Identity Theft
Each and every day, Americans share personal information about themselves with others without even realizing it. We write checks at department and grocery stores, charge purchases online or over the phone, rent a car, book a hotel room, mail our tax returns, use our cell phones and apply for credit cards. Each of these transactions requires you to share personal information: your bank and credit card account numbers; your income; your Social Security number; or your name, address and phone numbers.
Unscrupulous individuals can use this personal information to commit identity theft. Identity theft is one of the fastest growing white-collar crimes in the United States. In fact, surveys show that there are 7 to 10 million victims of identity theft per year. If your identity is stolen, it can take months or years, not to mention thousands of dollars, to clear your name and your credit record. According to the FTC, the average victim of identity theft is unaware of the problem for 12 months. By the time it is detected, it is already too late. Victims of identity theft may be denied credit and refused loans, lose job opportunities or even be suspected of crimes they did not commit.
What is identity theft?
Using a variety of methods, criminals steal their victims' Social Security numbers, driver's license numbers, bank account numbers, credit card numbers, ATM cards, telephone calling cards and other pieces of individual's identities such as names, addresses, telephone numbers and dates of birth. They then use this information to impersonate their victims and apply for additional credit cards or bank loans, open new bank accounts, set up telephone services and purchase merchandise.
There are four kinds of identity theft:
- Financial identity theft focuses on your name and Social Security number. Using this information, the imposter may apply for telephone service, credit cards or loans, buy merchandise and lease cars or apartments.
- Criminal identity theft occurs when an imposter provides the victim's information instead of his or her own when stopped by the police. Eventually, when a warrant for arrest is issued, it is in the name of the person issued the citation-the victim.
- Identity cloning is when the imposter uses the victim's information to establish a new life. They work and live as you.
- Business or commercial identity theft occurs when the imposter gets credit cards or checking accounts in the name of the business. The business finds out when unpaid suppliers send collection notices, or their business rating score is affected.
How can my identity be stolen?
Thieves can get your personal information in the following ways:
- stealing wallets and purses containing your identification and credit and bank cards;
- stealing your mail, including your bank and credit card statements, preapproved credit offers, investment reports, insurance statements, benefits documents, new checks and tax information;
- completing a "change of address form" to divert your mail to another location;
- rummaging through your trash or the trash of businesses, a practice known as "dumpster diving," for unshredded credit card and loan applications, copies of checks, credit card or bank statements or other records that bear your name, address, telephone number and sometimes even your Social Security number;
- Fraudulently obtaining your credit report by posing as a landlord, employer or someone else who may have a legitimate need for, and legal right to, the information;
- using personal information you share on the Internet;
- posing as legitimate companies or government agencies you do business with, often through e-mail;
- stealing files out of offices where you are a customer, employee, patient or student; bribing an employee who has access to your files; or "hacking" into electronic files;
- hacking into your computer, especially those without firewalls;
- looking over your shoulder at ATMs to steal your PINs;
- using phony telemarketing schemes to convince you to give them your personal data;
- purchasing your identifying information at one of the identity search companies found on the Internet; for a nominal fee, these companies will sell people's Social Security number, their mother's maiden name, their home and employment address, their previous addresses, their credit history and more.
If my identity is stolen, what can the imposter do with the information?
Given enough personal information, an imposter can literally take over your identity and commit an array of crimes-all in your name. They can:
- cash a check or, using their own personal computer, print fraudulent checks bearing your name but a different address and then drain your account;
- get a loan;
- open a bank account with a line of credit;
- open new credit accounts or call your credit card issuer pretending to be you and request a change of address and then run up a multitude of charges; because the bills are sent to a different address, it could be months before you realize there is a problem;
- rent an apartment;
- buy a car;
- purchase a cell phone;
- commit a crime and give your name to the police; if they are released from custody and do not show up for their court date, an arrest warrant will be issued in your name.
Will I be held responsible if an imposter uses my identity to commit a crime?
From a financial perspective, if an imposter fraudulently uses your credit card, the Consumer Credit Protection Act limits your liability for unauthorized credit card charges to $50 per card.
The Electronic Fund Transfer Act provides protection for transactions involving an ATM or debit card or another electronic way to debit or credit an account. It also limits your liability for unauthorized electronic fund transfers.
It is important to note that the extent of your financial liability may depend on the length of time it takes you to report the fraud. However, VISAŽ and MasterCardŽ have voluntarily agreed to limit consumers' liability for unauthorized use of their debit cards in most instances to $50 per card, no matter how much time has elapsed since the discovery of the loss or theft of the card.
Although no federal law limits your liability if someone steals your checks and forges your signature, you may be protected under state law. However, while most states hold the bank responsible for losses from a forged check, they also require you to take reasonable care of your account. Therefore, you may be held responsible for the forgery if you fail to notify the bank in a timely manner that a check was lost or stolen.
What do I do if I believe I have been a victim of identity theft?
Contact your bank and all credit card companies by telephone immediately. Follow up with an e-mail and faxed letter summarizing your phone conversation. You will probably be asked to sign an affidavit attesting to the fact that purchases and account withdrawals were made without your consent.
Next, contact the FTC, the agency that enforces the Identity Theft and Assumption Deterrence Act, at 877.ID.THEFT/877.438.4338 and make an official complaint.
Report the theft by contacting the fraud sections of the three major credit-reporting agencies on the Internet, or call:
- Equifax: 800.525.6285 or write to P.O. Box 740250, Atlanta, GA 30374-0250
- Experian: (formerly TRW): 888.EXPERIAN or 888.397.3742, fax to 800.301.7196 or write to P.O. Box 1017, Allen, TX 75013
- Trans Union: 800.680.7289 or write to P.O. Box 6790, Fullerton, CA 92634
Lastly, where checking accounts and stolen checks are involved you must contact the major check verification companies, which retain data on unpaid checks, to report any fraudulent use of your checks. You will no longer be able to use checks for purchases if these companies are not made aware of your situation.
- CheckRite: 800.766.2748
- Chexsystems: 800.428.9623
- CheckCenter/CrossCheck: 800.843.0760
- Certigy/Equifax: .800.437.5120
- International Check Services: 800.526.5380
- SCAN: 800.262.7771
- TeleCheck: 800.710.9898
TIP: For more information, a comprehensive Web site that has been set up to aid victims of identity fraud is located at www.privacyrights.org.
How can I prevent identity theft?
While there is no definitive way to prevent identity theft, diligence in guarding your personal information minimizes the threat. Following are some steps you can take to keep your personal information secure:
- Carry only the personal identification, credit cards and debit cards that you need. Store infrequently used identification and cards in a secure location.
- Keep a list of all credit cards, account numbers, expiration dates and the customer service phone numbers in a secure place so that you can quickly contact your creditors in case your cards are lost or stolen.
- Cancel all inactive credit and debit cards; even though you do not use them, the accounts appear on your credit report, which can in turn be used by thieves.
- Never carry your Social Security card in your wallet; keep it in a secure place.
- Do not have your Social Security number or your driver's license number pre-printed on your checks.
- Only give out your Social Security number when absolutely necessary. Ask if it is possible to use other types of identifiers. If a company refuses to use another identifier to complete a transaction, consider taking your business elsewhere.
- Deposit your mail, especially bill payments, directly at the post office rather than leaving it in your mailbox for the postal carrier to pick up. If you are going to be out of town, request a vacation hold from the post office.
- Review all credit card statements, telephone and utility bills. If you do not recognize a charge or phone call, report it immediately.
- Pay attention to your billing cycles. If your bills do not arrive when expected, contact the creditor; a missing credit card bill could mean an identity thief has taken over your account and changed your billing address.
- Order your credit report every year. This report contains information on where you work and live, credit accounts opened in your name, how you pay your bills and whether you have been sued, arrested or have filed for bankruptcy.
Immediately report any inaccurate information. To review a copy of your credit report, contact the following credit bureaus:
- Equifax: 800.685.1111
- Experian: 888.397.3742
- Trans Union: 800.916.8800
- Place passwords on your credit cards, bank and telephone accounts. Do not use obvious passwords such as your mother's maiden name, the last four digits of your Social Security number, birthdays or anniversaries.
- Change your passwords and PIN numbers regularly.
- Memorize passwords and PIN numbers and destroy any paper on which they are written.
- Never throw away credit card receipts in public; shred them once you are home.
- Shred or tear up any offers of preapproved credit cards you do not intend to use and beware of offers from companies you do not recognize. Identity thieves can easily create an official-looking credit application offering you preapproved credit if you provide your Social Security number, mother's maiden name and signature.
- To cut down on the number of unsolicited credit card applications you receive and thereby reduce the chance of these applications being stolen, call 888.5OPT.OUT to have your name removed from marketing lists sold by credit bureaus.
- Protect your trash by tearing up or shredding sensitive materials: credit applications or preapproved credit offers, insurance forms, medical statements, charge receipts, checks and bank statements, bank receipts, canceled or expired credit and ATM cards and any other papers that include your personal information, identification and account numbers.
- Do not give personal information over the phone, through the mail or over the Internet unless absolutely necessary and only if you initiated the phone call. If someone calls claiming they are from your bank or credit company, ask for a number to call them back and then check to ensure that it is the actual phone number. Similarly, if contacted through a telephone solicitation, ask that they mail you information so you can research their company, products and services.
- When shopping on the Internet, only shop at secure Web sites. These are sites that use encryption technology to transfer information from your computer to the online merchant's computer. Encryption scrambles the information you send, such as your credit card number, in order to prevent computer hackers from obtaining it. The only people who can unscramble the code are those with legitimate access privileges. There are several ways to determine whether you are using a secure web site:
- Verify that the Web site's URL address begins with "https://". The "s" that is displayed after "http" indicates that the Web site is secure.
- Look for a closed padlock displayed at the bottom of your screen. If that lock is open, you should assume it is not a secure site.
- Look for an unbroken key. 5Pick up your new checks from the bank instead of having them sent to your home.
- Store canceled checks in a safe place. If they are stolen, the thief has access to your checking account number, your phone number and driver's license number.
- If you find your personal information posted somewhere on the Internet, demand that it be removed.
- Ask about information security procedures in your workplace. Identify who has access to your personal information and verify that records are kept in a secure location. Ask about disposal procedures for sensitive records.
- Do not put personal information on a computer home page or personal computer profile.
- Protect personal information stored on your computer. Use a firewall and secure browser; maintain current virus protection; never download files or click on hyperlinks from strangers; and avoid automatic login processes that store your account name and password. Moreover, when disposing of your computer, delete all personal information and completely overwrite the hard drive.
- Be wary of promotional scams. Identity thieves may use phony offers to get you to give them your personal information.
What should I do if I discover that my identity has been stolen?
If you find that your credit cards, driver's license, Social Security number or any other type of identifying information is stolen, your identity may be stolen as well. As soon as you are aware of the theft, you should proceed as follows:
Contact the Federal Trade Commission: Call the FTC's Identity Theft Hotline toll-free at 877.ID.THEFT/877.438.4338 to report the theft. The FTC's counselors will take your complaint and give you advice on how to deal with credit-related problems that may result from the theft. The hotline also provides you with one place to report the theft to the federal government. Once notified, the FTC will put your information into a secure consumer fraud database where it can be used to help other law enforcement agencies and private entities in their investigations and victim assistance.
Create an Identity Theft Affidavit: Create an identity theft affidavit and have it notarized. The FTC has an official identity theft affidavit that you can use to alert different companies, including the major credit bureaus, your credit card companies, your banks and so on. You can use this form for each company. This affidavit can be found at www.consumer.gov/idtheft.
Contact the Credit Bureaus: Contact the fraud departments of any of the three major credit bureaus to place a fraud alert on your credit file. This alert requests creditors to contact you before opening any new accounts or making any changes to your existing accounts. When the credit bureau verifies your fraud alert, the other two credit bureaus will be notified to also place fraud alerts on your accounts, and all three credit reports will be sent to you free of charge. To report fraud, contact the credit bureaus at:
- Equifax: 800.525.6285 and write: P.O. Box 740241, Atlanta, GA 30374-0241
- Experian: 888.397.3742 and write: P.O. Box 9532, Allen, TX 75013
- Trans Union: 800.680.7289 and write: Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790
Once you receive your reports, review them carefully and pay close attention to inquiries you did not initiate, accounts you did not open and unexplained debts on your accounts. If you find anything out of order, notify the credit company immediately. It is important to note that credit issuers are not required by law to observe fraud alerts. Therefore, it is important to request copies of your credit report every few months so you can ensure no new fraudulent activity has occurred. The automated "one-call" fraud alert process only works for the initial placement of your fraud alert. Orders for additional credit reports or renewals of your fraud alerts must be made separately at each of the three credit bureaus.
File a Police Report: File a police report with your local police department or the police department in the location where the theft took place, and keep a copy of the report to submit to your creditors and other entities that may require proof of the identity theft. Know the telephone number of your investigator so that you can give it to creditors and others who require verification of your case.
When filing out a police report, provide as much documentation as possible. This may include debt collection letters, credit reports, your notarized Identity Theft Affidavit and any other evidence of fraudulent activity.
Do not take "no" for an answer. If the police department tells you that identity theft is not a crime in your state, ask to file a Miscellaneous Incident Report instead. Remind the police of the importance of a police report-many creditors may require one to resolve your dispute.
Cancel/Close Accounts: Cancel all of your credit cards, ATM cards and phone cards. Notify your utility company. Call your bank and have them close all existing bank accounts. Put stop payment orders on any outstanding check of which you are unsure. Open new accounts with new passwords. Do not use obvious passwords like your mother's maiden name, birthdays or anniversaries.
You have 60 days from the date your bank account statement is sent to you to report in writing any money withdrawn from your account without your permission. If your ATM or debit card is lost or stolen, report it immediately because the amount you can be held responsible for depends on how quickly you report the loss. If you report the loss or theft within 2 business days of discovery, your losses are limited to $50. If you report the loss or theft after 2 business days, but within 60 days after the unauthorized electronic fund transfer appears on your statement, you could lose up to $500. If you wait more than 60 days to report the loss or theft, you could lose all the money that was taken from your account.
Report Stolen Checks: Report stolen checks to your bank as well as the following agencies:
- Certegy, Inc.: 800.437.5120
- Telecheck: 800.710.9898
- ChexSystems: 800.428.9623
- International Check Services: 800.526.5380
- SCAN: 800.262.7771.
Notify the Post Office: If you have reason to believe that the thief has filed a change of address form in your name, notify the local Postal Inspector. Call the U. S. Postal Service at 800.275.8777 to get the phone number. The change of address form will be an important piece of evidence for the police to follow.
Find out where fraudulent credit cards were sent. Notify your local post office to forward all mail in your name to your address.
Contact the DMV: If your driver's license is stolen, call the state office of the Department of Motor Vehicles to see if another license has been issued in your name. If your state DMV provides a fraud alert process, place a fraud alert on your license. Be prepared to show proof of theft and damage. Go to your local DMV to request a new driver's license number. Fill out the DMV's complaint form to begin the investigation process. Send supporting documents with the completed form to the nearest DMV investigation office.
Debt Collection: Do not pay bills for which you are not responsible. If debt collectors attempt to force you to pay unpaid bills on fraudulent accounts, ask for the name of the company, the person contacting you, their telephone number and address. Request the name and contact information for the referring credit issuer, the amount of the debt, account number and the date of all charges.
Inform the collector that you are a victim of identity theft and are not responsible for the account. Ask the debt collector if their company has a specific fraud affidavit form or if you can use the form provided by the FTC.
Send the debt collector a follow-up letter explaining your situation, including copies of documents that support your claim and asking them to confirm in writing that you do not owe the debt and that the account has been closed.
Criminal Identity Theft: If a civil judgment is entered in your name for your identity thief's actions, contact the court where the judgment was entered and report that you are a victim of identity theft.
If you are wrongfully arrested or prosecuted for criminal charges, contact the police department and the court in the jurisdiction of the arrest, as well as the state Department of Justice and the FBI. File an impersonation report with the police department or the court and confirm your identity. Ask the police department to take your fingerprints, photograph you and make copies of your photo identification documents. To establish your innocence, ask the police to compare the prints and photographs with those of the identity thief. If the arrest warrant is from a state or county other than where you live, ask your local police department to send the impersonation report to the police department in the jurisdiction where the arrest warrant, traffic citation or criminal conviction originated.
This action should cause the police department to recall any warrants and issue a "clearance letter" or "certificate of release" (if you were arrested or booked). It is important that you keep this document with you at all times in case you are wrongfully accused again. Ask the police department to file the record of the follow-up investigation establishing your innocence with the district attorney's office and/or court where the crime took place. This will result in an amended complaint.
TIP: Once your name is recorded in a criminal database, it is unlikely that it will be completely removed from the official record. Therefore, request that the primary name in the database be changed from your name to the imposter's name, with your name listed as an alias.
Maintain Thorough Records: Keep records of all conversations and correspondence with everyone you notify regarding the identity theft, including dates, names and telephone numbers. Keep track of the time spent and expenses incurred in case you are able to seek restitution in a later judgment or conviction against the thief or if you itemize tax deductions for theft-related expenses (consult your accountant). Confirm conversations in writing. Send correspondence by certified mail, return receipt requested.
Are there any laws that prohibit identity theft?
Under the provisions of the Identity Theft and Assumption Deterrence Act (18 U.S.C.A Section 1028), using another person's identification with the intent to commit any unlawful activity is a federal crime. Federal agencies, including the U.S. Secret Service, the FBI and the U.S. Postal Inspection Service investigate suspected violations of the Act. Prosecutions are handled by the U.S. Department of Justice.
Identity theft may also involve violations of other statutes such as:
- credit card fraud (18 U.S.C.A. Section 1029)
- computer fraud (18 U.S.C.A. Section 1030)
- mail fraud (18 U.S.C.A. Section 1341)
- wire fraud (18 U.S.C.A. Section 1343)
- financial institution fraud (18 U.S.C.A. Section 1344)
Each of these federal offenses is a felony and carries substantial penalties, which in some cases can be as high as 30 years imprisonment, fines and criminal forfeiture.
Many states have passed or are considering laws related to identity theft. If your state does not have an identity theft law, it is likely that the issue is covered under other state laws. Contact your state attorney general's office or local consumer protection agency for laws related to identity theft.