Most of the investigators who deal with identity theft in the Utah Attorney General's Office no longer get mail delivered to their homes. They rent post office boxes.
And one, chief deputy attorney general Kirk Torgensen, spent an afternoon anchoring a locking mailbox in concrete in front of his house.
They know just how vulnerable paperwork makes people in this age of identity theft, a time when too many teens go to buy a first car and find they've already got a long debt history they didn't create and too many adults show up begging for help because their good credit has been stolen — some long after the fact because they don't routinely monitor their accounts.
It's hard to put a number on how many Utahns have had their identities stolen and to what degree, Torgensen says. But Tami Nealy of LifeLock says research indicates that the number of people trolling the Internet for personal information has increased about 38 percent since last September, about the time it became clear the economy was souring. It's unknown what they're searching for or how they intend to use personal data they find, but that's a pretty good reason to be extra vigilant about preventing identity theft, experts agree.
The Federal Trade Commission has seen a 16 percent uptick in the number of Utah cases reported, said Nealy, who adds it's probably an undercount, since many people don't know to file with the FTC.
Often, the identity thief is someone you know well — a friend or brother or even a daughter. Much of it is not random; for instance, Postal Service spokesman Ron Hubrich notes that the FTC says fewer than 2 percent of identity theft cases cite stolen mail as the source of the purloined information. The source is much more likely to be someone you know. You have to be cautious on a lot of fronts.
And tough economic times always seem to increase certain crimes, says Richard Hamp, who prosecutes identity theft for the Utah Attorney General's Office.
"We're going to see a huge increase in ID theft," he predicts. "It's easy to commit and has a high return. People who are walking the edge criminally are going to fall off" in the bad economy.
Investigators are already seeing more of certain scams, like phishing, where you get an e-mail from your financial institution telling you that for security purposes you need to log in (they thoughtfully provide a bogus link) and "verify" yourself with your account number and other identifying information. Reputable institutions don't ask for that stuff online. There are other variations that text your cell phone or call you and ask for the data.
And if you don't think you need to be proactive, Nealy urges you to consider this:
Not long ago, many universities used Social Security numbers for personal identification numbers. So did health and life insurance companies. If you got tired of writing it down for everyone who wanted it — the local pharmacy and grocery store that cashed your check, your doctor, lawyer, alumni association and interior designer, all of whom you gave it to at some point — you could have it printed on your driver's license or even your checks. Many of us did.
It's out there. And here's another chilling fact: If someone randomly puts together a Social Security number for illicit work purposes and it happens to be yours, checking your credit report will not tell you about them. Say your name is John Doe. The thief is using the name Jane Scofflaw. When you ask for your credit report, the credit bureau will simply pull the material attached to John Doe and send that to you. They'll never tell you Jane Scofflaw is also using that same number. If someone's using both your name and number, you may pick up on it, though. And that's actually the scarier scenario for you, says Hamp, who helped push a law that makes ID theft a felony, not a misdemeanor.
"Where the name and number match, that's particularly deadly, because law enforcement, etc., is looking for mismatches. It costs more to buy a name-number match because computers will not catch it. And if you're an ID theft victim, the burden is on you to fix it. That's much harder with a match."
No Utah law forces someone to tell you your data may have been compromised. When last summer University Hospital announced that personally identifiable information was potentially compromised by a car break-in, it was a gesture of goodwill. Ditto when mortgage finance giant Countrywide made a similar announcement. Companies do it because they know it helps rebuild customer trust, perhaps, but Utah is not a state that mandates such disclosure.
Utah was, however, among the first states to enact a credit-freeze law, with a mandate that you be able to thaw your credit quickly to complete a transaction. There's a fee to freeze and to thaw, but it provides pretty solid credit protection, Hamp said.
Adds Torgensen, they had to fight for it. "It can't be done," "It's too burdensome," he says they were told. "Well, it could be done and it was. It works fine."
Utah also has the distinction of being the first state that made a fuss about children's Social Security numbers being compromised, he says. The attorney general's office and Workforce Services teamed up for a pilot project that found a disturbing number of children who were no longer the sole possessors of their numbers. And when a Social Security number is used fraudulently, such as for a job — that's the largest category of ID theft — it's not something the IRS makes a fuss about, he said. If the state sees it, though, it sends a warning letter to tell parents to check if the child has a credit record he shouldn't. If so, there are steps to take to clear it up in a timely fashion before a child is rejected for a student loan.
"The worse thing you want to do is not know," Torgen?sen said. "The earlier you find out, the easier it is to fix. And even then, when you're proactive, it's a lot of work. That's a pet peeve of mine."
Unfortunately, he said, victim advocates were eliminated by budget cuts.
While nothing's foolproof, there are steps concerned people can take to protect themselves. Use a fraud alert, for instance, and if you've provided your cell phone number, you might get a call while you're standing in line at the grocery store to see if you're really trying to buy a car across town. The underwriter will ask questions that verify it is your credit, such as who holds your mortgage and what's your payment. Then you can say you did apply for that credit or you did not. But not all creditors subscribe to the credit bureaus, so it's not foolproof.
When you apply for your free credit report, do it through annualcreditreport.com. It's the only source of the free, authorized report.
E-mail: [email protected]
Sources on the Web
Utah Attorney General's Office: