Wednesday, November 17, 2004

Dealing with ID Theft

This is the second in a series of "Baker's Dozen" tips on personal security. Comments are appreciated before I submit to Mama Liberty to TPoL for publishing.

A Baker’s Dozen Tips ™ To Dealing with ID Theft by Nathan Barton © 2004

A major growth sector in US crime is identity theft. Millions are victimized every year by emptied bank accounts, charged-out credit accounts, ruined credit records, and even criminal records pointing towards the victim's identity. The Federal Trade Commission says that identity theft is the number-one form of fraud, with over 9 million people affected in 2003. Many people don’t find out for months that they were hit.
  1. Fundamentals: Know what is needed to steal an identity. It doesn’t take much. A name, address (past or present), phone, birth date, Social Security number (SSAN), mother's maiden name, and just one of the following: bank account number (from a check), credit card number (from a sales slip or a bill), driver's license (from a motel receipt, perhaps), plate number and/or VIN (vehicle ID number), even a utility bill. A thief can make a few phone calls, do an online search and become you.
  2. A Little Defense: There are lots of ways for the crook to get the data he (or she) needs: Pick pocketing, “shoulder surfing” and dumpster diving are covert ways of obtaining info, but registry clerks, medical filers, property management filers, bankers, utility company employees or any venue where you are required to give out your SSAN for services are the weakest links in your ability to conceal your ID. Dishonest employees sell lists of SSAN for cash. So the number one thing you can do is LIMIT HOW OFTEN YOU GIVE OUT THIS NUMBER! Don’t write your signature on your debit and credit cards – instead, print “SEE PHOTO ID” in that space, and use your drivers license, military ID, or school ID to show the signature. Make sure that clerks don’t write down the ID number or SSAN (if it appears on the ID) on a check or sales slip. Leave street addresses and SSAN OFF your checks – many people advise putting only initials, not full names.
  3. The Postman Cometh: Postal address forms can be filled out and your mail redirected to a criminal’s address. Incoming and outgoing mail have everything they need. Credit card offers and loan applications have proprietary information, and can often be completed and approved with just a bogus signature. Stolen mail might never be missed, giving the thief a head start. If possible, use a locked USPS box, a private mailbox (PMB) (from the UPS Store or some other private business), or a mail slot, rather than a traditional outdoor mailbox.
  4. For Whom the Phone Rings: Criminals don’t observe “no-call” lists. Some predators call congratulating you on winning a prize or trip. Someone will claim you hit their auto in a parking lot (or they hit yours!), or that they found something of yours with identity on it and ask you to confirm your SSAN, drivers license, or other number to prove you are who you claim to be.
  5. Phishing and Other Computer Fun: The computer/internet version of phone fraud: e-mails asking for personal information and imitating a service provider or other business are common types of spam. Often the e-mail will direct you to a web-site that mimics a well-known and recognized web-site (such as Visa or Wells Fargo) but is really sitting on a server in Russia or Bermuda. Data-mining spyware is another threat, where you enter the very information they are looking for, for a legitimate site and use, and the number is collected by the spyware. Change passwords frequently and use “non-common” passwords.
  6. Behind the Curve: On average, the FTC says it takes a person 12 to 16 months to realize they have been victimized by a well-run operation. Some thieves will pay off debt for up to a year to get larger increases on loans and credit cards, then cash in when the big loans and limits come in. Other times, less knowledgeable but lucky crooks can strip your accounts in mere days: a credit card with a 10,000-dollar limit can provide a spree of less than a week.
  7. Prevention: Many small things can be done to prevent this from happening. Some ideas: get to know the people at the post office – especially in small towns. In larger towns, get to know your carrier, as well as UPS, FedEx and other delivery service drivers. If they see something that doesn't make sense they may be the first to notify you. Don’t just get a locking mailbox, but never put outgoing mail in an unsecured mailbox. Get a shredder and shred everything with a name, account number and address. Reduce exposure by paying as many bills online and getting online billing statements (only) for accounts. Limit the number of cards you have and use.
  8. Watch out: It is critical to pay attention to your finances. Look at bills for items you never purchased, calls from credit card companies increasing your credit lines, calls from bill collectors looking for payments, and mail for people other than yourself (especially in the form of credit card statements or loans). Review your bank statements: electronic banking means they don’t need to steal your checks to steal your money. Look for an unusual amount of direct mail from a particular brand or product line; this represents a large purchase on behalf of the thief putting you on a direct mail list regarding their purchase.
  9. Zip your lip: It is not necessary to give out your SSAN as much as you think. Only give it out if it is absolutely necessary, ask for alternatives. Deal only with established vendors with solid backgrounds. Never give out your mother’s maiden name unless absolutely necessary, and after verifying it is essential (look for other key questions to use).
  10. Credit, Cash, Paper, or Plastic: Be careful: excessive inquiries into your credit lower your scores making you less able to get loans for cars or homes, but you should check your credit record at least annually, and perhaps quarterly (especially if you can’t lower your vulnerability). This checks make you aware of activity regarding your SSAN and accounts, especially new ones. Look over bills carefully, and keep sales slips.
  11. Banker-Man: Establish a personal relationship with your banker – if you are using a large chain bank, pick a small branch to work with, not the main or major local office, and get to know them. At the same time, make sure that the bank uses their systems to verify “unusual” or “unexpected” changes in pattern. Protect your PIN (personal ID number) carefully: when new ones are assigned, immediately change to one that you DO NOT WRITE DOWN, at least not in a recognizable form.
  12. If It Happens: First, contact the fraud departments of all three major credit bureaus – have them flag your SSAN. Contact all your banks, and change passwords (or put them into place if you don’t have them). Notify all credit card companies, and cancel all credit cards affected by theft. Notify local authorities – the location of your residence is usually who has jurisdiction, but this may vary by state. Check with your drivers license agency to make sure that new duplicates of licenses haven’t been issued, and to see if there are tickets you “didn’t get.” If the theft appears to be local, notify the people you normally do business with, including gasoline stations, convenience stores, supermarkets, discount stores, the post office, and similar places.
  13. Business’ Responsibility: Identity theft is not your boss’s problem, but an employee struggling to get their life in order after being hit can hurt the business. The victim will be distracted, spend company time, use phones, go to court, come in late and leave early, as they work desperately to get the mess straightened out. An average victim is estimated to spend 175+ hours in the effort, which can cost up to $20,000. Employee training can help your employees, and the business.

2 comments:

Anonymous said...

I've discovered, accidentally, a good defense against identity theft. Avoidance of credit and/or debt.
If you don't have anything a thief can steal, he won't bother.
This also works against the biggest governmental thief, because the IRS does most of it's stealing online sans due process.
Why do you use SSAN instead of SSN, like everyone else?

Anonymous said...

Response to "Anon" -

SSAN is "Social Security Account Number" and I use it first because it is the correct name, second because of my military background (where SSAN is standard), and third to remind me (and others) that it is SUPPOSED to be an account number like a bank account or any other account - NOT an ID number.

Much as I wish it were possible for people to avoid debt and credit, these days in the USA, that is almost an impossibility - we are far too integrated for it to be feasible.