Information Security

Identity Theft: What You Don't Know Can Harm You

Jody_King

By Jody R. King, JD, CPA

Vice President & Director of Financial Planning

Information security with person at keyboard

Identity theft is rampant. Since 2005 there have been almost 12,000 data breaches exposing nearly 1.7 billion records, according to the Identity Theft Resource Center. With so many records exposed, there has been a corresponding increase in fraud, with reports to the Federal Trade Commission (the FTC) increasing from approximately 333,000 in 2001 to 3,200,000 in 2019. Although not all of these reports are related to identity theft, it is estimated that seven to ten percent of the United States population is subjected to identity theft in a given year. Although you may not be able to control whether your personal information is exposed in a data breach, there are actions you can take to protect yourself against identity theft.

PROACTIVE MEASURES TO PROTECT YOUR IDENTITY

Obtain and Carefully Review your Credit Reports: Under federal law, each person is entitled to one free copy of their credit report annually from each of the three major credit reporting bureaus, which include Equifax, Experian, and TransUnion. Due to the rampant fraud during the current pandemic, every person is now entitled to a free online copy of their credit report on a weekly basis from each of the three agencies through April 2021. To obtain your free reports, visit https://www.annualcreditreport.com/index.action. Note that this is the only website sanctioned by federal law to obtain these free reports.

Once you obtain one or more of your credit reports, you should review each of them carefully. Reports can be quite lengthy, but any detail that is incorrect could complicate things for you later, or could be a sign that there has been an unauthorized attempt to utilize your credit. Items to pay particular attention to include: your personal information, including name, current and prior addresses, phone numbers, and date of birth; credit accounts such as credit cards, car loans, and mortgages; and credit inquiries. The credit inquiries indicate what entities have accessed your credit history for some reason. Entities that you have a credit relationship with, such as a credit card issuer, will access your report periodically to verify that you are still a good credit risk. Beyond that, inquiries should be monitored, as they are the first step in establishing new credit, which includes actions like opening up a new credit card, obtaining a mortgage, or renting an apartment. If anything appears suspicious, you should reach out directly to the entity that made the inquiry to see if an account has been established or attempted to be established with your credentials. If you see a problem with your personal information, such as your address or phone numbers, you should contact the credit bureau.

Set up your My Social Security account: If you have not done so, you should set up your My Social Security account by visiting https://www.ssa.gov/myaccount/. Obtaining your credit report will help in answering the security questions required by the Social Security Administration (SSA). These questions are designed to ensure that it is you attempting to set up your own account in order to prevent fraud. If you answer any questions incorrectly, you will be locked out for 24 hours.

There are many reasons to set up a My Social Security account, including the ability to easily verify your earnings history, to project your Social Security benefits, or to establish direct deposit of benefits. The most significant reason, however, is to stop someone else from doing so and potentially claiming benefits in your name or redirecting benefits to which you may be entitled. If your identity with the SSA is ever compromised you may not be able to set up your account, which is why anyone over the age of 18 should do this today. If you find that you have been the victim of Social Security fraud, file a report at https://oig.ssa.gov/.

Guard your Social Security Number (SSN): Never give out your SSN unless you trust the other party and you are sure that they actually need it for a valid reason. The fewer databases that contain your SSN, or even your driver’s license number, the less likely your identity is to be compromised. Many forms, including medical questionnaires, ask for your SSN but may not have a legally valid reason for requiring it. For example, as long as your medical provider has your insurance information, they do not have a right to your SSN. Parties that do have either a legal right to or a need to have your SSN include those that must verify your identity under the federal Consumer Identification Program or who are required to report to the IRS. Among those with a legitimate right to require your SSN are employers, banks, investment advisors, insurance companies, and lenders, as well as the credit bureaus and many government agencies, including the IRS and the Department of Motor Vehicles. To protect yourself, do not carry your Social Security card in your wallet.

Freeze your Credit: After you set up your My Social Security account, you should seriously consider freezing your credit. The advantage to freezing your credit is that it blocks potential new creditors from accessing your credit reports, thus making it unlikely that new credit would be granted on your record. If you are planning to apply for a new credit card or rent a new apartment, you would need to unfreeze your credit with one or more of the credit bureaus to allow the new creditor access. There is no cost to doing this and it is easy to accomplish. When you apply for credit you can ask the creditor which bureau they intend to utilize and unlock just that bureau. In addition, when you unfreeze your credit file, you can instruct it to automatically refreeze after your chosen interval of time, which could be a day or week, for example. Freezing your credit does not affect your ability to utilize your current credit cards or stop current creditors, or a limited group of others, from accessing your credit information.

The act of freezing your credit is easily done online by visiting each of the three main credit bureaus websites. Once the credit bureau verifies it is you, you can freeze your credit with that bureau. Each bureau will follow up with a letter confirming your decision, and likely provide you with a PIN number, if you did not create one at the time of freezing. It is important to retain that information in order to easily unfreeze your credit later. In addition to the three major credit bureaus, there is a fourth, lesser-known bureau, Innovis, where you may also want to consider freezing your credit. Although less critical than the big three, there is no significant downside to also freezing your credit with the fourth bureau. The links to the credit bureau websites to freeze your credit are:

Even if your credit is frozen, you need to remain vigilant about periodically reviewing your credit reports because problems can still arise. In addition to your own credit, you should consider freezing your minor child’s credit and assisting disabled or elderly family members to accomplish the same.

  • Military Active Duty Alert: Deployed members of the military are a particularly attractive target for identity thieves. It is recommended that service members place an Active Duty Alert on their credit file by contacting one of the three major credit bureaus. The first bureau will inform the other bureaus of the alert. The alert is valid for one year, but can be renewed, and will remove the person from prescreened credit card offers for two years unless he or she requests to be put back on the list.

Consider Credit Monitoring Services: Some choose to sign up for credit monitoring services to help provide timely notice of any suspicious activity. There are a number of services available to do this, either through the credit bureaus, credit card companies, or other companies dedicated to this service. Some services are free, while others are not. If you chose to sign up for a service, make sure it is reputable and will provide you with whatever types of monitoring you deem important. Please remember that signing up for a credit monitoring service is not a substitute for remaining diligent about protecting your identity and reviewing your credit reports.

Watch your Mail: Examine your mail carefully for indications that your identity may have been compromised.

  • Be leery of unsolicited mail:
    • Read, but verify, and take appropriate action: If you receive a letter from the state indicating you have filed for unemployment benefits when you have not, you will want to take action immediately. The same goes for correspondence from collection agencies on accounts that are not yours, or letters from the IRS or SSA. Instead of calling back any phone numbers that may appear in the correspondence, go online to find or verify contact information in case the letter itself is fraudulent. Be careful to not reveal your personal information until you are sure you are dealing with a legitimate party. Remember that neither the IRS nor the SSA will call you unless you are in a dialogue with them already, and if they do call you they will not ask you for your full Social Security number, bank account information, or credit card number. If you receive a letter saying a credit application you did not submit has been denied, this is a red flag of potential problems.
    • Preapproved credit card offers: If you are not interested in receiving preapproved credit card offers, you can opt out for either five years or permanently. Call 888-567-8688 or visit https://www.optoutprescreen.com/ to begin the process.
  • Review your credit card, bank, and investment statements: Whether you receive these by mail or online, you should review them carefully for unauthorized activity. If your credit card provides it, you should consider signing up for notifications for “card not present transactions” and other signs of fraudulent activity, so that you can respond quickly in the event of a breach.
  • Shred sensitive information: Dumpster diving is one of the ways that thieves can obtain information about you, so be sure to shred any documents that include sensitive information.

Use Unique Passwords Online: Periodically update your unique, hard-to-guess passwords for all your online accounts, including email, credit, bank and all other accounts. To keep your detailed login information secure, either use a password-keeper application or maintain a paper-based documentation system. Utilize multi-factor authentication whenever it is available.

See Avoiding Coronavirus Fraud and Phishing Scams for tips

IF YOUR IDENTITY HAS BEEN COMPROMISED

If you think your identity may have been compromised, or you know that you have been the victim of some form of identity theft, there are steps you can take to begin to restore your identity and limit additional headache.

Initiate a Fraud Alert: If you are concerned that your personal information may have been exposed in a data breach, if your wallet has been stolen, or if you know that you are a victim of identity theft, you should consider placing a Fraud Alert on your credit file. There is no cost to placing a fraud alert, and the type of fraud alert that is appropriate for you will depend on your circumstances.

  • Initial Fraud Alert: You can place an Initial Fraud Alert on your credit file even before you know you have been a victim of identity theft. To place an initial fraud alert, you should contact at least one of the three major credit bureaus and ask them to place an Initial Fraud Alert on your file. You can contact all three, but even if you only contact one, they are required to notify the other two. This process will allow you to provide a statement about your circumstances and a phone number where anyone accessing your credit report can contact you. This process puts any potential creditor on notice that additional measures must be taken to verify that it is really you attempting to establish a credit relationship. An Initial Fraud Alert lasts for one year, can be renewed if desired, and provides you with a free copy of your credit report. Even if you have frozen your credit, it is still recommended that you put the fraud alert on your file if you are concerned about identity theft. This additional layer of protection would only be seen by a potential creditor after they manage to access your credit report.
  • Extended Fraud Alert: If you have been a victim of identity theft, you can contact one of the three major credit bureaus and place an extended fraud alert on your file that will last for seven years. The bureau will ask you to complete a form and require you to submit your Identity Theft Report (see below). It will also notify the other two credit bureaus of your extended fraud alert. In addition, you will be eligible for two free credit reports from each of the three bureaus over the next year and will be removed from marketing lists for prescreened credit offers for five years.

Review Your Credit Reports: If your identity has been compromised, you should obtain and review every detail of your credit reports. A second review of these may turn up important details that may have been missed previously.

File an Identity Theft Report: If you have been the victim of any type of identity theft, you should file an Identity Theft Report by visiting https://identitytheft.gov. This website is maintained by the FTC and is a clearing house for fraud reporting. Although there are other ways to file a fraud report with the FTC, doing so online and establishing an account allows you to update your Identity Theft Report as you learn more, and provides recommended action steps to address the details of your particular circumstances including tailored letters that you can send to help remedy your situation. This will allow you to go back in and “check off” the steps you have accomplished. Your Identity Theft Report will be required to place an extended fraud alert and will be necessary to correct some items that are incorrect on your credit reports.

Change your Passwords: Periodically updating your passwords is always advisable, but doing so when your identity has been compromised is even more important. Remember to use unique, hard-to-guess passwords. If you have been the victim of an internet crime, consider filing a complaint with the Federal Bureau of Investigation Internet Crime Complaint Center (IC3) at https://www.ic3.gov/complaint/default.aspx.

Contact Creditors, Banks, and Other Organizations: As will likely be detailed on the Identity Theft Report recovery plan, you should at a minimum contact any organizations where you have accounts or where anyone has attempted to open an account in your name. This may involve closing accounts in some circumstances. If your medical or insurance records have been compromised, you should work to correct the inaccuracies.

Consider Filing a Police Report: If you have been the victim of identity theft, contact your local police department. They can help you decide if filing a police report is appropriate for your particular situation.

File Tax Returns as Early as Possible: Tax-related identity theft occurs when someone assumes your identity with a taxing authority. This can be as simple as filing a fraudulent return with your taxpayer information and claiming a refund for all or part of the taxes you may have paid. It is always advisable to file your income tax returns as soon as practical, but if you believe your information may have been compromised you should truly prioritize filing your return as soon as possible. If you are concerned about tax-related identity theft, request a tax transcript from the IRS online at https://www.irs.gov/individuals/get-transcript.  If you are a victim of tax-related identity theft, or some other identity theft, you should consider completing IRS Form 14039 – Identity Theft Affidavit.

It is always easier to protect and maintain your identity than it is to recover from identity theft. Taking proactive steps today to secure your identity, including reviewing your credit reports and freezing your credit, can ultimately save you significant time and stress. If your identity is compromised, quick and decisive action can help to limit the damage.

Click here to view the pdf version of this article.

The opinions expressed in this article are as of the date issued and subject to change at any time. Nothing contained herein is intended to constitute investment, legal, tax or accounting advice, and clients should discuss any proposed arrangement or transaction with their investment, legal or tax advisers.

Learn more about how we can help you

Contact