When Alexis Moore looked at her credit report as a matter of routine, she discovered a strange entry: a satellite TV service with an overdue balance of about $250. Moore, who wasn't a customer of the company, figured it was simply a mistake. "I thought I could take care of it myself," the Northern California–based attorney says.
Turns out, someone had stolen her identity and racked up months of charges. "I reported it to the police and the Federal Trade Commission—all the things they say you're supposed to do," Moore explains. Despite her efforts, she says, a "firestorm of nonsense" erupted, one that took two years and a legal battle to extinguish. The thief was never apprehended.
More than 650,000 people in the United States reported incidents of identity theft to the FTC in 2019. The actual number of victims is probably much higher, because these crimes take many forms and get reported inconsistently. Javelin Strategy & Research, a financial advisory firm, estimates last year's total monetary losses nationwide due to identity fraud at $16.9 billion.
Experts predict the losses will continue to grow. To protect yourself, it's important to understand the basics about identity theft, the possible consequences of becoming a victim, and the ways you can minimize your risks.
Identity theft happens online and offline.
Recognizing Identity Theft
Identity theft is defined as illicitly using someone else's personal information for financial gain or any other benefit. The most prevalent example is credit card fraud, in which the thief opens an account under an assumed name. Related crimes include getting a phone, renting an apartment, taking out a bank loan, or applying for a driver's license with a stolen identity.
The FTC tracks seven broad categories of identity theft, nearly all of which are on the rise. The ways criminals approach stealing someone's identity vary just as widely. They might "skim" credit or debit cards by attaching a device to a legit card reader that captures and transmits account numbers and PINs. They may request a Social Security number under false pretenses in the form of a "phishing" email or phone call. They may pilfer personal information from documents taken from mailboxes and trash or recycling bins. These are but a few examples.
The variety of identity theft scams seems boundless, says Jessica Warren, manager of fraud awareness, education, and outreach for Western Union. "There are romance scams, giveaway scams, even inheritance scams," she says. "It's something that can happen to anyone."
Steve Weisman, a law professor at Bentley University and author of the book Identity Theft Alert, warns that identity theft appears to be increasing in 2020, a trend he attributes to the Covid-19 pandemic. "Phony websites are luring people into providing their personal information or unwittingly downloading malware [malicious software] that will steal information." Warren adds that the United States saw a rash of fraudulent attacks related to federal government stimulus checks earlier in the year.
Knowing the Consequences
Because identity theft takes so many forms, the impact of an attack can range from inconsequential to life-changing. Fraudulent credit card purchases that the real cardholder discovers and reports quickly to the financial institution typically result in little or no damage to the victim; your liability tops out at $50. It's more complicated with debit cards: Federal law limits your liability to $500 if you report an attack within 60 days; if you don't, your liability is unlimited and you can lose all the money in your account, Weisman notes.
That said, as Alexis Moore's story shows, identity theft can have a severe and lasting impact. Scammers who open new accounts, borrow money, or even buy property in your name can cost you money and damage your credit long-term.
The consequences of identity theft can go beyond financial problems too. Your stolen ID could be handed to police by the actual perpetrator of a crime, claiming to be you and opening you up to a wrongful criminal prosecution, says Gabe Turner, chief editor of Security.org. In one burgeoning type of identity fraud, scammers use a victim's health insurance to get treatment or prescription drugs under the victim's name. This could lead to medical bills and, if controlled substances are involved, criminal liability until the matter is resolved.
Use credit reports to help monitor fraudulent activity.
Protecting Your Identity
As with other aspects of your personal and financial life, exercising care and diligence will help you protect yourself from identity theft. Keep passwords, credit card numbers, and other information private to reduce your vulnerability. Shred paperwork before you recycle it. Regularly monitor your account activity. Discovering problems quickly decreases their impact on victims and expedites recovery, says Victor Lamond, operations manager for AAA Identity Champion. "We live in a fast-moving digital world, so the faster we can detect an instance of identity theft and take action, the better we will be at reducing risks to our finances, privacy, and reputation."
You can practice good digital hygiene by using strong passwords and two-factor authentication on your accounts, filtering out spam, being wary of attachments, installing software that regularly checks your computer for viruses and malicious code, and avoiding sharing details (such as your mother's maiden name) on your social media accounts, which you should always set to private.
It's possible to monitor for fraudulent activity using two free tools: credit reports and notifications from financial institutions.
Annualcreditreport.com, a federally mandated service, gives consumers access to a copy of their credit report from each of the major reporting agencies— Equifax, Experian, and TransUnion—once a year. These reports summarize all accounts open in your name, including payment history and other details. Your primary task when reviewing them is to make sure everything is accurate. If you find an error, open a dispute. (Pro tip: Rather than requesting all three reports at the same time, get a different one every four months, which improves your odds of catching any fraudulent activity early.)
Meanwhile, set up email or text notifications for activity related to your debit cards, credit cards, and bank accounts. This is the fastest way to uncover any wrongdoing. These alerts, which can be set up through each provider's website, are highly configurable. For instance, you could be notified immediately if your debit card is used outside the United States, or if a transaction exceeds a certain threshold (whatever dollar amount you choose).
To ratchet up your protection, you can opt into an identity-theft protection service (such as Identity Champion from AAA). These services, sold as subscriptions, keep tabs on your credit report and alert you to fishy changes. Some plans offer recovery assistance when personal information has been compromised, as well as insurance coverage that may cover financial losses related to identity theft.
Act immediately if you believe your identity has been stolen.
Recovering From an Attack
If, despite all your precautions, your identity is stolen, the best thing to do is take action right away. Call your bank and credit card providers, change potentially compromised passwords, and consider putting a fraud alert on your credit report.
In more severe cases, you'll need to take additional steps. The FTC outlines best practices online at identitytheft.gov. Steps include freezing your credit (asking each of the three major agencies to stop issuing new credit in your name until you decide otherwise) for extra security and reporting the crime to the FTC and local law enforcement. Much of this can be done online, and you'll want a "paper trail" if your case ends up in court, as Moore's did.
Resolving an identity theft can take time and persistence, but failing to address it head-on can result in bigger problems. "There is no shame in looking after yourself," Moore says. "If you see something wrong, don't wait. Get help immediately."