9.5 Identity Theft

only for RuBoard - do not distribute or recompile

9.5 Identity Theft

In 1991, a car salesman from Orlando, Florida named Steven Shaw obtained the credit report for a journalist in Washington named, coincidently enough, Stephen Shaw. For Steven Shaw, getting Stephen Shaw's credit report was easier than you might think: for years, the consumer reporting firm Equifax had aggressively marketed its credit reporting service to car dealers. The service lets salespeople weed out the Sunday window-shoppers from the serious prospects by asking for a customer's name and then surreptitiously disappearing into the back room and running a quick credit check. In all likelihood, the Shaw in Florida had simply gone fishing for someone with a similar-sounding name and a good credit history.

Once Steven Shaw in Florida had Stephen Shaw's Social Security number and credit report, he had everything he needed to steal the journalist's identity. Besides stating that Stephen Shaw had excellent credit, the report listed his current and previous addresses, his mother's maiden name, and the account numbers of all of his major credit cards. Jackpot!

"He used my information to open 35 accounts and racked up $100,000 worth of charges," says Stephen Shaw. "He tagged me for everything under the sun car loans, personal loans, bank accounts, stereos, furniture, appliances, clothes, airline tickets."

Because all the accounts were opened using Stephen Shaw's name and Social Security number, all of the businesses held the Washington-based Stephen Shaw liable for the money that the other Shaw spent. And when the bills weren't paid, the companies told Equifax and the other credit bureaus that Stephen Shaw, the man who once had stellar credit, was now a deadbeat.

Stories of consumer fraud similar to what happened to Stephen Shaw have become epidemic in recent years. Called identity theft, this crime was relatively rare in the 1980s and early 1990s. In recent years, however, cases of identity theft have skyrocketed. It's now estimated that there have been more than a million victims of identity theft throughout the United States. Chances are that you know somebody who has been directly affected by this crime.

Sometimes the crook gets the personal information from inside sources. In April 1996, federal prosecutors charged a group of Social Security Administration employees with stealing personal information on more than 11,000 people and selling the data to credit fraud rings, who used the information to activate stolen credit cards and ring up huge bills. Other times, crooks pose as homeless people and rummage through urban trash cans, looking for bank and credit card statements.

Not all cases of identity theft start with a stolen credit report or a misappropriated bank statement. Some cases begin with a fraudulently filed change of address form, directing the victim's mail to an abandoned building. And no paper trail need be created at all. In May 1997, the Seattle Times reported that hundreds of people in the Seattle area had received suspicious crank phone calls. The caller claimed to be from a radio station that was giving away money; the check would be in the mail as soon as the people picking up the phone provided their Social Security numbers.

Some people found the calls suspicious and telephoned the station or the police. Others presumably handed over the information that the callers requested. Similar scams are epidemic on America Online, the world's largest online service, where they have been given the evocative name phishing.

Stephen Shaw says it took him more than four years to resolve his problems a period that appears to be typical for most identity theft victims. That's four years of harassing calls from bill collectors, of getting more and more angry letters in the mail, of not knowing what else is being done in your name. Four years of having your creditors think of you as a deadbeat. During this period, it's virtually impossible for the victim to obtain a new credit card or a mortgage. One of the cruelest results of identity theft is that many victims find themselves unemployable; in addition to job references, many businesses routinely check the credit reports of their job applicants.

9.5.1 Protecting Yourself From Identity Theft

Identity theft is made possible because companies that grant credit especially credit card companies are always on the lookout for new customers, and they don't have a good way to verify the identity of a person who mails in an application or places an order over the telephone. So the credit-granting companies make a dangerous assumption: they take it for granted that if you know a person's name, address, telephone number, Social Security number, and mother's maiden name, you must be that person. And when the merchandise is bought and the bills aren't paid, that person is the one held responsible.

Of course, it's relatively easy to learn a person's name, address, telephone number, Social Security number, and mother's maiden name. Credit bureaus hand this data out to their customers. Lookup services make this information available, at minimal cost, over the Internet. And many consumers, unaware of the risk, will readily divulge this information to people who call on the phone and claim to be from a bank or credit card agency.

There are lots of technical changes that could be made to lower the incidence of identity theft. One change, for example, would be to require a person applying for a credit card to show up in person and have a photograph taken, recorded, and put on the back of the credit card. This would act as a deterrent, because most identity thieves don't want to have records created that could be used to trace back to their actual identity. But few credit card issuers would ever mandate the use of photographs, as it would effectively end the industry's marketing strategy of sending credit cards to new customers through the mail, without the need to have local branch offices.

Fortunately, you aren't powerless. There are a number of strategies that you can use right now to help protect yourself from identity theft:

Shred your trash

One of the most common ways for crooks to get hold of your Social Security number and credit card accounts is to go rummaging around through your trash. Fortunately, there's an easy way to put an end to this problem: buy a personal shredder. In recent years, the prices of shredders have dropped from hundreds of dollars to less than $25. For $50, you can buy a fairly good strip shredder that sits on top of a trash can and will shred five pieces of paper at a time into long strips that present more trouble than most crooks are willing to handle. Remember, the goal of a shredder is not to make your trash illegible; it's just to make your trash harder to read than somebody else's.

Of course, strip shredders are not perfect. If you demand higher security, you can buy a cross-cut shredder that will make it virtually impossible for somebody going through your trash to reassemble anything. Expect to spend between $100 and $400 on a good cross-cut shredder.

• Simply buying a shredder is not enough: you must use it. It's good procedure to shred every piece of paper that has your name or an account number on it. Some people believe in shredding everything on the grounds that this makes their trash even harder for a crook to reassemble. But if you are using a decent shredder, there is no need to shred everything just shredding the important stuff will do.

Monitor your credit report

The longer identity theft goes on, the harder it is to put your life back together. For this reason, you should monitor your credit report on a regular basis. There are three major credit reporting firms in the United States (see Table 9-2), and any one of them will send you your credit report for free if you have been denied credit, insurance, or a job within the past 90 days. Some states have also passed laws that require the credit reporting agencies to give you one free report each year. If you don't live in one of these states, you can still get a report by paying between $5 and $15 to the credit reporting firms.

As of this writing, both Experian and Equifax made it possible to view your credit report on the Internet after answering a few questions designed to prove your identity; TransUnion will allow you to order your report on-line, but they send it to you via surface mail. Equifax also offers a CreditWatch service that will tell you when there is unusual or suspicious activity in your credit history.

Table 9-2. The United States' major credit reporting agencies

Name	Contact information	Online access
Equifax	Equifax Consumer DirectP.O. Box 105496Atlanta, GA 30348-5496Attn: Customer Care [e-mail]	http://www.equifax.com/
Experian	Experian Consumer Services901 West Bond StreetLincoln, NE 685211-888 EXPERIAN(1-888-397-3742)Does not accept email queries	http://www.experian.com/
TransUnion	TransUnionP.O. Box 2000Chester, PA 190221-800-888-4213Does not accept email queries	http://www.transunion.com/

Be careful of what you carry in your wallet or purse

What would happen if you lost your wallet right now? Chances are, you would be in trouble. You wouldn't simply have lost needed plastic somebody who found your wallet would have a virtual "identity theft kit" with your name on it.

To protect yourself from lost wallets, try to carry only what you absolutely need. Don't carry your Social Security card or a birth certificate you don't need them. Ideally, make sure that your Social Security number doesn't appear in your wallet at all.

Once you have minimized the number of cards that are in your wallet, take them all out and photocopy their fronts and backs. This way, if your wallet is lost, you'll have a record of what was lost and you'll be in a position to quickly cancel them all.

Cancel unnecessary credit card accounts

Don't apply for every credit card available. If you have a lot of plastic, see if you can get rid of all but the essential ones.

Ask organizations to use numbers other than your Social Security number as your account number

The bad news is that many organizations use Social Security numbers as account numbers. The good news is that many organizations will give you a different number if you ask. In Massachusetts, for example, most drivers' license numbers are the drivers' SSN, but the Registry of Motor Vehicles will issue an "S-Number" if the driver requests it. Likewise, Blue Cross of Massachusetts doesn't use SSNs as their account numbers, but numbers that are slightly different.

If possible, confine all of your online purchases to a single credit card, and use another credit card for your offline purchases

There has been considerably more fraud associated with credit cards that are used for online purchases than with those that are not used for online transactions.

In particular, if you have an American Express card, consider using the "Private Payments" service associated with the cards. This is a service that will generate a one-time number to use in online shopping. There is no need to actually send your real account number to any merchant on the Web. See the AmEx page at http://www.americanexpress.com/privatepayments/.

Don't give out personal information to people who call you claiming to represent credit card companies, banks, or companies giving away prizes

If your credit card company calls you telling you that there is suspicious activity on your account, make the operator prove that he or she really works for the company before you cooperate with them.

Use passwords

A growing number of companies are allowing their customers to put a "password" on an account, rather than relying on the customer's "mother's maiden name." See if your bank, credit card company, and utilities allow you to put passwords on your accounts. If they do, take advantage of this service.

If you are the victim of identity theft, follow these steps:

• Report the crime to your local police department, to the Secret Service, and to the postal inspector at your local post office.

• Call the Federal Trade Commission's Identity Theft Hotline 1-877-ID THEFT (1-877-438-4338). The FTC is keeping statistics at the Identity Theft Data Clearinghouse to gauge the severity of the identity theft problem. They will also give you advice and counseling.

• Contact your bank and credit card companies to alert them to the problem.

• Contact the banks and credit card companies where the fraudulent accounts have been opened and advise them of what has happened. Be aware: these companies may not believe you, especially if they think you owe them thousands of dollars. Nevertheless, you must persevere if you wish to clear your name.

• Get a copy of your credit report from Equifax, Experian, and TransUnion. Yes, you must get a copy of the report from each of these credit reporting agencies! Go through the report line by line, and challenge every single piece of information that appears incorrect, even if the incorrect information isn't obviously part of the identity theft incident. You may also wish to speak to the fraud departments at these organizations, although you may find them less than helpful.

• Consider obtaining the assistance of an attorney to aid you in clearing your record. This may not be inexpensive, but legal advice and assistance can be very helpful, especially in getting financial institutions to pay attention.

Ultimately, identity theft is flourishing because credit-granting companies are not being forced to cover the costs of their lax security procedures. The eagerness with which credit companies send out preapproved credit card applications and the ease with which stores will open a revolving charge account for a new customer creates the risk of fraud. When the fraud takes place, the credit grantor simply notes that payment was not made in the consumer's credit file and moves on; the consumer is left to pick up the pieces and otherwise deal with the cost of a stolen identity.

It stands to reason, then, that the easiest way to reduce fraud would be to force the companies that are creating the risk to suffer the consequences. One way to do that would be by penalizing companies that add provably false information to a consumer credit report in the same way we penalize individuals who file false police reports. Such penalties would force credit grantors to do a better job of identifying the individuals to whom they grant credit, and this, in turn, would help limit the crime of identity theft. However, it may be a while before this happens financial institutions have well-paid lobbyists who help quash legislation on topics such as this.

only for RuBoard - do not distribute or recompile