Is your identity being traded by criminals?

What do UK Metropolitan Police Fraud Squad Detectives do in retirement? One option is to build a massive database compiling records that are being traded by criminals online. That’s what Colin Holder and Tim Harvey decided to do. And it’s not a cheap endeavor.

Holder and Harvey have spent over $160,000 to create  Lucid Intelligence and say they now have a database with 120 million records in it, and that at least 40 million Americans are represented there.  If you’re among the (at least) 40 million, your e-mail address, password, credit card number, credit card pin, address, and/or social security number has been found on a “known criminal site,” according to Colin Holder, with whom I spoke last week.

You can find out whether your data are at risk over at Lucid Intelligence. The search is free, and will let you know whether you’re at risk, at no risk, or at high risk. (I’m not in the database – phew!) For a fee of ten British pounds ($16.50), you can find out exactly which data have been exposed and where.

Holder gave me a backend tour of the database that a normal user doesn’t get to see. Frankly, I was shocked by the extent to which some unknowing Americans’ personal details have been compromised and by which sites. Lucid also sent me a list of the top ten cities with citizens potentially imperiled. That Chicago and Brooklyn are on the list doesn’t seem surprising, given their population density. But cities like Fayetteville, N.C. and Sugar Land, Tex., made the list too.

The ten cities with the greatest number of records in the database are as follows:

Fayetteville, N.C.
Bristol, Conn.
Chicago
Raleigh, N.C.
Brooklyn, N.Y.
Atlanta
Sugar Land, Tex.
Baton Rouge
Houston
Lithonia, Georgia

So what does it mean to be in the database? Lucid Intelligence CEO Colin Holder took me on a virtual tour of the database. A normal user wouldn’t get to see the records laid bare the way that I did. I saw people’s names, social security numbers, credit card numbers,  credit card expiration dates, dates of birth, and ATM pins. (Don’t worry, I didn’t take notes on that.) According to Holder, this data comes from “trusted sources” who gather it from known criminal sites.

When the company discovers an exposed credit card number, it notifies Scotland Yard, which then sends the information to banks who presumably close the account and notify the credit card holder. The Lucid folks used to notify the banks directly, but they say they stopped doing this when they discovered banks were refusing to reimburse victims. In the banks’ eyes, those who appeared in the database were guilty of risky online behavior and were at fault for any resulting fraud.

Indeed, many of those that I saw in the database had gotten in there because of websites they’d visited. One victim had given his information to a site called GetYourGift.biz. Holder said that sites like these are not necessarily phishing sites, but that at some point they sold their data to another entity and that it eventually made its way into criminal hands.

There were a few famous folks in the database, but that portion of our tour was off-the-record.

Being in the database might mean that your identity is in peril, that someone might open an online loan using your details, or just that you’re likely to be added to a bunch of spam lists, as pointed out by the Washington Post. But the more important takeaway from finding yourself in there is that you need to be more careful about the sites that you visit and the information you’re handing over online.

What perplexes me more than someone handing over Paypal account information to a site like “GetYourGift” is why Holder and Harvey have sunk so much money into this creation. They have just one advertising partnership so far — with a company called Trusted ID — and are not making much money from individuals. Over the past three weeks, they’ve had 45,000 hits at their website, but only eight people have paid to find out why they are deemed “high risk” by the database.

“I’m a retired detective, not a businessman,” said Holder, who hopes to break even someday and is currently paying over £2,500 a month to maintain the database. “But I do hope something comes of it.”