All it takes is one slip (of paper) for an identity thief to strike
By Lucy Lazarony • Bankrate.com

You'll never see it coming.

An impostor steals your name and Social Security number, opens bank accounts, rents apartments, buys cars, charges up numerous credit cards to the hilt and disappears.

If you are one of the millions of people who will be a victim this year of the growing crime of identity fraud, the first clue will likely come in an embarrassing form. The grocer will refuse your check. Your credit card will be declined. An angry creditor will call.

Then begins the painful, time-consuming task of clearing your name and convincing credit card companies, banks, credit bureaus and collection agencies that you are indeed whom you say you are.

"I carry the first page of the police report at all times because I've been accused of being the impostor," says Mari Frank, who learned she was an identity theft victim in August 1996.

An impostor ran up debts of more than $50,000 in her name. After 500 hours of phone calls, letters and not backing down, Frank's credit was clean again by spring 1997. She has since made fighting identity theft her crusade. As a privacy advocate, Frank is on the advisory board to the Office of Privacy Protection for California's Department of Consumer Affairs.

"I'm pretty tenacious and I was very, very upset," says Frank. "It's really hard fighting the bureaucracies and trying to prove who you are."

A case a minute
It's a growing problem: Based on credit industry figures, there are at least 500,000 new cases of identity theft each year. That's about one a minute, estimates Beth Givens, director of the Privacy Rights Clearinghouse in San Diego, Calif.

You do have some federal protections if a thief gets hold of your credit card or debit card and goes shopping. Fortunately, the immediate financial damage is limited to $50 per creditor if a credit card is stolen. In most cases, creditors waive this sum.

Different laws surround your debit card. It's not so bad if you act fast. Under the Electronic Fund Transfer Act, your liability is capped at $50 if you notify your bank within two days of finding out your debit card is missing. Wait more than two days and you could lose as much as $500.

If you habitually stack bank statements and reconcile at a later date, failing to report an unauthorized transaction within 60 days after if appears on a statement, your liability for the loss is unlimited. You could lose everything in your checking and overdraft accounts.

So when it comes to fraud it's important to realize that you don't have the same legal protections with a debit card as you do with a credit card.

"If you own a deferred debit card, that's a signature-based debit card with a Visa or MasterCard logo, get rid of it today," says Frank. Too many clients have been left with emptied accounts trying unsuccessfully to have their bank cover the unauthorized transactions.

Clean-up is still a chore
Removing an impostor's misdeeds from your credit report is not any easier today, even with increased awareness.

"It can take anywhere from eight months to several years, depending on the complexity of your situation, the number of credit accounts obtained by the impostor and the type of accounts," Givens says.

And checking your credit report once, emphasizes Givens, is not enough. We tell victims that they must continue to monitor their credit reports on a regular basis for years to come. Many victims have told us that even though they thought they had their credit report back to normal, fraudulent accounts reappeared because the credit issuers sometimes re-reported them. Even though this is a violation of federal law, it is still a common event.

It's a long, tough battle and until it's won, victims often cannot qualify for mortgages or car loans. One victim couldn't even rent a car. There's also the stress of dealing with aggressive collection agencies.

"I've heard so many horrendous cases. They harass. They do not believe the individual is a victim of identity theft. They think the individual is lying," Givens says. "I've heard cases where the collection agency threatens to take a person's house or threatens to file a lawsuit."

Frank was helped greatly in her quest to clear her name when police caught her impostor. Even though there was no identity theft statute in California at the time, a police officer was sympathetic to Frank's case. The reason? His wife was a victim of identity theft and their credit was in ruins.

Frank was allowed to file a police report -- a rarity then, because California law at the time decreed that the credit card companies and banks to be the only victims, not the individual. An officer sent to the address the impostor had given credit card companies was able to search her home because she was already on probation. Among the items found were a handgun and Frank's credit report, Frank's business cards and a letter from a rental car agency demanding payment for a damaged car.

Frank later figured out what had happened to her. The identity thief worked as a paralegal in a Ventura, Calif., law office. Posing as a private detective, she had been able to pull credit reports, including Frank's, from a small credit reporting agency.

The impostor's punishment was two months in a work furlough program and five years probation.

"I was very lucky," says Frank, a lawyer who has written The Identity Theft Survival Kit. "Only 10 percent of cases ever find the impostor."

Because there are so many ways to swipe someone's private information, such as a Social Security number, driver's license number, credit card and bank account numbers, it's tough to find the thief or even determine how it happened.

"It's an opportunistic crime rather than a targeted crime, which means the thief grabs information from whatever source they can," Givens says.

How it happens
Here are some of the ways it can happen:

• Sticky Fingers: The most obvious way to steal someone's identity is to snatch their purse or wallet. Identity thieves also steal mail, swiping everything from bills to pre-approved credit card offers.
• Dumpster Diving: Thieves comb the dumpsters of banks, mortgage companies, auto dealerships, restaurants and other businesses for credit slips and applications. Many businesses fail to shred these documents.

"That just infuriates me," Givens says. "Lawsuits are expensive. Shredders are cheap."

• Inside Job: Dishonest employees tap into a company's personnel records, copying Social Security numbers and other information.
• Skimming: Retail employees who handle customer credit cards swipe a card twice -- once for the purchase and once into another card-reading device. They take the encoded information on the magnetic stripes and create new accounts.
• Shoulder-surfing: At ATMs and phone booths, thieves will stand close enough to see PIN numbers punched in by users.
• Application Fraud: An impostor fills out a credit application in a victim's name and has it sent to another address.
• The Grudge: Roommates, friends, relatives and others with access to personal information ruin someone's credit for revenge.
• The Internet: The thieves set up phony Web sites with enticing offers for consumers.

Be careful about giving information to sites you don't know. It's one thing if you know Land's End. It's another thing if someone says, 'We'll give you a free vacation. Just give us your credit card number and Social Security number.'

While the vast information available online makes all our lives easier, it also helps thieves. There's certainly more information and access to information than there was -- even things like public records. Now you can sit at your computer and pull all that up.

Identity theft is growing rapidly, says Frank, because it is too easy to access consumers' sensitive information. The burden for reducing identity theft falls back on the financial industry -- the banks and credit issurers -- and businesses to change their inside practices. They need to examine how they store and access private information.

If it happens to you
What should you do if someone has stolen your identity?

• Contact any one of the three major credit-reporting agencies. The agency you call will automatically notify the other two agencies. This will trigger an automatic "fraud alert" to be placed in each of your credit reports. This alert notifies creditors to call you for permission before any new accounts are opened in your name. Not all creditors pay attention to these alerts. You need to stay vigilant for new account openings.
• Contact creditors for any accounts that have been tampered with or opened without your knowledge. Be sure to put complaints in writing.
• File a police report. Document as much as possible. Send copies to creditors and credit bureaus as proof of the crime.
• Report the fraud to the Office of the Inspector General's fraud hotline.

The Identity Theft and Assumption Deterrence Act of 1998 makes identity theft a federal crime with penalties of as much as 15 years in prison. Using the information itself is now a crime.

In addition, nearly all states have now passed identity theft statutes, except Colorado, Vermont and the District of Columbia. These state laws, however, vary widely, explains Beth Givens. Some are felonies with fairly strong penalties, a few are misdemeanors and some, like California's, take the "wobbler" approach - it's a misdemeanor or felony depending on the extent of the crime.

• Contact the FTC. While federal investigators only tend to pursue larger, more sophisticated fraud cases, they do monitor identity theft crimes of all levels in the hopes of discovering patterns and breaking up larger rings. Fill out the ID Theft Affidavit, make copies and send to all the creditors and the credit-reporting agencies.
• Change account passwords. Avoid using your mother's maiden name or the last four digits of your Social Security number as a personal identification number.

"If someone's committing identity theft against you, they may well already have your mother's maiden name," Givens says. "Pick something they can't find out."

In extreme cases, you also may be able to obtain a new Social Security number. The federal government will, grudgingly, issue a new Social Security number in circumstances when the old number has been obtained by someone else, resulting in either harassment or persistent cases of fraud. Contact your local Social Security field office for details, or read the rules from the Office of the Inspector General.

More tips for fighting back against identity theft are available from the FTC's Consumer Alerts bulletin, Privacy Rights Clearinghouse, Public Interest Research Group, California Public Interest Research Group and from Frank's Web site, Identity Theft Prevention and Survival.

The FTC has extensive identity theft information on its FirstGov for Consumers Web site.

Preventing identity theft
To minimize your chances of becoming a victim of identity fraud, consumer experts recommend the following actions:

• Get a credit report at least once a year and clean up any errors. Here's how to read and understand your credit report.
• Buy a shredder and destroy bills, pre-approved credit offers and other documents with personal information before throwing them out.
• Stay on top of your finances, especially bill due dates, so you'll know if a bill's missing.
• Carefully monitor your bank accounts and reconcile your checkbook regularly.
• Know your bank's policies regarding account errors and loss. Read the fine print.
  

If you miss a credit card bill, rather than simply celebrating, check to see if it was mailed out. Monitor your account.

• Protect your Social Security number. Only give your Social Security number when absolutely necessary. Avoid using it as your account number whenever possible. If merchants demand it, ask for an alternate number -- and take your business elsewhere if they insist on writing it on your check. Don't carry your Social Security number and driver's license together in your wallet.

"I don't think it's paranoia. It's cautiousness. Once it happens to you really have to be on the alert," says Frank. "It becomes a lifelong vigil in protecting your good name and credit."

-- Updated: April 25, 2003