By Ed Dadisho, Sergeant, Los Angeles Police Department, Los Angeles, California

The Preliminary Investigation
Generally, identity theft crimes will not be contained in one jurisdiction. Every investigation requires investigators to determine the point of compromise of the victim's identity-that is, where the offender may have obtained the victim's identification information. This will help lead to possible suspects and will often lead to additional victims.

properly structured preliminary investigation saves investigative time, involves the victim in resolution of the theft, and lays the foundation for prosecution.

The investigation starts with the victim's report of the theft. Victims should be informed of the steps they need to take to prepare for investigation. This enables victims to start doing something constructive immediately and helps fulfill their emotional needs. By providing a worksheet or explaining exactly what victims need to do, investigators help victims organize their thoughts and information. In preparing for the investigation, victims should gather the following information and materials and turn them over to the police investigators, being sure to keep any original documents related to the case:

• Date of birth, driver's license number, social security number, telephone numbers (work, home, and cellular), and e-mail addresses of every victim in the household


• Account numbers involved in the theft and the names of primary and secondary account holders


• When and how the fraud or theft was discovered, and under what circumstances the victim became aware of the identity theft


• Exact locations (addresses, businesses, persons involved) where fraudulent use of the identity occurred


• Name, addresses (home and work), phone numbers, date of birth of every person involved in the incident


• Names of financial institutions the victim has notified of the theft, along with the names, addresses, and phone numbers of customer service representatives or investigators who accepted the report, the dates and times of the reports, a brief summary of the conversation, and copies of any e-mail messages or faxes sent to or received from the financial institutions


• Photocopies of any letters, account statements, and other documents associated with the case


• A chronological log of the theft and the victim's actions since discovering the theft, to include information about the discovery of theft or fraud, possible locations of the theft, and names or descriptions of persons around when the theft might have occurred

During the early stages of the investigation it is important to determine the motive. The motive will help direct the investigation. The motive for financial crimes is usually greed, drugs, or revenge. Determining the motive requires investigators to conduct a detailed interview with the victim. The U.S. Secret Service, along with the IACP, has developed an outstanding 11-page document that investigators can give to the victim to fill out. This document is in effect a questionnaire filled with a variety of useful information to the investigator. This document can be obtained from the U.S.Secret Service/IACP "Identity Crime" CD-ROM; call the Secret Service or the IACP for details.

The Continued Investigation
The next steps taken by the investigator should be to examine all financial and credit bureau documents. These documents are useful and vital pieces of evidence to tie suspects to the crime and eventual prosecution. For help with this step, the investigator can contact appropriate state and local agencies, as well as the following federal agencies:

• Postal Inspection Service


• Federal Bureau of Investigation


• Bureau of Immigration and Customs Enforcement


• Social Security Administration


• Secret Service

The Secret Service has a program called E-Information, an intranet site that is available, for free, to law enforcement agencies and investigators. It is an important tool for investigators in accessing bank and credit card information. For more information, go to (www.einformation.usss.gov). The resources available on the Secret Service E-Information Network include the following:

• Bank identification number search


• Credit card and skimming information


• Counterfeit check database


• Genuine and counterfeit identification document database


• Cybercrime resources


• Fraudulent document database

FinCEN (Financial Crimes Enforcement Network) is another excellent network for investigating identity theft and other financial crimes. FinCEN links databases maintained by the law enforcement, financial, and regulatory communities. Its purpose is to collect, analyze, and share information with law enforcement agencies. FinCEN accesses approximately 37 different and independent databases in three main categories: law enforcement, financial, and commercial. The databases include AutoTrack, LexisNexis, the Social Security Administration Death Master File, and Drug Enforcement Administration, Federal Bureau of Investigation, and Internal Revenue Service databases, to name a few.

Another excellent tool for investigators is the use of informants. Investigators should develop informants from potential suspects during the investigation. Investigators should identify possible informants by using intelligence from other law enforcement agencies or the private sector. Another good technique to develop informants is using other people who participated in some capacity in the identity theft, such as a store employee who sold goods knowing the suspect was using someone else's identity.

Investigators should consider using other means to gain access privileged information. Obtaining federal cooperation and funds, seeking state and federal RICO statute investigations, or using forfeiture statutes to gain access to financial records. Above all, investigators should always follow the money; this is an appropriate investigative technique in any financial crime.

In January 2002 the IACP published a model law enforcement policy on identity theft. The purpose of the IACP policy is to enable police agencies to develop protocols for accepting, recording, and investigating the crime of identity theft. The IACPmodel policy suggests the following:

• An identity theft report should not normally be taken when a related crime report has already been filed with any law enforcement agency. If a resident of your agency's jurisdiction is not satisfied that another forgery-related report is sufficient, complete an identity theft report. Note in the narrative, "Victim insisted on report," and reference related reports.


• An identity theft report should not be taken in lieu of a worthless-document report. Specific forgery-related crimes shall continue to be reported on a worthless-document report.


• The location of occurrence for an identity theft is the victim's residence. Therefore, nonresidents of your agency's jurisdiction should be referred to the law enforcement agency having jurisdiction over their residence.


• Identity theft reports shall not normally be taken telephonically. Residents of your agency's jurisdiction making telephonic inquiries should be directed to appear in person at the nearest police station with copies of supporting documentation and identification to file a report.


• Officers conducting a preliminary investigation of an identity theft shall include with the report the following:

• Include all copies of documents supporting the allegation (credit reports, invoices, demand letters, affidavits of forgery, and so on) as pages of the report. If these documents are not available, explain in the narrative.


• Attach a copy of the victim's identification as a report page. If the victim is not in possession of identification at the time of the report, explain in the narrative.


• Include all notifications made by the victim to any financial institutions or credit reporting agencies in the narrative portion of the report.


• Cause the reporting person to sign the report and submit the report to a supervisor for approval.


• When the taking of the report is beyond the ability of the desk officer or requires expert knowledge, the desk officer shall refer the reporting person to a detective or agency unit specializing in theft crimes. When the concerned detective or unit is not available, referral shall be made to the watch commander. In all cases, the final interviewing officer shall take the report.

• Review the crime report and conduct any follow-up inquiries of victims or others as appropriate for clarification or expansion of information.


• Contact the FTC Consumer Sentinel law enforcement network and search the database for investigative leads.


• Contact other involved or potentially involved law enforcement agencies for collaboration and avoidance of duplication. These agencies include but are not limited to the following:

• Federal law enforcement agencies such as the U.S. Secret Service, the Federal Bureau of Investigation, and the U.S. Postal Inspection Service as appropriate, whether or not the victim has filed a crime report with them.


• Any state or local enforcement agency with which the victim has filed a crime report with them.

Obtaining Financial Information
Getting financial information for any fraud case can be a daunting task for the investigator, especially when cooperation is lacking. It is imperative that the investigator gain cooperation from both the victim and the financial organization. There are three ways of getting the financial information needed for an identity theft case: (1) search warrant, (2) subpoena power, (3) or consent. Consent is the simplest and most cost-effective. This article will assume that investigators are quite familiar with obtaining search warrants and subpoenas for their cases; therefore, we will concentrate more on obtaining consent through the victim and financial institutions.

As in other cases dealing with victims, identity theft cases require officers and investigators to develop a rapport with victims and witnesses to gain their cooperation. This is more important when dealing with victims who are experiencing an emotional crime such as identity theft, much like an assault victim. Comforting the victim and assuring them that the crime was not their fault will go a long way toward gaining their confidence and cooperation. Nevertheless, investigators should explain the potential consequences of being a victim of identity theft (the effect on the victims' credit, the financial loss, the amount of time the investigation may take, and the long-term issues relating to this crime).

Victims have an overwhelming need to be actively involved in the case because ultimately it is their reputation, their credit, and their family's livelihood on the line. Although this is the investigator's case and the officer must maintain control, giving the victim some sense of control will help develop information and evidence for a successful conviction.

Ask the victim to begin gathering and providing documentation, to include the following:

• Bank and credit card statements


• Letters from creditors


• Merchant account statements


• Any other financial documentation related to the crime

Ask the victim to obtain and voluntarily provide you the credit reports from the three major credit bureaus (Equifax, Experian, and TransUnion). A subpoena is needed from the courts if the victim does not voluntarily provide you with the credit reports. Remember, if the victim provides authorization the investigator can get the victim's identity theft-related transactions records from creditors without first obtaining a subpoena under the 2003 amendments to the Fair Credit Reporting Act.

Advise the victim to keep a log or a diary of everything they do or everyone they talk with regarding the crime. This can be used as part of the victim impact statement during any subsequent court proceeding. The FTC or ID Theft Resources Center provides valuable information on how victims can organize their identity crime cases.

The investigator should contact the financial institution or merchant security departments and ask for (or subpoena) documentation on all fraudulent or suspect accounts.

Identifying Additional Victims
There are many reasons why an investigator should locate and identify additional victims, but among the most important is to ascertain if there is a larger, organized ring victimizing the community. One way of doing this is by quarrying the FTC Clearinghouse for other reported complaints that may be related to the case. Investigators can also contact other agencies in the area to determine if there have been similar crimes reported and possibly connected. If that is the case, these agencies can combine resources and personnel into a task force to combat the crime.

Case Preparation
Filing the case criminally can be another daunting adventure for the investigator. However, if the case is well prepared, the criminal prosecutor will be better equipped to file the case. As noted earlier, the best way of preparing the case is having the victim play a role in the case by taking and keeping notes or a diary, requesting and collecting financial information regarding the identity theft, and taking an overall interest and partnership in the case.

The Los Angeles County District Attorney's Office has an active prosecuting unit involved with high-tech crimes. Deputy District Attorney Jeffrey McGrath indicated that the unit handles an average of 60 high-tech cases per year. Of the 60 cases, approximately 50 percent involve identity theft. Many more are brought for filing but they are declined because of the office's lack of resources. The prosecutors in the L.A. County District Attorney's Office must therefore be selective in the cases they accept for filing, and they focus on the large identity theft cases that involve an organized ring with multiple victims, losses, and suspects. Because of the cases they do file, and the investigations they receive from area law enforcement agencies, the unit has a 100 percent conviction rate.

According to McGrath the key to getting an identity theft case filed, and getting a successful conviction, is organization. The investigator has to organize the case logically. McGrath recommended that investigators use binders containing a contents page and dividers with tabs on each major section. In McGrath's words, "Avoid the brick." A brick is a giant stack of papers the district attorney has to shuffle through. Those cases will never get filed.

The binders need to include supporting documents such as search warrants, all financial account numbers for each victim, names and addresses of the financial institutions, and documentation for subpoena duces tecum that would be admissible in court. McGrath said it is fine to get all of the financial information from the victim, but eventually the court will require these in an admissible format. The binder also needs to include an outline of expected testimony from victims and witnesses.

McGrath recommended that the investigator have an outline of the particular law that is sought for filing when dealing with district attorneys who are unfamiliar with the law. List the requested charges and enhancements on the charging sheet, along with any additional charges.

The Future
The new FACT Act will invariably increase the number of victims reporting identity theft cases to local police agencies. But more report taking is not the only problem facing local police agencies. This influx of reports will require at least a preliminary investigation if not a full investigation and filing with the local prosecutor. This reporting influx will require police agencies to look at the problem as any other crime affecting the community and begin comprehensive problem resolution strategies.

To provide the level of service required by the community, police departments must prepare for the increase of identity theft victims reporting identity theft crimes. Police agencies can prepare by teaching the public how to prevent and report identity theft and training officers in the prevention and investigation of identity theft crimes and other financial crimes. Having a robust community education program, such as providing pamphlets on identity theft prevention and organizing community and business meetings, will help a police department reduce the likelihood of community members being victimized.

Police officers must be knowledgeable about state and federal laws relating to identity theft and other fraud crimes so that they can identify violations involving identity theft and peripheral criminal activity that are related, such as burglary or robbery, that specifically target financial information. These peripheral crimes could lead to bigger cases involving criminal rings. Investigators should receive training in conducting complex financial crime investigations involving multiple suspects, victims, and witnesses. The investigator must be knowledgeable in interviewing techniques, evidence collection, and presentation of evidence to ensure cases are filed with the local prosecutors office.

All of this can be done at little or no cost to local police agencies by merely asking for assistance from government or private organizations. Government agencies such as the FTC, the FBI, and the Secret Service have excellent resources and training tools; resources such as FinCEN and Consumer Sentinel are available to all law enforcement agencies; one needs only to apply. Private nonprofit organizations such as the IACP and NW3C provide training for police officers and investigators in all facets of high-tech crimes, including identity theft. The training provided by the NW3C is available at no cost to any law enforcement agency, along with any resource material they publish. ■