The man on the phone called himself James Garrett.
Speaking with a lilting accent, the man said he was an executive with a Los Angeles company called M.B.S Financial. He told an employee at ChoicePoint Inc. that he wanted to open an online account with the company to receive electronic reports on people.
It was the kind of request that ChoicePoint, one of the nation's largest information services, gets all the time. Thousands of corporate and government clients rely on the company to provide them with publicly available information on people for help in hiring, fraud detection, journalist research, national security and debt collection.
But the man's call last fall was different, according to a detective's description of the encounter and testimony presented in a later court hearing. Unknown to ChoicePoint, the caller was not Garrett, an actor in the Los Angeles area. Police said he was a con artist involved in a vast identity-theft scam that succeeded in making off with records of at least 145,000 people. The real Garrett was just another victim.
The imposter's attempt to gain access to even more files would not only expose the scam, but spark a national outrage and congressional hearings over whether the nation's growing commercial data industry is doing enough to guard personal information.
Yesterday, the burgeoning scandal led ChoicePoint to cut off access to some sensitive data to thousands of small businesses. The company also announced in filings with the government that two senior executives were under investigation by the Securities and Exchange Commission for stock trades that took place after they learned about the scheme last fall but before they made it public.
On the day the man called ChoicePoint in late September, he was close to getting what he wanted. He had already filed an application for the right to download reports to his computer, for about $15 each, claiming he needed sensitive personal information like Social Security numbers to track down targets of his collection agency.
But to the ChoicePoint employee on the other end of the line, something wasn't quite right. For starters, the caller used a Los Angeles copy store to fax his paperwork to open an account. That seemed strange for a businessman, and even more so when an in-house investigator realized that similar requests had recently been made by others in the Los Angeles area. Something also seemed out of kilter about the local government documents the man forwarded to prove his business existed.
Authorities in Los Angeles were called for help. The officer assigned to the case, a sheriff's detective named Duane Decker, asked the company whether it could lure the man posing as Garrett back to the copy store as part of a modest sting operation. ChoicePoint would convince Garrett he needed to go back to the copy store to sign a faxed copy of his application and send it back to the company.
The ruse worked. On Oct. 27, a man claiming to be Garrett showed up as promised at the Copymat store on Sunset Boulevard. He approached the counter, asked for a document filed for James Garrett and paid the bill.
Decker, lingering nearby, asked the man if he was Garrett. When the man said yes, Decker asked him to step outside. As they left the store, the detective said he thought he had an easy case in hand. He couldn't have been more wrong.
The man Decker stopped was Olatunji A. Oluwatosin, a 41-year-old Nigerian national. Oluwatosin claimed he was picking up the paperwork for another man named Bobby, according to testimony at Oluwatosin's court hearing.
On the way out of the store with Decker, Oluwatosin dropped the paperwork he had just received from ChoicePoint and other forms for a company dubbed Gala Financial. At the time, he was carrying five cell phones, only one of them in his own name. Three credit cards bore the names of other people, including at least one woman.
At Decker's request, Oluwatosin shared his address in North Hollywood. Once there, Decker said he found a printout of a ChoicePoint search involving another name, that of a man he later learned had lost $12,000 to identity thieves. Decker also found a receipt for a public storage business not far away. Before long, searching in unit B-245, Decker found what he later told a state court judge were the tell-tale signs of an identity theft operation: new televisions, electric generators and other products in shipping boxes stripped bare of details about where the goods came from.
The paperwork offered other leads. Decker found addresses that turned out to be commercial mail services. Investigators asked to see the unopened mail at some of those locations. One clerk brought out two large bags containing credit card applications, financial statements and other mail that had been redirected from homes around the nation.
Driving to more than a dozen commercial mail services in one day, Decker and a postal inspector identified redirected mail from more than 700 people. Further investigation revealed links to 22 other ChoicePoint accounts that had been opened under false pretenses.
"I realized that this was just absolutely huge and out of control," Decker said.
Identity theft and fraud has become a national problem in a few short years. In 2003, federal authorities estimated that about 750,000 people fell victim to some identity scam. Now the prevailing estimate is close to
10 million.Driving the rise is a growing number of clever criminals who use people's Social Security numbers and other facts of their lives to take on their personas to run up credit cards bills, empty bank accounts and commit other crimes. But consumer advocates say it's also the failure of so many information brokers, retailers and credit issuers to adequately protect records or do enough to stop swindlers by verifying the identities of customers.
Credit card companies, marketers and others have lost millions of files to hackers and identity thieves in recent years. Two years ago, ChoicePoint itself was hit by another identity theft scheme involving personal records of thousands of people.
ChoicePoint, based in Alpharetta, Ga., has assembled a huge trove of personal data in recent years. Much of that information, such as court rulings, driver records and real estate details, comes from government agencies. The company also purchases information from the three major credit bureaus and other information services.
Its ability to create and electronically transmit exhaustive dossiers on people makes it a favorite of many Fortune 500 companies, government agencies and law enforcement and Homeland Security authorities. Today, it has more than 100,000 customers and revenue approaching $1 billion, a large proportion based on the resale of details about individuals.
Before granting service, ChoicePoint typically requires a photocopy of a driver's license and business records on file with a state or local government agency. A ChoicePoint employee would then verify that such a person and company exists. Identity thieves skirted this system by using fake IDs and by setting up front companies on paper, registered with government agencies in phony names, according to court and company records.
Olatunji Oluwatosin pleaded no contest to identity theft in a California court last month. He was sentenced to 16 months in state prison. Authorities are still investigating who else may be involved in the scandal. They believe others, possibly many others, worked with him.
ChoicePoint officials, meanwhile, said they have since identified more than 50 accounts that appear to be phony. The company has warned people to watch for unauthorized activity on their credit reports and has offered to give them free access to that information, at an estimated cost of $2 million.
The real James Garrett said he first noticed that something was amiss when he received a call from a credit card company. The company told him that a card in his name had been redirected to another address. When Garrett went to police to report the fraud, police told him he was apparently part of an identity theft ring, possibly related to terrorist financing, Garrett said yesterday.
An investigator in the ChoicePoint case later told him that identity thieves had obtained not only his name and address, but his Social Security number, credit card password and mother's maiden name.
"They knew everything about me," Garrett said.
Behind the scenes, the case continues to expand. Decker and other authorities in Los Angeles have discussed the case with the FBI and Secret Service, which has indicated it may have another identity theft suspect with ties to the ChoicePoint case. The Federal Trade Commission has begun an inquiry.
At the same time, public ire is intensifying. Congress is planning to hold hearings about the breach and the information industry in general. Some of those hearings may involve questions about national security. Democrats, including Sen. Bill Nelson (D-Fla.) have asked for a study about how terrorists might use information brokers like ChoicePoint.
In response to the thefts, ChoicePoint said in an SEC filing that it is "discontinuing the sale of information products that contain sensitive consumer data ... except where there is either a specific consumer-driven transaction or benefit or where the products support federal, state or local government and law enforcement purposes."
"We fully support a continued national discussion of how to ensure that information is used responsibly, that the positive benefits of information use are preserved and that the illegal uses of data are severely punished," the company's filing said.
The company has defended the sale of hundreds of thousands of shares since November, before the scandal became public, by ChoicePoint chief executive Derek V. Smith and president and chief operating officer Douglas C. Curling, saying the transactions were part of scheduled sales arranged last fall. Smith said he personally did not know about the security breach until January.
Decker, meanwhile, said that after four months it feels like his investigation is just beginning.
"Sometimes you're looking at Social Security numbers, and all of the sudden a name pops out and you realize, 'These are real people, all of them,' " he information is out there," he said. "They could all be victims, if not now, in the future.
Special correspondent Kimberly Edds contributed to this story from Los Angeles.
Copyright 2005 The Washington Post Company
NOTE: For more telecom/internet/networking/computer news from the daily media, check out our feature 'Telecom Digest Extra' each day at
For more information go to: