TRANSCRIPT—Identity Theft

NARRATOR: When you hear about a large data breach, your first thoughts might be about credit card fraud. In this Achieving Excellence podcast, Will Marling, Executive Director of the National Organization for Victim Assistance, gives an overview of identity theft and ways you can protect yourself. Marling is a Certified Identity Theft Risk Management Specialist. He says that while credit card fraud is a problem, it only accounts for about 17 percent of the crimes associated with identity theft.

WILL MARLING, EXECUTIVE DIRECTOR, NATIONAL ORGANIZATION FOR VICTIM ASSISTANCE: Identity theft is commonly considered like a paper crime or a white collar crime, something like that. And we know full well that this crime is being used as a tool in violent criminal victimization, including stalking, harassment, sexual assault, domestic violence, trafficking for children. Because if you traffic somebody in, you need to give them an identity to change their status, and maybe they're from another country and they are here illegally—not just as a person, but criminally illegally, but also they don't have legal status, so what do we do? We give them legal status by stealing somebody's Social Security number and name.

NARRATOR: A stolen identity can be used for many different crimes beyond violent crime.

WILL MARLING: There's medical identity theft, where people are using other people's identification to gain medical services. There's employment identity theft, where somebody uses my name and Social Security number to legally gain employment because they don't have legal access to employment. There's child identity theft, where their personal information is being misused for all of those other things, sometimes. And so it's a complex problem, touching a lot of different areas, and that's why it's very intimidating for people to confront, but also to remediate.

NARRATOR: The crime of identity theft has been around a long time.

WILL MARLING: We've always had the personal information but many times it was in a hard copy file in a locked drawer in a locked file behind a desk. And, of course, there were breaches when people would break into doctors' offices and steal those files. What has changed the game, really, is the issue of technology and digital technology and digital information because that gives the potential for multiplying my personal information and putting it out there, and then it makes it accessible, not just locally but, because things are digitized, they're now in electronic files. And if those files are not secure, that makes the vulnerability and the potential for that much higher—in essence, exponential.

NARRATOR: Increasingly, our personal information is stored in large databases—often in the databases of many different organizations.

WILL MARLING: It's academic institutions; medical-related, health care-related fields. So many people have their hands on our personal information, the question is, are they taking care of it? And there's good indication that they're not; that it's being lost or stolen. And we have no control of that, and then it's breached. There were 550 declared major data breaches in 2011, which means that those are the ones we know about. In other words, a company or an entity or an organization that lost information, either through a hack or just some form of negligence, you know. Even with the known data breaches, we know that amounts to hundreds of millions of records of people's personal information.

NARRATOR: At this point, there is no consistent way to handle communication about breaches or consistent steps for remediation.

WILL MARLING: There are laws but they're inconsistent, they can vary from state to state, and there's really not a consistent data breach standard in the country to tell us what we should do about it, how we should tell people. There's really not a direction for remediation because the nature of the problem. And so that needs to change, because we need to give people options about what to do to remediate or to minimize the threat. And a good percentage of people who receive a data breach notice actually become victims.

NARRATOR: The model standards include program guidelines for securing and maintaining client data. The standards also address procedures for notice to the client if data is stolen or lost. Each person—from elderly to infants—is vulnerable to identity theft.

WILL MARLING: Targets for identity theft revolve around the value of the information, how it can be used, and the vulnerability of the person being targeted. For instance, the older generations can be targeted; there's no question about that. They come from a different generation where their information can be out there; they also have assets. If they are retired they might be considered more valuable because they've worked all their lives and now they have that nest egg that they're living off of. It's surprising to people that the most vulnerable group for identity theft is not the elderly but it's 20 to 30. That's the group most victimized by identity theft because those people are the most connected today, electronically, and they have probably the least amount of awareness about what their personal information means. In other words, they're posting a lot of information on their Facebook site or their social networking site. And so about 30 percent of people posting on a social networking site post their name, their address, their date of birth, including the year. And with just your name and your date of birth, there's a lot of damage I can do to you, actually, just with those two pieces.

NARRATOR: The value of what can be stolen and the vulnerability of the person combine to make military personnel common victims of identity theft. They are vulnerable while on deployment.

WILL MARLING: Those folks deployed are gone for a period of months or years on deployment. That gives perpetrators an opportunity to access their information while they're away, that nobody's going to be checking on unless it's an informed spouse or significant other or loved one or friend. And that means that many times the soldiers are being victimized in identity theft while they're on deployment, and they don't even find out about it until they return. And now there are advocates who are becoming more aware of this and discussing options for security freezes. The military has its own security freeze option with the credit bureaus. But it's really important, obviously, to be aware that they can be easily targeted because they're simply gone for a while, and perpetrators that are aware that they're deployed know that they have time to use their personal information.

NARRATOR: While children may not have financial resources, their names and Social Security numbers are valuable. They are vulnerable, in part, because most parents don't realize the value of their children's personal information.

WILL MARLING: We laugh and say, "Oh, my kid's getting a, you know, a credit card offer." In reality, that could be a big red flag that his information is being used. So you want to check the Social Security Administration for any work history, because his name and his Social Security number are very, very valuable for that. And secondly, from the standpoint of credit, you should look and see if he has a credit history. This can happen very young because as soon as a child has that, that number can be stolen, of course, and misused.

NARRATOR: Children in foster care are also vulnerable to identity theft victimization.

WILL MARLING: It's quite egregious when you realize that children in foster care present a unique opportunity for perpetrators. They themselves are not aware of the value of their personal information. Many times they don't have control over their personal information. That information is in the hands of caregivers, foster parents, and it could happen with anybody who gets access to their personal information and realizes that that child really doesn't have anybody looking after that aspect of who they are. So in foster care, who actually is looking out for them? And that's a big part of the problem, because it could be anybody who has access to that personal information and uses it for a variety of reasons and then creates a context where a foster child has a lifetime of challenges trying to remediate debts that are created, crimes that are committed in their name; and they could end up dealing with this for a lifetime—literally, for a life time.

NARRATOR: These foster youth discover the theft of their identities as they are exiting or aging out of the foster care system.

WILL MARLING: And so now they have access to their information and they start getting calls from creditors looking for payment. Or they have a traffic stop and they're pulled over and they discover that there's a warrant out for their arrest for a crime committed in their name. The discovery could happen earlier by an attentive caregiver or foster parent who notices inconsistencies or realizes that there's a problem with the records that are being kept. And so it's another awareness issue for those of us who care about kids in this system to be paying attention to whatever symptoms might present themselves, just like any identity theft victim.

NARRATOR: A red flag that should warn you of a problem is anything unique or unusual on a statement. A missing statement can also indicate a problem.

WILL MARLING: The first place the breach occurs for an individual is commonly change of address because what perpetrators want to do is re-direct your mail to them. They get the statement and so that prevents you from knowing what's transpiring, you don't know where the statement went. And then, of course, they can commit crimes of identity theft and fraud in your name and it takes a while for you to even find out, and you don't even know where they redirected it to. Anything out of the ordinary. Many times it's very subtle, and commonly it's the victim who has to take notice. So it's truly paying attention to your own patterns, your own statements, and even the subtle things sometimes are indicators. For a child, anything that indicates that they're involved in some, you know, adult-level activity, like having a job or owning a credit card or having some account that they really shouldn't have at their age. I mean, a child at 11 should not have a work history. And so that's an indicator that somebody could be using their Social Security number, for instance, to gain employment or to take out a loan in their name.

NARRATOR: Prevention and remediation, Marling says, begin with awareness.

WILL MARLING: Awareness is crucial here because once you begin to realize how valuable your information is, you begin to make different choices. You just simply make different choices about who you give your information to, and even in giving it, asking questions: Why do you need it? What are you going to do with it? How are you going to protect it and, when you're done with it, how are you going to destroy it? Those are very fair questions. Well, do you really need to have this information?

NARRATOR: Marling also cautions against keeping files on your computer with names that identify them as having personal information. Files with names such as "tax return" or "passwords."

WILL MARLING: Anything connected to a network really is accessible. So it's just really taking that extra step. If you have to have that file on that computer, I just suggest you rename it at the very least. You don't want to label sensitive files in a way that indicates what's in them. That's really the principle there. And that's easy to do. Just change that file name.

NARRATOR: Because of the time-lag between the theft and possible criminal use of your personal information, Marling suggests you review your own records.

WILL MARLING: It's important to, first of all, look at your credit report and continue to monitor your credit report. That's one indicator that something is awry, that somebody's using your personal information. We have the right—each of the three credit bureaus, the main credit bureaus, are obligated to give us one free credit report a year. And so, with that, if you stagger those, say, every four months, you can get a free credit report every four months, one from each of the credit bureaus. The common practice is simply to review records, any statements that you get. That information is important to review. But many people don't even bother to review their credit card statements, their bank statements that they're given on a monthly basis. As well, you can put a credit security freeze on your accounts, which means that no credit transactions can take place with your personal information. And that can impact a large area of the problem.

NARRATOR: Because so many organizations and institutions have our personal information, some may worry it's not possible to minimize the risk.

WILL MARLING: And so the temptation is to say, "Well, if everybody's losing my information, why bother? Why should I even, you know, bother to do this?" And, what's important to recognize is that if you're victimized, it commonly becomes more complex. And so anything you can do to minimize the risk, even if your data was lost in a breach—locking down your information, doing a security freeze on your credit, monitoring your credit. You can also do fraud alerts. Those kinds of things, if you're aware you can do them, narrows the risk. Because people are going to go to the lower-hanging fruit, to be honest.

NARRATOR: Another way to reduce risk is to hire a third party to monitor your data.

WILL MARLING: My personal recommendation is pick a service that has no vested interest in doing anything but protecting your information, a company that says, "Our reputation rises or falls on whether we're protecting your information, and the service we provide if you're the victim of identity theft."

NARRATOR: If you're the victim of identity theft—even if it's credit card fraud and the bank will handle it—Marling urges that you contact law enforcement.

WILL MARLING: To declare publicly, legally, officially, I am the victim of identity theft. Because it becomes very complicated when law enforcement can't tell the difference between the perpetrator and the victim. And that's what makes it so complex and so frustrating for victims, because they now feel like they've done something wrong and they haven't. So these are the kinds of things that we're trying to emphasize. And this all goes back, really, to victim service standards, doesn't it? There's an emphasis in the standards on technology, which is really crucial here because very few of us can keep up with the technological advances that not only create options for efficiency and convenience in exchanging information but also, the reality is, it also creates opportunity for perpetrators. All of these things connect really. This becomes yet another tool in the scope and scale of victimization that includes violent criminal victimization.

NARRATOR: Crimes like identity theft put victim assistance providers at the forefront of emerging technologies. The model standards offer a comprehensive approach to improving the range and quality of service delivery.