Tips & Tools to Stay Safe From ID Theft
Identity theft is the nation’s leading method of fraud in the 21st century, with the highest number of complaints nationwide originating here in California. While old practices such as mail theft and “dumpster diving” continue, consumers today face new threats as technology advances and new opportunities develop for criminals. These threats include the use of card-skimming devices, abuse of Bluetooth technology, key-logging malware, and attacks on unsecured WiFi networks. To help consumers understand the multiple threats to their identity the CALPIRG Education Fund created an online info-graphic detailing the threats consumer’s face online, at home, and while doing business – detailing the actions they can take to protect themselves.
See our report, “Still @ Risk” for more information and details on the present risks of identity theft.
How to Prevent Identity Theft
Identity theft is increasing in scope and variety, forcing consumers to learn how to keep private information safe. CALPIRG Education Fund recommends these simple 12 steps to help consumers keep their private information private:
1. Do not disclose your full nine-digit Social Security number unless you have to. Never use it as an identifier or password, and question institutions who ask for it.
2. Avoid paper billing by requesting secure electronic statements instead. If you still require hard copies, you can print them and store them safely rather than risk mail theft.
3. Lock your mailbox.
4. Keep your information safe, both online and offline. Shred documents containing personal information before throwing them away. Password protect sensitive computer files.
5. Use unique hard-to-guess passwords that include a combination of letters, numbers, and symbols.
6. Avoid using the same password across multiple accounts, and change your passwords once or twice per year.
7. Install and update antivirus, anti-malware, and security programs on all computers, tablets, and smart-phones.
8. Don’t disclose information commonly used to verify your identity on social network sites. This includes date of birth, city of birth, mother’s maiden name, and name of high school.
9. Avoid making purchases, paying bills, or sending sensitive information over unsecured WiFi networks (at airports, coffee shops, or hotels).
10. Disable Bluetooth connections on devices when not in use.
11. Watch out for “phishing” scams. If you receive un-solicited requests for personal information in email or over the phone, ignore them. Instead, use official methods of contact online or by calling the institution’s customer service numbers available on statements, back of cards, or on official websites.
12. Fight “skimmers” by not handing your debit card to a server or anyone who could have a hand-held skimming device out of sight. When using ATM machines, touch to see if the all the parts are solid and not add-ons; always cover the hand typing the password; look for suspicious holes or cameras; and avoid using ATM machines in unsupervised locations.
Special Feature – Protecting your Smart-phone and Tablet:
- Set a personal password and protect your smart phone to prevent un-authorized access.
- Use only authorized apps provided by your bank or reputable publishers to access financial information.
- Look for popular apps that have been accessed and downloaded by many consumers. “Wisdom of crowds” is a good indicator if the apps are legitimate and safe to use.
- Keep track of your monthly bills, in case unknown phone calls or service charges are made on your account.
Detecting Identity Theft
45% of identity theft is discovered first by consumers, so heightened consumer vigilance is key to limiting identity theft. To stay on top of account activity, consumers can sign up for email and mobile alerts offered by their bank and credit card servicers. This will enable them to see fraudulent charges or account changes as soon as they happen, limiting the time criminals have to do damage. Automatic email alerts inform consumers about unusual credit activity and address changes in their accounts. FTC research found that 35% of identity theft victims reported that their bank or credit card provider first alerted them to fraud on their accounts. In 2010, 22% of identity fraud was detected by consumers monitoring their financial accounts for unauthorized address changes, a common method criminals use to take over a victim’s identity. Consumers should review their free annual credit report to ensure that all the accounts and employers listed are accurate. Doing so will alert consumers to fraudulent accounts, loans, and employment criminals may have engaged in using their identity. Free credit reports are available online at AnnualCreditReport.com or by calling 1-877-322-8228. At least 8% of identity fraud was detected by consumers monitoring their annual credit reports.
Getting Your Free Credit Report
Consumers should avoid the following common mistakes when getting their free credit reports:
1. Mistyping annualcreditreport.com and instead reaching fraudulent or misleading websites offering bogus services.
2. Mistaking “annual” for once a calendar year. Everyone is entitled to a free credit report from each of the three main credit reporting agencies once every 12 months, regardless of the calendar year cycle. Consumers often request a credit report from all three credit services at the same time. Instead, consumers should know that they can request a credit report from one of the credit report servicers every four months.
What to do when you detect identity theft
In addition to financial loss, victims of identity theft spend time and effort undoing the damage left behind by criminals. In order to safeguard themselves from future claims and debt collectors, consumers must establish that they were victims of identity theft, collect supporting documentation, and keep track of the agencies and businesses they have contacted. Step 1: Notify your financial institutions.
When consumers discover that their wallet, checkbook, credit card or other sensitive information has been lost or stolen, they should immediately notify the issuing bank, credit card or relevant institution to close all existing accounts. Consumers should also immediately report any suspicious activity on their accounts to the relevant institutions. Early reporting is crucial to limiting the time criminals have to damage to their victims’ finances or credit.
Step 2: Notify the FTC.
If consumers notice fraudulent activity and suspect identity theft, they should report the suspected cases to the FTC using the online complaint form. In addition to providing further insights into identity theft, reporting to the FTC will help victims develop documentation establishing that they were victims of identity theft. Such documentation will prove helpful later on as victims work to undo damage caused by identity thieves.
Step 3: File a police report.
Consumers who believe they have fallen victim to identity theft should then file a report with their local police department and retain copies of the police report for future use. In California, local police are required to file an identity theft report documenting a victim’s complaint. A comprehensive identity theft police report includes enough information to detail damage caused by identity theft. Consumers should bring a printed copy of the FTC ID Theft Complaint form, a prepared cover letter, and supporting documentation when filing a report.
Step 4: Contact one of the three major credit reporting companies and place a fraud alert and security freeze on your account.
An important next step is to place a fraud alert on your credit reports, and review credit reports regularly. Placing a fraud alert will frustrate criminals’ efforts to open new accounts in your name in order to commit fraud and minimize future damage. Alerts can be placed by contacting the toll-free fraud number of any of the three consumer reporting companies noted below. Consumers do not need to contact all three, as notifying one will suffice.
• TransUnion: 1-800-680-7289; www.transunion.com; Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790
• Equifax: 1-800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
• Experian: 1-888-EXPERIAN (397-3742); www.experian.com; P.O. Box 9554, Allen, TX 75013
Consumers should also place a security freeze on their credit reports. This will restrict access to their credit report and reduce the likelihood that criminals will be able to open a new account in their name. Initiating a credit freeze does not impact credit scores nor does it prevent consumers from getting free annual credit reports or from buying their credit reports or scores later on. In California, a security freeze is free for victims who have a police report of identity theft. To place a freeze, victims must contact each of the three credit bureaus noted earlier and provide them with their personal information and a copy of their police report of identity theft.
The difference between a Fraud Alert and Security Freeze
A fraud alert is a notation on a credit report that a business receives when checking a consumer’s credit rating. It tells the business that there may be fraud involved in the account. A security freeze means that a consumer’s credit file cannot be seen unless the consumer gives prior consent. Most businesses will not open credit accounts without first checking a consumer’s credit history.
Privacy Protections When Paying By Credit Card
California has special laws protecting a consumer’s privacy when paying by credit card. Law prevents retailers from collecting personal information from credit card transactions to use for their own marketing purposes or for selling to direct-mail specialists. However, some merchants continue to collect personal information from credit card transactions illegally. Consumers need to be aware of what information a merchant is and is not allowed to collect when paying by credit card. A Merchant is NOT Allowed to:
• Write personal information, including your address and telephone number, on the credit card slip.
• Use forms with pre-printed spaces for personal information.
A Merchant is Allowed to:
• Collect personal information for cash advance transactions or when a credit card is used as a deposit for goods or services.
• Collect personal information when required by contractual obligation or obligated by federal law.
• Collect personal information for an incidental special purpose such as for shipping, delivery, servicing, installation and special orders.
• Ask a consumer to provide reasonable forms of I.D. such as a CA driver’s license, CA state I.D. card or other form of photo I.D. (But again, the merchant may not write any information from the I.D. onto the credit card sales slip).
• Record driver’s license number or I.D. number IF the cardholder does not show the credit card number to the merchant (e.g., when paying by credit card over the phone).
If you have been asked by a merchant to provide you name and address to be written on a credit card transaction slip or otherwise find a merchant to be using your personal information in a way you find intrusive, you can get more information regarding your rights and remedies by sending an e-mail to CALPIRG.
Privacy Protections When Paying By Check
The practice of merchants recording your credit card number on your check provides an easy way for your account information to be stolen and your credit ruined. In 1990, the California legislature passed a law prohibiting retailers from continuing this practice. Sadly, many merchants continue to violate the law. Consumers should know what can and cannot be required of them when they pay for retail items by check. The Merchant is NOT Allowed to:
• Require the consumer to show a credit card as a condition of accepting a check and is not allowed to record a credit card number on the check;
• Call the credit card company to verify if consumer has credit to cover check;
• Condition acceptance of the check on the consumer authorizing the merchant to charge the credit card if the check bounces.
The Merchant is Allowed to:
• Require and record the check guarantee card number;
• Ask for and record the consumer’s name, address and phone number on the check;
• Ask to see a driver’s license, state identification card or another form of photo identification;
• Require or record the credit card number when a check is used to get cash back, the credit card number is used in lieu of a deposit, or when a check is used to make payment on that credit card account
• Ask a consumer to voluntarily show a credit card for identification or to demonstrate credit-worthiness ONLY IF the information recorded is the type of card, the issuer, and expiration date. The retailer must also inform the consumer that showing the credit card is not a requirement by posting a notice or telling the consumer directly.
If you were asked to provide your credit card number and the merchant wrote the number on your check when paying for retail items, or if a merchant took other questionable actions with regard to your credit, you can get more information regarding your rights by sending an e-mail to CALPIRG.
MORE IDENTITY THEFT RESOURCES
There are many free sources of advice and assistance available, and we have compiled a few below. • The Consumer Federation of America launched the IDTheftInfo.org site, which features news, resources for consumers and businesses. • Identity theft victims can find good advice and a victim support on the California Attorney General’s Privacy Enforcement and Protection Unit website. • The nonprofit Identity Theft Assistance Center provides free Victim Assistance for customers of companies that support the organization. • Free counseling for identity theft victims is available from the nonprofit Identity Theft Council. • Identity theft victims can get free advice and assistance from the nonprofit Identity Theft Resource Center. • The Federal Trade Commission provides advice about what to do If Your Information Has Been Compromised But Not Yet Misused and how to Take Steps To Respond To And Recover From Identity Theft. There is also information about Credit, ATM and Debit Cards, What to Do if They’re Lost or Stolen. Finally, the FTC has a series of online tutorials on staying safe on the web
available here • See the Internal Revenue Service advice about Identity Theft and Your Tax Records. • If your Social Security number has been stolen, read the advice from the Social Security Administration about Identity Theft and Your Social Security Number. • Identity thieves may use stolen personal information to get medical services. Read the Medical ID Theft/Fraud Information from the U.S. Department of Health and Human Services.