If you have purchased a house, a car, applied for a credit card, or took out a loan, then the odds are your personal financial information has been leaked into cyberspace. One of the big three credit reporting agencies, Equifax, in 2017 had a data breach where 147 million records were stolen. First American Financial Corp, which provides title insurance and real estate settlement services, had the records for about 885 million transactions stolen from as far back as 2003. The 2019 Capital One data breach affected about 100 million customers.
Then there is the U.S. government and the Office of Personnel Management data breach that was discovered in June 2015. In this breach, the records of 22 million government employees and military personnel were stolen by Chinese agents.
Even though these events seem to be in the past, your financial information does not change. Your personal identifying data remains the same; your Social Security Number, driver's license number, and other financial information are static. Though these breaches happened in the past, criminals will use these dated accounts with current social security and driver's license numbers to set up credit accounts and take out loans.
When it comes to extending credit and approving loans, there are two forces at work, each working against the other. First is the need for the banks to make money through the interest charged for credit cards and loans, so the goal is to make credit as simple and easy as possible. The second force is security, the need to validate customer requests for credit; the harder this is, the fewer credit approvals. It is common for these illegal transactions to occur with incorrect and outdated residence addresses, phone numbers, and other personal information. This is really not a balancing act; it is easy credit that wins. However, the industry's goal of ease and simplicity leads to significant problems for those whose identity has been stolen.
Financial institutions are now required to provide services to those whose identities they held were stolen. First is a notification of the breach and the offer for credit monitoring. In addition, there are other required services, and these depend on federal and state laws. In general, these services are the reimbursement for professional services from accountants, attorneys, etc., and other expenses incurred in notary fees, postage, mileage, phone charges, etc. These reimbursement amounts are all limited, and these packages have a shelf life that ends after a set period of time. These services will not help an individual whose identity was stolen and years later finds out they are a victim of identity threat.
There is a range of identity theft, from simple fraudulent credit card transactions to someone buying or renting a car or taking out a loan in your name. If this is credit card fraud, you need to dispute the charges. A good reason to use credit cards is that the financial institutions that issue credit cards are required to validate the transactions and reverse charges in the case of fraud. This is a good reason not to use debit cards or gift cards, as once these transactions are completed, the money is gone, and the financial institutions will not help. Frequent charges to your account may be resolved by a new credit card. Identity theft with large financial transactions, renting or buying cars, loans made with your identity, and capital purchases is a different matter. Here you need to be proactive and document your actions. This requires what seems like fruitless activities that establish you are not the one taking out the loan or the one who rented and wrecked the car. An excellent 2022 Los Angeles Times article by Jessica Roy, "My wallet was stolen at a bar. Then my identity theft nightmare began," outlines her odyssey to recover from identity theft.
The advice is to report, document, and fight. You need to report to establish the paper trail that shows you are not the one making the transactions. The banks will not forgive the multi-thousand dollar loan just because you said someone stole your identity. You need to make a police report and report to the FBI’s IC3; these reports help establish that you are not the one responsible for the transactions. Another action is to freeze your credit. This entails contacting the three credit bureaus and freezing your credit; you can easily unfreeze your credit to apply for additional credit. You may want to change your social security number; this is a process, and the government generally does not like to do this.
What you have to do is establish a new financial identity. It is painful, and do not expect much help from law enforcement. Though many thousands of criminals make millions off of stolen identities, for some reason, an individual case is irrelevant. When the criminal is caught, do not expect the courts to do much, there is always a sad story behind each criminal. Truly this is one of those situations where luck needs to be on your side.
The fact is your information is out there. If you are misfortunate enough to have your identity stolen, the best advice is to move quickly, report, and document proof of your actions, and freeze and monitor your credit.
With 30 years of experience in information technology, Mike Olivier brings his expertise to small-business System Security Planning with San Diego-based 171Comply. As a small business owner working in the federal space both as a prime contractor and as a subcontractor, he understands the realities of running a small business. Contact Mike at firstname.lastname@example.org.