Cont......

Verton says his findings suggest similar breaches may be taking place at an epidemic level across e-commerce, with insiders diverting vast amounts of valuable data to criminal circles.

In short, if your personal information resides in any database anywhere, it can become a target, even if you prefer to write checks and patronize bricks-and-mortar banks and stores.

'This stuff happens'

Apart from data thieves, another kind of crook specializes in converting the stolen ID data into goods and cash, using the Internet as a communications and distribution network.
Surge in attacks
Phishing: 73 million adults say they've received at least 50 phishing e-mails in the last 12 months.

Spyware: 80% of consumer PCs are infected with spyware.

Blended attacks: 63% of large companies say their main security concern is the increasing complexity of cyberattacks.

Corporate losses: 639 of 700 companies and government agencies surveyed lost $31 million worth of proprietary data and spent $43 million to clean up computer viruses.

Consumer risk: 13% of all Internet users have had a member of their household victimized by identity thieves, and 41% say they are buying less online due to security threats.

Sources: Gartner Research, June 2005; Web root, 2005 State of Spyware report; Deloitte 2005 Global Security Survey; CSI/FBI 2005 Computer Crime and Security Survey; Conference Board Research Center, 2005.

"The market is becoming more sophisticated," says Jim Melnick, former analyst for the Defense Intelligence Agency, now director of threat intelligence at security firm iDefense. "There's more differentiating of roles and services to streamline and accelerate cybercriminal activity."

The most widely cited measure of cybercrime activity comes from a 2-year-old Federal Trade Commission consumer survey, the first of its kind, which placed the number of Americans victimized by identity thieves at 10 million in 2003, with consumers losing $5 billion and businesses $48 billion.

The FTC plans to redo its identity theft survey early next year, and the results are expected to reinforce anecdotal evidence that cybercrime has intensified.

George Rodriguez, the North Carolina commercial real estate broker, doesn't need a government study to tell him the threat is increasing. When Rodriguez spotted a cybercrook attempting to transfer proceeds from his Ameritrade portfolio to a consumer account at Bank of America, he quickly called authorities to cut short the stock trades before they were settled.

But the experience left him wondering what might have happened if he had been on vacation or simply not using his computer that day.

A local detective identified the BofA account owner as Kevin Maguire, a 53-year-old corporate travel manager from Austin.

Contacted by USA TODAY, Maguire said he "has no idea" what happened to his bank account. He says BofA informed him of the incident, but said little else. "They just told me this stuff happens," Maguire says.

Investigators say cyberthieves probably intended to use Maguire's compromised account to launder Rodriguez's cash. To misdirect authorities, thieves typically transfer funds a number of times culminating in a cash withdrawal.

Dealing with the fallout of a cybercrime can be frustrating. Most banks espouse policies of making restitution to consumers who fall prey to online fraud, if the crime is reported within 60 days.

But that is not uniform. Ameritrade, which declined comment to USA TODAY, told Rodriguez in a short letter that it would unravel the bogus stock trades "as a one-time courtesy to you. ... Going forward, you are responsible for any transactions placed in your account."

"They treated me as if I screwed up," Rodriguez says, looking at the letter, shaking his head.

Contributing: Acohido reported from Seattle, Swartz from Gastonia, N.C.