Why Identity Theft is a Crime

Imagine getting a call from a collection agency that tells you to pay the $ 4,000 you owe from a local department store. The same day, you notice on your answering machine another call from an unknown caller, which is a collection agency for the local sports chain in town. The most common reaction is Whatever, I will call them when I get a chance and let them know they have the wrong person . . . . . big companies never get it right.

The next few days bring a few more calls from numbers that appear also to be collection agencies. While it bothers you, there is little alarm. Then imagine that you arrive home from work and you are met by police officers who talks with you for a few minutes and then proceeds to arrest you.

Incredibly, this is happening in large and small towns throughout the United States. The reason: Identity Theft . . . Criminals are regularly taking the identity of individuals without their knowledge, using it quickly to engage in credit fraud that makes hundreds of dollars in minutes for the knowledgeable criminal.

Using a variety of methods, criminals steal victims Social Security numbers (SSN), driver's license numbers, credit card numbers, ATM cards, telephone calling cards, and other pieces of individuals' identities such as date of birth. They use this information to impersonate these victims, spending as much money as they can in as short a time as possible before moving on to someone else's name and identifying numbers.

There are usually two types of identity theft. "Account takeover" occurs when a thief acquires a victims existing credit account information and purchases products and services using either the actual credit card or simply the account number and expiration date. "Application fraud" is where a criminal uses a victims SSN and other identifying information to open new accounts in that name. Victims are not likely to learn of application fraud for some time, because the monthly account statements are mailed to an address used by the imposter. In contrast, victims learn of account takeover when they receive their monthly account statement. This guide discusses strategies for reducing the risk of both types of fraud.

If properly prepared, victims of credit and banking fraud are liable for no more than the first $50 of the loss. (15 USC sec. 1643). In many cases, the victim will not be required to pay any part of the loss.

The problem is that while certain state and federal statutes protect the victim from being liable for losses, there is often no protection for the credit report aspects of this crime. Victims are frequently left with a bad credit report and must spend months and even years regaining their financial health. In the meantime, they experience extraordinary difficulties getting credit, obtaining loans, renting apartments, and even getting hired. Victims of identity theft find little help from the authorities as they attempt to untangle the web of deception that has allowed another person to impersonate them.

Criminals have become very organized and sophisticated about the means they use to obtain the identifying numbers of a person. All types of methods are now used to obtain SSNs, drivers licenses, credit card numbers and other pieces of identification. Some of these include:

• "Dumpster diving" in apartment and town home trash bins for direct mail advertising credit card and loan applications and documents that may contain or lead to ones SSNs.
• Accessing credit report fraudulently, for example, by posing as an employer, loan officer, or landlord.
• Stealing mail from mailboxes and completing applications to obtain newly issued credit cards, bank and credit card statements, pre-approved credit offers, investment reports, insurance statements, benefits documents, or tax information.
• Obtaining names and SSNs from personnel or customer files in the workplace.
• "Snooping" at ATM machines and phone booths, often with binoculars or telescopes set up in adjacent apartments or offices, in order to capture PIN numbers.
• Finding identifying information on Internet sources, via public records that are placed for convenience or administrative use.

Can One Take Steps to Reduce the Chances of Identity Theft?

You cannot completely prevent identity theft. Knowledgeable criminals can commit identity theft relatively easily because of inherently lax credit industry practices and the ease of obtaining SSNs. There are a number of things you can do to reduce the risk of fraud. We have set forth a few of these things: Two of the most important tips of advice, are (1) check your credit report at least once a year; and (2) stop giving out or using your Social Security Number, even when asked.

Reducing access to your personal data:

1. To minimize the amount of information a criminal can steal, do not carry extra credit cards, your Social Security card, birth certificate or passport in your wallet or purse, except when needed. At work, store your wallet in a safe place.
2. If possible, do not carry other cards in your wallet that contain the Social Security number (SSN), except on days when you need them.
3. To reduce the amount of personal information that is "out there," consider the following:
• Take steps to remove your name from the marketing lists of the three credit reporting bureaus -- Equifax, Experian (formerly TRW) and Trans Union. You can do this by calling 888-5OPTOUT. Doing this will limit the number of pre-approved offers of credit that you receive. As we already indicated, these credit solicitations, when tossed into the garbage, are a potential target of identity thieves who use them to order credit cards in your name.
• You can sign up for the Federal Trade Commission's National Do Not Call Registry and the Direct Marketing Association's Telephone Preference Service. Your name is added to name deletion lists used by nationwide marketers. You may also need to register for your states "do not call" list, if it has one.
• National Do Not Call Registry, www.donotcall.gov, (888) 382-1222
• Telephone Preference Service, PO Box 1559, Carmel, NY 10512
• Do Not Call Registry interaction with state registries: www.ftc.gov/bcp/conline/edcams/donotcall
• Have your name and address removed from the phone book and reverse directories.
4. When ordering new checks, pick them up at the bank. Dont have them mailed to your home. If you have a post office box, use that address on your checks rather than your home address so thieves will not know where you live.
5. When you pay bills, do not leave the envelopes containing your checks at your mailbox for the postal carrier to pick up, or in open boxes at the receptionists desk in your workplace. If stolen, your checks can be altered and then cashed by the imposter. It is best to mail bills and other sensitive items at the drop boxes inside the post office rather than neighborhood drop boxes.
6. Install a locked mailbox at your residence to deter mail theft. Or use a post office box or a commercial mailbox service. When you are away from home for an extended time, have your mail held at the Post Office, or ask a trusted neighbor to pick it up.
7. Keep a list or photocopy of all your credit cards, bank accounts, and investments -- the account numbers, expiration dates and telephone numbers of the customer service and fraud departments -- in a secure place (not your wallet or purse) so you can quickly contact these companies in case your credit cards have been stolen or accounts are being used fraudulently.
8. Never give out your SSN, credit card number or other personal information over the phone, by mail, or on the Internet unless you have a trusted business relationship with the company and you have initiated the call. Incredibly, one of the most obvious ploys works exceedingly well. Identity thieves have been known to call their victims with a fake story that goes something like this. "Today is your lucky day! You have been chosen by the Publishers House Clearing Contest to receive a free trip to Jamaica. We have to have personal information to verify you as the winner and you can pick up your tickets this afternoon at the Merchant Bank. We do, however, need to make sure you are the person we selected, so you need to verify your Social Security number, credit card number and expiration date."
9. Reduce the number of credit cards you actively use to a minimum. Carry only one or two of them in your wallet. Consider canceling unused accounts. Even though you do not use them, their account numbers are recorded in your credit report, providing a tempting target for identity thieves. But be aware that reducing the number of credit card accounts might lower your credit score. Part of your score, is determined by having credit cards and installment loans and making timely payments. (For more information on credit scoring, visit www.myfico.com.)
10. Always take credit card receipts with you. Never toss them in a public trash container. When shopping, put receipts in your wallet rather than in the shopping bag. Many credit theft experts will strongly advise purchasing a shredder and making sure that each of these solicitations, which appear to be no more than simple advertisements, are shredded. These experts will tell you that a large organized criminal underworld has special machines that routinely piece together normally shredded materials gleaned from trash. These experts will recommend a cross-shredder to create difficulties for these criminal organizations to piece back together your otherwise shredded materials.
11. Never permit your credit card number to be written onto your checks. It is a violation, in some states for merchants to require this. As one example, California law (Civil Code sec. 1725), along with other laws in many states, puts one at risk for fraud.
12. Order your credit report once a year, [it is actually worth the expense to order it twice a year], from each of the three credit bureaus to check for errors and fraudulent use of your accounts. Credit reports cost $8-$9 in most states. If you are on a budget, order from one credit bureau now, from another in six months, and the third six months later. In one year you will have checked all three.
13. Some states are moving toward so-called freezing laws. Californians, for example, are now able to "freeze" their credit reports, a stronger alternative to fraud alerts. (California Civil Code 1785.11.2, implemented January 1, 2003) This law enables individuals to prevent others from accessing their credit files and thereby prevents thieves from opening up new credit card and loan accounts. Security freezes are available at no charge to identity theft victims and for an annual fee for non-victims. The California Office of Privacy Protection provides a guide on security freezes.
14. You do not have to be an identity theft victim to place a "fraud alert" on your three credit reports. With the alerts, you can place a statement on your files requesting credit issuers to call you at your phone number before issuing credit. In this manner, if a criminal attempts to open credit in your name, the credit grantor will contact you first. Naturally, there is no guarantee that these credit agencies will pay attention to fraud alerts, so this strategy does not ensure that you will prevent identity theft. When you place fraud alerts by phone, the credit bureaus give you a temporary alert, good for only a few months. If you wish to extend the fraud alert, you must write the three credit bureaus and request a seven-year fraud alert.
15. Watch the mail when you expect a new or reissued credit card to arrive. Contact the issuer if the card does not arrive.
16. One of the newest forms of combat for victims are credit-monitoring services. Several companies, including the three credit bureaus, offer credit monitoring services for an annual fee ranging from $50-$120 a year. They notify you when there is any activity on your credit report, thus alerting you to possible fraud. While each person must decide for themselves is this protection is worth the cost, we believe that individuals should know of this option. In only six states it is the law that consumers should be able to obtain one free credit report a year from each bureau: Colorado, Georgia, Massachusetts, Maryland, New Jersey, and Vermont.
17. When creating passwords and PINs (personal identification numbers), here are some factors that criminals can easily discover: the last four digits of your Social Security number, mothers maiden name, your birthdate, middle name, pet's name, consecutive numbers or anything else that could easily be discovered by thieves. Instead, create passwords that mean nothing to anyone.
18. Ask your financial institutions to add extra security protection to your account. Most will allow you to use an additional code or password (a number or word) when accessing your account. Do not use your mother's maiden name, SSN, or date or birth, as identity thieves easily obtain these.
19. Obvious to many, but apparently not to all is the fact that one should memorize all your passwords. Do not record them on anything in your wallet.
20. Shield your hand when using a bank ATM machine or making long distance phone calls with your phone card. "Shoulder surfers" may be nearby with binoculars or video camera.
21. Protect your Social Security number (SSN). Release it only when absolutely necessary (like tax forms, employment records, most banking, stock and property transactions). The SSN is the key to your credit and banking accounts and is the prime target of criminals. If a business requests your SSN, ask if it has an alternative number that can be used instead. Speak to a manager or supervisor if your request is not honored. Ask to see the company's written policy on SSNs. If necessary, take your business elsewhere. If the SSN is requested by a government agency, look for the Privacy Act notice. This will tell you if your SSN is required, what will be done with it, and what happens if you refuse to provide it. If your state uses your SSN as your drivers license number, ask to substitute another number.
22. Do not have your SSN or drivers license number printed on your checks. Do not let merchants hand-write the SSN onto your checks because of the risk of fraud. There is no law against this, so you may need to be assertive.
23. Examine your Social Security Personal Earnings and Benefits Estimate Statement each year to check for fraud. The Social Security Administration mails it to adult-age SSN holders about three months before the birthday. The SSA web site has additional information, www.ssa.gov/mystatement. Reach them by phone at (800) 772-1213.
24. As we discussed, be careful not to carry your SSN card in your wallet except for situations when it is required, the first day on the job, for example. If possible, do not carry wallet cards that display the SSN, such as insurance cards, except when needed to receive healthcare services. A California law places restrictions on the display and transmission of SSNs by companies. It is being phased in through 2005.
25. If you live in a state that uses the SSN as the drivers license number, we recommend that you contact your Department of Motor Vehicles and request a different number. This can be done, although one will receive a fair amount of resistance unless one insists.
26. One thing that is critical is to install a firewall on your home computer to prevent hackers from obtaining personal identifying and financial data from your hard drive. This is especially important if you connect to the Internet by DSL or cable modem. Also, install and update virus protection software to prevent a worm or virus from causing your computer to send out files or other stored information.
27. Password-protect files that contain sensitive personal data, such as financial account information. Create passwords that combine 6-8 numbers and letters, upper and lower case.
28. When shopping online, do business with companies that provide transaction security protection, and that have strong privacy and security policies.
29. Before disposing of your computer, remove data by using a strong "wipe" utility program. Do not rely on the "delete" function to remove files containing sensitive information.
30. Each month, carefully review your credit card, bank and phone statements, including cellular phone bills, for unauthorized use.
31. Store personal information securely in your home, especially if you have roommates, employ outside help, or have service work done in your home.
32. Do not toss pre-approved credit offers in your trash or recycling bin without first tearing them into small pieces or shredding them. They can be used by "dumpster divers" to order credit cards in your name and mail them to their address. Do the same with other sensitive information like credit card receipts, phone bills, bank account statements, investment account reports, and so on. Home shredders can be purchased in many office supply stores. Many experts recommend crosscut shredders.
33. Demand that financial institutions adequately safeguard your data. Discourage your bank from using the last four digits of the SSN as the PIN number they assign to customers. If you have been given the last four SSN digits as a default PIN, change it to something else. Insist they destroy paper and magnetic records before discarding them. By not adopting responsible information-handling practices, they put their customers at risk for fraud.
34. When you fill out loan or credit applications, find out how the company disposes of them. If you are not convinced that they store them in locked files and/or shred them, take your business elsewhere. Some auto dealerships, department stores, car rental agencies, and video stores have been known to be careless with customer applications. When you pay by credit card, ask the business how it stores and disposes of the forms. Avoid paying by credit card if you think the business is not careful. When paying with credit cards on the Internet, be sure the company uses secure transmission and storage methods.
35. Store canceled checks in a safe place. In the wrong hands, they could reveal a lot of information about you, including the account number, your phone number and driver's license number.

For More Information Credit Reporting Agencies

Order credit report/Report fraud

• Equifax (800) 685-1111 (800) 525-6285
• Experian (888) EXPERIAN (888-397-3742) (888) EXPERIAN (888-397-3742)
• TransUnion (800) 916-8800 (800) 680-7289

Federal Trade Commission Identity Theft Clearinghouse

• Phone: (877) IDTHEFT (877-438-4338)
• Web: www.consumer.gov/idtheft
• FTCs free 34-page identity theft guide, "Take Charge: Fighting Back Against Identity Theft," available by phone and www.ftc.gov/bcp/conline/pubs/credit/idtheft.htm

Additional web sites:

• U.S. Dept. Of Justice, identity theft information, www.usdoj.gov/criminal/fraud/idtheft.html
• U.S. FBI, identity theft information, http://www.fbi.gov/publications/financial/fcs_report052005/fcs_report052005.htm#e1