Identity Theft: Interviewing and Prosecuting Suspects, Part Two

Examining identity theft suspects requires systematic, methodical techniques designed to yield evidence for possible prosecution.

If an identity theft suspect has been arrested, request copies of the mug shot, fingerprints, palm prints (if taken), and the booking or arrest sheet. The booking sheet will usually contain an address, emergency contact, or next-of-kin information and possibly attorney and bonding information. Bail bondsmen can be helpful in locating suspects.

If you interview the suspect in custody and you're a law enforcement officer, make sure the suspect understands his or her Miranda rights. If you're not a law enforcement officer, you don't have to give the Miranda warnings, but it doesn't hurt to "remind" the suspect of them, to avoid a "silver platter" issue later if the suspect confesses to you and you later provide the confession to law enforcement. Reduce whatever the suspect tells you to writing. If you're authorized to do so, take a sworn statement. If not, take a witnessed, written statement. Many prosecutors prefer the second type. If the suspect's guilt is reasonably certain, yet he or she persists to deny, take the negative statement and use it later to attack the suspect's credibility if necessary.

Questions, Questions  

Following are some of the questions you should ask or information you should obtain:

1. Where and how did he get the personal identification information?
2. What was he going to do with that information?
3. What was the motive? Why did he do it?
4. Where and how long has he been doing it?
5. What did he do with the money or merchandise?
6. Who else is involved? How much did he have to "kick back?"
7. How did the scheme operate?
8. How much money was realized from the scheme?
10. What things made it easy for him?
11. How did he make the checks?
12. How did he make the identification cards?
13. How did he get started? Was he recruited? By whom?
14. Does he know of anyone else doing the same thing?
15. What hotels and motels has he stayed at? (Many identity thieves work out of extended stay hotels or motels.)
16. If the case involves stolen, washed, forged or counterfeit checks, get an admission that the subject never had any association with the business or person whose name appears as the accountholder.
17. What vehicles were used and what were their descriptions?
18. What phone numbers does the suspect have or know for the other suspects?
19. Get informed, voluntary written consent for anything worth searching, including computers.
20. If family members are involved in the scheme, try to pin down family relationships by blood or marriage. In one of my cases, the answers to such questions "fleshed out" the scheme and helped focus attention on persons previously ruled out.

Instruct the suspect to date and initial copies of any pertinent checks, credit cards, applications or other documents for later identification. If you take a written statement, it should reference these documents.

Writing Samples, Speed Freaks, and Mug Shots  

Take general cursive and printed handwriting exemplars. The "London Letter" form incorporating the alphabet, numerals, and letter combinations is commonly used. I use a supplemental form which has "written out" numbers, such as those on checks, to copy. My supplemental form also incorporates common payees such as local phone, and utility companies and chain, discount, and specialty stores. This form once helped me identify a forger who always spelled the word "hundred" as "hundrend."

Take specific exemplars of the victim's written and printed name. If you have a copy of the suspected credit or account application, get samples of the addresses, phone numbers, dates, and other information entered on the form by the fraudulent applicant. Numerals can be as distinctive as letters.

Interview methamphetamine abusers or "speed freaks" after they've been in jail for a day or so. Freshly arrested speed freaks often still have a drug-induced attitude. They become much more cooperative after some time in custody.

If the suspect has been arrested at a bank or store, determine if the store has the suspect on surveillance video and recover that tape as soon as possible. Get the names, addresses, phone numbers, dates of birth, and driver's license numbers of all witnesses who dealt with the suspect. If fraudulently obtained merchandise was loaded onto a customer's vehicle, the loading invoice may have a vehicle description or tag number. Get any paper the suspect may have handled or signed, including checks and sales slips. Many times, when the transaction is interrupted and suspect flees, he will leave his bogus identification behind.

As soon as you can, if warranted or desired by the local prosecutor, show a photo spread of mug shots to witnesses. The spread should have at least six similarly sized photos. The photos should be the same gender, race, and about the same age as the suspect. If the suspect has a beard and wears glasses, then all the people in the photos should have beards and glasses. The background of each photo should be similar and there should be no markings or anything else that could be construed as suggestive or distinctive. The photos should all be of similar size. Randomly place the photo of your suspect into the spread. Photocopy the finished photo spread and ask the witness, if he or she makes a positive identification, to date and sign either above or below the suspect's picture, and date and initial the other pictures in the photo spread. Make up a different spread for each suspect. Don't put multiple suspects in the same spread.

Compile a folder for each witness with the statement or interview and copies of any documents, records, or other items that the witness may have to introduce or authenticate. I also run criminal history checks on my witnesses. A felony conviction can impeach a witness, and prosecutors don't like surprises like that.

Help from Police, Computer Examiners, and Prosecutors  

Police officers who aren't involved in your examination need to be aware that what they observe and confiscate during arrests for other offenses can indicate the suspects are also involved in identity theft. For example, you should follow up leads such as possession of computer-generated blank checks or checks in another's name; multiple IDs and credit cards in other names; mail addressed to different names; and computer equipment such as CPUs, printers, and disks. A trained forensic computer examiner can be invaluable. In addition to retrieving images from a recovered computer, the examiner, in cooperation with the credit issuer, can track down the Internet Protocol addresses and Internet e-mail addresses that lead to the suspects.

When the examination is completed, confer with the local or federal prosecutor to decide which charges to pursue. State or province violations may include forgery, credit card abuse, theft, theft by check, theft by deception, possession of a forged instrument, fraudulent use of identifying information, possession of false identification, possession of stolen property, or possession of stolen financial information.

Federal charges may include bank fraud, mail fraud, credit card fraud, possession of stolen mail, false statements, fraud in connection with access devices, and fraud and related activity in connection with false identification documents.

Become familiar with the elements of every applicable state, province, and federal statute to select one or several charges which are best supported by the proof developed. It's better to pursue a few solid charges than try to track down every offense and every penny lost, although an overall loss figure will usually be needed for sentencing. One substantive count and one conspiracy count will usually suffice. It's a good practice to include one major substantive offense and one lesser substantive offense in indictments as an inducement for plea bargaining.

Prior to any grand jury testimony thoroughly review the case and be prepared to describe the crime as succinctly as possible. If the case involves a hierarchy or a division of labor, the testifying fraud examiner should consider the use of charts and other visual aids, if permissible.

Going to Trial  

Conduct your fraud examination as if you'll go to trial. Don't cut any corners and do everything right the first time, if possible. Prior to going to trial:

1. Make sure all forensic laboratory work is completed and reports and exhibits are ready.
2. Verify addresses and phone numbers of witnesses.
3. Associate items of evidence with the witness who will introduce or authenticate it. Follow the prosecutor's order of proof.
4. Remind your victims and witnesses to dress properly for court. Find out what the judge prefers.
5. Provide transportation for your witnesses to and from court if necessary.
6. Make sure all charts and graphics are clear and understandable.
7. Get certified copies of Federal Deposit Insurance Certificates, if applicable to the case.
8. Get certified copies of all the defendant's prior convictions, and copies of the police or investigation reports if possible.
9. Make sure all audio tapes are accurately transcribed.
10. Make sure that any audio-visual equipment to be used at trial is in working order.

Organize your files by victims, witnesses, evidence, contacts, reports, and field notes. Organize your field notes in chronological order or some other logical order, such as by suspect, complaint, etc. Create witness files with their statements or interview reports, contact information, and background information including criminal histories, if necessary. These steps will keep you from digging around in your file for something you need. This will also help you organize and write your final report.

Lastly, think like a defense attorney. In fraud cases, defendants may adapt mistake-of-fact, good faith, or bad business practice defenses. Be prepared for these with proper documentation of interviews and other fraud examination steps. Look for the holes in your case and plug them.

Aggressive Investigation  

While prevention and public education are the best defenses against identity theft, this crime calls for careful, aggressive investigation and organization of evidence and information. The fraud examiner, after consulting with prosecutors, should select offenses that will be the easiest to prove such as bank fraud, mail fraud, forgery, or fraudulent possession of identifying information.

The fraud examiner needs to approach identity fraud cases like a defense attorney and try to strengthen any weak points and, most importantly, consider the identity theft victim an active member of the examination team.

Peter J. Donnelly, CFE, is a deputy constable in Tarrant County, Texas. He is a retired U.S. postal inspector with more than 15 years experience in investigating identity theft and related crimes.