When Equifax reported a massive data breach, you may have been concerned that you could become a victim of identity theft.
On the other hand, you might be only vaguely aware of the threat and not sure what identity theft is or how identity thieves operate. The Consumer Financial Protection Bureau (CFPB) has published a comprehensive guide to identity theft, with advice for affected consumers.
It offers useful tips for protecting your data and recommends steps to take if you become a victim.
Eva Velasquez, President and CEO of the Identity Theft Resource Center (ITRC) in San Diego is accustomed to working with consumers who have been blindsided by identity theft and aren't even really sure what has happened to them.
"Identity theft is the misuse of your personally identifying information for someone else's gain," Valasquez told ConsumerAffairs. "It can be financial, it can be for goods or services, it can even be to avoid punishment or consequences for their behavior."
Stealing your identity
So the fact that your name, address, Social Security number, and other personal information could be in the possession of criminals is a big deal. In today's impersonal, anonymous world where fewer transactions are done face-to-face, having this information makes it easy for someone to pretend to be you.
Identity thieves could apply for a credit card in your name, obtain a copy of your driver's license, buy a car, or even file a fake tax return claiming a big refund. When they don't actually pay for any of this, they don't get in trouble -- you do.
Valasquez says an identity thief can even get in trouble with the legal system and escape the consequences.
"We've had a couple of cases where people told us they were having their wages garnished for child support and they didn't even have children," she said. "The thieves can pretend to be you and operate as you, whether it's making purchases, getting medical goods or services, or filing for government benefits."
Financial institutions are trying to help consumers understand the gravity of the issue and take steps to protect themselves. Bank of America recently produced this brief YouTube video as a guide.
What happened to my data?
If you are one of the 143 million consumers whose financial information may have been compromised, you may be wondering where your information is now. What has happened to it? Unfortunately, says Valasquez, it could be just about anywhere.
A rouge nation state may have it and could sit on it for years before doing anything with it. Large fraud rings may buy it in bulk, along with thousands of other consumer profiles, and sell it to individuals on the Dark Web. Each time the information is sold it makes money for all the criminals involved, which is why identity theft is so lucrative.
"Some of these guys selling stolen identities even have customer service policies, so that if your bundle of stolen identities you purchased doesn't meet a percentage guaranteed use, you can get a refund," Valasquez said. "It's extremely elaborate."
How to protect yourself
So how do we protect ourselves? The most robust protection available, says Valasquez, is placing a credit freeze on your credit reports at all three credit agencies -- Equifax, Experian, and TransUnion. Here's how to do it.
When your account is frozen, no one can access it unless you unfreeze it. Without access to your credit report, even a thief with your Social Security number won't be able to open a new account in your name.
"Some people don't like the credit freeze as an option because it lacks flexibility, requiring you to unfreeze it every time you want to use it," Valasquez said. "You lock legitimate folks out too, but you lock the thieves out."
There's also a fee involved every time your freeze and unfreeze your credit. The fees vary by state, but average around $10.
Since so many people will now avail themselves of this protection, shouldn't the process of freezing and unfreezing credit be cheaper and easier? No, not really, Valasquez says.
'It should be a little difficult'
"I think one of the reasons we're here now is because we want everything to be effortless and convenient," she said. "When it comes to authenticating ourselves, I think we need to rethink our expectations about how effortless that should be. It should be a little difficult, it should be a little complicated for me to prove that I am me."
With 143 million consumers facing this difficulty from now on, there is a lot of consumer anger toward Equifax, and other commercial enterprises that have suffered data breaches. Valasquez says that's understandable, and entities that have security breaches must be held accountable.
"At the same time, when it comes to service delivery that we're asking from these folks, we need to be reasonable about that as well," she said. "I don't think we can have our cake and eat it too. I don't think we can have seamless and easy and high levels of security and protection, at least not yet."
If you become an identity theft victim, you probably aren't going to know right away. You might not know until you start getting late notices for bills you don't owe or calls from bill collectors. At that point, much of the damage is done.
Pull your credit report
What every consumer should do in the short term is take advantage of the federal law that provides free access to their credit reports from all three credit agencies once a year. The reports are available by going to www.annualcreditreport.com.
You are not required to download all three at the same time. Download one of the reports and check it carefully for credit accounts that are not yours. Four months later, download a second and repeat the procedure. In another four months, download the third report.
Unfortunately for the 143 million of us compromised by the Equifax data breach, this vigilance will be a necessary part of our financial lives from now on.