I've seen variations of this posted in many groups and lists, and of course we have heard of similar (though perhaps smaller) incidents in the past. Yet nobody ever seems to ask the obvious question: why does ChoicePoint deliver sufficient information for identity theft even to "legitimate" businesses? More abstractly, why is the information required by an entity to verify the identity of a consumer also sufficient for someone to obtain credit or cash in the name of that consumer? There are many ways to set things up such that this is not the case. They range from the highly technical (e.g., public key crypto) to the procedural (credit inquiry locks).
IMHO, the current system is designed purely for the convenience of the financial institutions. The consumer is expected to disclose whatever personal information the bank requests and, if the bank likes what it hears, the consumer may get his money, credit, etc. The system is not only haphazard and insecure but unidirectional: there is barely any notion of the bank's authenticating itself to the consumer. It is because many consumers are conditioned to respond unquestioningly to anything that appears to be acting on the bank's behalf that the many phishing scams (online and otherwise) are practical.
Recently in my area we had a rash of ATM fraud. The scam involved replacing the door entry card reader at enclosed ATMs with one which recorded the customer's information, and installing minicams to watch the PIN entry. I'll bet that these incidents will be used to push SecureIDs or similar contrivances which force the consumer to jump through additional hoops to prove herself to the bank while doing little to address the underlying problem. N.B. I'm not opposed to high-tech solutions, but we need to think in terms of mutual authentication and zero knowledge proofs (concepts that have been around for so long that most of the patents have expired :). Again, more abstractly, we need to recognize that it is as important for the bank to prove its identity to the consumer as it is for the consumer to prove her identity to the bank.
Dan Lanciani ddl@danlan.*com