the con artist only needs your name.

Perhaps you mean financial fraud in your name. In this case, sometimes the fraudster often needs name, SSN, drivers license, and a slick con. Or, they need your name, your credit card number, and sometimes a drivers license. Recall that obtaining a drivers license in your name usually requires a birth certificate or passport.

Or perhaps you are asking about tax fraud. This requires name, SSN, and exquisite timing on filing fraudulent tax documents.

Or perhaps you mean to ask about health insurance fraud. In this case, the thief needs name and insurance ID. This appears to be the easiest type of fraud to commit, currently.

Or perhaps you mean theft of money from your financial account. In this case, sometimes the thief needs name, SSN, account number, and a very slick con. In many cases the thief needs further identification, drivers license, passport, birth certificate, etc. These people are stopped all the time by vigilant financial institutions.

If you want to learn more about fraud and identity theft, visit South Florida and chat with people about it. Florida is the fraud capital of the US, and people down there know all about the ways it is done and how to avoid it.

Answer 3

Not really because it's not enough info that institutions like banks will verify identity with (they will probably ask "secret questions," or card number/pins, but those may be known by the thief too), but you could do some bad things with such info already that can cause problems.

Somebody once ordered packages and they paid with their own payment method, but they used my name and address and had things sent to me, which I found a bit creepy/weird (not mentioning what the things were here). They could have done this with a gift card or some other way in which their identity could be hidden somewhat. So, in any case, it's not good, but it's not the ultimate gateway to identity theft just to have someone's name and address. One other thing this can cause is toying with social engineering and various deception techniques, which could, in theory, become identity theft.

For example, you could sign someone else up for something and it or someone can be mailed/arrive at the name and address you give of another -- this isn't identity theft, but it can be harassment/etc.