PARIS & Identity Theft

Jessica Brinks

IP Locator Analyst

Michigan Department of Health & Human Services

Office of Inspector General, Investigative Analytics Unit

Ohio Identity Theft Case: Caught in the Act

u Mr. and Mrs. Smith move from West Virginia to Ohio to live with Mr. Smiths cousin,

Misty, who has 4 children, including a newborn

u Mr. Smith gets caught when Mrs. Smith finds out that Mr. Smith is the father

of Mistys newborn

u Mrs. Smith leaves Mr. Smith and returns to West Virginia

u Mrs. Smith applies for and receives assistance using the identities of Misty and

her children in West Virginia

u PARIS match occurs for Misty and the children between Ohio and West Virginia

u Mrs. Smith gets caught

Michigan Identity Theft Case:

Its weirdI actually believe her

u Started with a PARIS Interstate Match

u Client #1 receiving benefits in Michigan and Texas

u OIG Agent spoke to Client #1 who stated shed never lived in Michigan

u Agent found no other information to substantiate Michigan residence

u Contacted OIGs Investigative Analytics Unit for assistance

Client #1: Application Phone Number

Applications placed using 123-456-7891

Cases using 123-456-7891

IP Addresses of recipients using 123-456-7891

Michigans Internet Protocol (IP) Tracking

u IP Addresses are captured when someone visits MI Bridges

u Whether an:

u Application is submitted

u Or an individual checks on, or changes, some aspect of a previous application or current assistance case

u Michigan uses MaxMind to identify the location and the Internet Service Provider (ISP) of the matched IP address

u These two in combination are key to identify positive hits

u https://www.maxmind.com/en/geoip2-isp-database

u GeoIP2 City & ISP Databases

https://www.maxmind.com/en/geoip2-isp-database

Michigans Internet Protocol (IP) Tracking

u These IP addresses can be used to:

u Identify individuals who are applying from out of state (or country)

u Weve had someone apply from Turkey!

u Identify individuals who are students, but not reporting

u Individuals who have not placed an application, but have left the state and continue to check on their benefits

u Identify/link together Identity Theft/Identity Theft rings

u Identify recipients on social media

MI Bridges Account Information

u MI Bridges account information is captured when an account is created and/or information is updated by the individual

u Account Data:

u Username

u First & Last Name

u Phone number

u Email address

u Security Questions

MI Bridges Username Pattern 5522

If a username was forgotten, a second username

was created

First name & 5522

Last name & 5522

Partial name & 5522

Variations of 5522 552211 2255

Additional Connections: Email Addresses

It looks like you want to commit fraud.

Id recommend not putting your name in the

email address

Additional Connections: Physical Addresses

Multiple addresses were used

Recipients did not just stay at one address for the life of their case

Addresses were modified

PO Boxes sometimes looked like apartments

Customer Service Call: Receiving mail-PO BOX

Side Note: UPS P.O. BOXs

Initial Findings

u Over 120 recipients were found to be linked via a combination of:

u Phone numbers

u Email addresses

u IP Addresses

u Physical Address

u MI Bridges Username patterns

PARIS Matches

u Of the 120+ recipients, 14 hit on PARIS Interstate matches with the below states:

Alaska California District of Columbia Florida New Jersey New Mexico North Carolina Ohio Pennsylvania Texas Vermont

Suspect

Identified!Via: Email addresses Phone numbers Physical addresses IP addresses Facebook Store video footage Multiple subpoenas.

A Joint Operation

u Partnered with:

u USDA-OIG

u United States Department of

Agriculture-Office of Inspector General

u AUSA

u Assistant United States Attorney

Question #1: How do you find someone who is living as

someone else and constantly moving?

Answer #1:Facebook!

Question #2: How do you make sure theyll be home

when you serve your warrant?

Answer #2: Facebook & Hotels.com

http:Hotels.com

Findings of the Search Warrant

u List of 700+ stolen identities

u Names

u DOBs

u SSNs

u State of residence

u Employment information

u Banking information

u Background checks

u EBT cards

The Damages

u300+ Food Assistance applications using stolen identities

u$518,000+ in Total Fraud

Customer Service Call:When you cant keep track of where your card goes

The Outcome

United States v. Pamela TribbyCase No. 15-CFR-20497

u Plead guilty to:

u Identity Theft: 18 USC 1028(a)(4)

u Theft of Public Money: 18 USC 641

u Sentenced to:

u 70 months in prison

u 3 years probation

u Full Restitution of over $518,000

u Lifetime disqualification from Food Assistance

Structure Bookmarks12345678910111213141516171819202122232425