Identity Crimes: Impact and Recovery

It’s not just identity theft anymore. Criminals have expanded to a whole range of identity crimes. And it’s extremely easy to unintentionally give your private information to a scammer. Even something as simple as calling tech support could put your information in a criminal’s hands. It’s essential to be vigilant about your data.

See Identity Crimes: Theft, Compromise, Misuse with Mona Terry for a complete transcript of the Easy Prey podcast episode.

Mona Terry is the Chief Victims Officer at the Identity Theft Resource Center (ITRC). The ITRC navigates the complexities of identity protection and identity crime recovery. Mona’s role provides high-level oversight, which includes looking at the types of identity crimes people contact them about, analyzing trends, and determining which protection and prevention methods help the most. She also creates training materials internally and conducts training outside the ITRC so people know how to protect themselves and how to recover if the worst happens. Knowing people are vulnerable and criminals are preying on them angers her, so she is motivated by the opportunity to help and support them.

Explaining Identity Crimes

The ITRC has started talking about identity crimes instead of identity theft. There are multiple fraudulent things a criminal could do with your identity, and not all of them are technically theft. Mona breaks it down to three different categories.

First is identity theft, where someone is actually stealing your identity. This is the one you’ve probably heard the most about. Identity theft doesn’t actually do much on its own, but it enables identity misuse.

Second is identity compromise. This happens when your information is out there, but nothing has actually happened yet. Most often, identity compromise happens when you give your information to someone you thought was legitimate, only to later realize that they were untrustworthy or an impostor. Even though nothing has happened yet, your information is now out there and can be misused.

Third is identity misuse. This is when the thief has taken your information and is actually doing things with it. They’re opening accounts in your name, taking over existing accounts, using your health insurance, filing for unemployment under your name, or any number of other things. They’re misusing your information to get something.

How Identities Get Compromised

For an identity crime to happen, criminals first need to get your information. This can happen through data breaches or buying your information on the dark web. But most often, it happens through scams.

The number one reported site of [identity] compromise is through scams.

Mona Terry

Usually, people think they’re talking to someone legitimate – a government agency, a friend, or a business they actually do business with. The story sounds legitimate and the victim thinks they need to give out some information. Often, they realize after they give out the information that they weren’t talking to who they thought, and they call the ITRC.

We’ve seen a real big uptick in what we’re calling impersonation scams.

Mona Terry

This happens with all types of scams. Romance scams, crypto scams, any type of scam can be a way to get information out of you. But the big thing the ITRC has seen lately is impersonation scams. In the past, a lot of scammers had pretended to be government agencies, like the Social Security Administration. Now, a lot more scammers are pretending to be businesses, especially financial institutions.

Fake Numbers for Real Companies

A big trend the ITRC is watching is people who end up calling a scammer instead of the business they meant to call. This usually happens when someone is googling a customer service phone number and a fake number comes up. Historically, scam prevention has focused on being suspicious if a company calls you. It’s much harder when you initiate the call.

Knowing how to scroll through search engine [results] is important.

Mona Terry

Scammers are able to purchase ads on search engines, so they’re at the top of the search. The number one way Mona is seeing this method of identity crime happen is through search engine ads. And they’re harder to spot, too. With emails and websites, there used to be “tells,” like misspellings and poor English. Now with AI, fake emails and websites are getting more polished. And a search engine result can be almost impossible to identify as a fake.

Mona’s best advice is to make sure things are legitimate. Triple-check that the website is correct before putting in any information. If you get a statement or invoice from a company, make sure it’s legitimate. If you need to contact a financial institution, use the contact information on the back of your card – Mona has yet to hear about scammers mailing out fake credit cards with fake numbers.

Verification Can Be Hard

One of the reasons avoiding identity crimes can be so challenging is that verification isn’t easy. Scammers are good at getting into people’s heads. They use some information from somewhere else – or an earlier phishing attempt – to sound legitimate. They create a sense of urgency or fear, whether they’re talking to you through email, chat, text, or phone call. It all works together to create an environment where you trust the person you’re talking to, or you forget about the need to verify you’re talking to the real company in the first place.

People want to do the right thing, generally. And they don’t want to be scammed or taken advantage of. Part of verification is not being afraid to say, “I’m going to hang up and call you back.” Simple things to verify you’re talking to the right person goes a long way.

Victims want to do the right thing … [and] they don’t want to be scammed.

Mona Terry

It’s always good to be suspicious. Mona once had a friend who received a phone call from her local sheriff. The phone number was correct and they used the actual sheriff’s office’s information. They told her there was a warrant for her and she would be arrested unless she paid a fee. She was really concerned. They also told her not to tell anyone because it would jeopardize her case, but she told her husband, who was right behind her. He used his phone to call the sheriff’s office, who told him that was a scam.

It comes back to being suspicious. Victims already feel a lot of shame and are predisposed not to tell anyone what’s happening. If someone on the phone is reinforcing that and trying to isolate them, tha’s a big red flag.

Identity Misuse Can Be Devastating

There are a lot of different forms of identity misuse. The most common one is account takeover. This is what happens when someone steals your credit card information and makes charges on your account, gets into your bank account and sends themselves your money, or files taxes in your name. Anywhere you have an account, even if it’s just a retailer, account takeover could happen. Fraudulent charges on your credit card are the most common cause of misuse

The other common type of identity misuse is new accounts established in your name. You’ve probably heard of identity thieves taking out loans or mortgages in people’s names or opening new cards with their information. This is identity misuse. The ITRC has also recently seen an increase in bank accounts established in the victim’s name, as well as insurance and medical accounts.

Other forms of misuse include giving your information when getting pulled over or arrested or getting hired under your name. Social media account takeovers are also a form of identity misuse. This can be really challenging for people because social media includes a lot of personal information, including photos that they may not have anywhere else. And some people use social media as a source of income or to sell things for their business, which makes it especially challenging.

How to Protect Your Accounts

The best way to protect your accounts from takeover and other identity crimes is to secure them. And there are two fairly easy ways that can give you really good protection.

Use unique passwords for every single account. If you have a chance, create passkeys with unique phrases. You can use a password manager for this. Alternatively, Mona gives the example of a pet store website, you can create a passkey that says “Fido’s favorite store” with a couple of extra characters – that why it’s unique, but you can remember it.

Mona also highly recommends that you enable two-factor authentication (2FA) or multi-factor authentication (MFA) on every account that has the option. You can use an authentication app or get the 2FA code through text message. Some people may tell you that text/SMS is less secure than an app for getting your code. That is true. However, some 2FA is better than no 2FA. If you don’t have a phone that can run apps or don’t feel technologically savvy enough to use an app, do it by SMS – some security is better than no security, and it will still make it harder for someone to get into your account.

Defining Identity Theft

Identity theft is just like it sounds – it happens when someone steals your identity. They can get your information from all kinds of places. Data breaches and leaked information are common. They may also use phishing (including forms like quishing, smishing, and vishing) to get your information. And physical theft is still alive and well. People steal mail, wallets, or purses, or break into cars to get paperwork left there. Once they have enough info to assume your identity, they can start to misuse your identity.

Identity theft is one of the hardest identity crimes to become aware of. With compromise, you may be aware that you gave your information to the wrong person or get a notification about a data breach. With misuse, you can see unauthorized charges on your credit card, new accounts on your credit report, or weird statements of benefits from your health insurance company. But there’s no real way to know that a criminal is building a profile on you to steal your identity. Being aware of any theft that may have happen or paying for dark web monitoring to spot your information can let you know about compromise, but often you may not know actual identity theft has happened until you see signs of misuse.

Keep Your Information Out of Thieves’ Hands

People committing identity crimes ultimately want money. Mona encourages everyone to freeze their credit so no one can open accounts in your name. That includes you. Freezing your credit used to be a cumbersome process, but now it’s free and easy. You can do it online, call the credit bureaus, or even mail in a form (though Mona doesn’t recommend that because mail can be stolen).

You don’t want people sending information via mail if you can help it.

Mona Terry

Unfreezing can also be done in the same way. And many bureaus offer a “timed thaw” where you can unfreeze it for a certain amount of time or just for a particular company if you know you’re going to be applying for credit. The most secure option is to keep your credit locked down and release it only for situations you know about. You can also check your credit report for free to look for unauthorized accounts – right now you can check weekly without paying.

Many people don’t know you can also freeze your child’s credit. This is very useful, because if your minor child’s credit is stolen, you probably wouldn’t even notice until they tried to get credit years later. A lot of people don’t think to check because children shouldn’t have credit, but identity crimes happen to children too. As long as they have a social security number, you can freeze their credit. Mona recommends doing that as soon as your child is issued their social security number. After all, they’re not going to need it for a while.

Identity Monitoring is Like Washing a Car

Identity theft insurance and identity theft monitoring services are out there. Mona thinks of it like washing your car. It’s something that’s good to do, but you can choose whether you want to pay someone to do it for you or do it yourself.

Either way, you should do it. But it’s up to you whether you would like to pay a service to take care of it for you or do it yourself. And it is possible to do it yourself. Keep an eye on all your accounts and watch your credit. No news is not necessarily good news – just because you’re not getting notified of a problem doesn’t mean there’s no problem.

Some people are afraid to check because they don’t want to know. But even though it’s hard, catching it early can prevent you a lot of stress and frustration later on. There are a lot of resources out there that can help. If you’re not already doing this, you should start right now.

What to Do if You’re a Victim of an Identity Crime

What you need to do when you’re a victim of an identity crime depends on a lot of factors, like what was compromised, what specifically happened, and how that impacts your life specifically. Contacting the ITRC is a great place to start. They can help walk you through what’s going on and come up with next steps. They can also help you prioritize – if you can’t renew your driver’s license because someone opened a license in your name in another state, for example, that might be something to address first if you have multiple issues.

The ITRC serves as a resource to help people along this process. They don’t want to be a source for criminals to get your data, so they’ll never ask for account or personal info. Their goal is to walk beside you as you deal with it and provide guidance if you get stuck. And they’ll help no matter how long it takes, whether it’s resolved in a few months or takes multiple years. They’ve been helping victims of identity crimes for a while and they know what to do and how to help you do it.

Unraveling Identity Crimes Isn’t Easy

It takes a lot of effort and paperwork to deal with identity crimes. If there are multiple instances, it’s even harder. The ITRC doesn’t just focus on recovering from what specifically happened to you, but also about how to protect yourself from further theft, compromise, and misuse in the future.

There’s steps to just not only recover from the specific issue that’s happening, but thinking about what you need to protect yourself from other things.

Mona Terry

It’s not a quick process. With account takeover, it may take a few weeks to a few months, depending on how bad the takeover was. If you established the accounts in your name, and especially if it’s a financial institution you’re dealing with, there are usually good processes in place to manage takeovers.

If someone has opened a new account in your name, that can take six months or longer. You have to jump through the hoops of proving you’re the real person that goes with that identity, not the thief. The ITRC generally tells people it will take 3-6 months, but some people have had it take a year or longer.

Tax issues – where someone is using your social security number to earn income, file taxes, and/or collect unemployment benefits – get even more challenging. Now you’re dealing with state and federal issues. This can take a few years.

Sometimes people think that because their identity was compromised so quickly, it should be resolved quickly. Unfortunately, we’re just not there. That’s part of why identity crimes are so impactful. You still have to live your regular life and now also fight this issue. That’s part of why the ITRC exists – to support you, let you know you’re not alone, give guidance, and help you through the long process.

The Emotional Impact

The people at the ITRC aren’t therapists, but they do listen and generally care about the people who call. Sometimes it helps people just to have a sounding board where they can admit they’re scared and don’t know what to do. Many of the people working there have been victims themselves at one point or another. They understand the challenges and how hard it is to tackle all these things.

But the ITRC is also action oriented. They have empathy for the frustration and fear and often shame people feel when this happens to them. Many people are also overwhelmed – they don’t know where to start, or even if they do they feel like it’s just too much. The ITRC is there to tell you it’s a long process but help you get through step one and walk with you the whole way. And it’s tailored to your circumstances and how you want to move forward. They are a fantastic resource for anyone dealing with identity crimes.

Learn more about the Identity Theft Resource Center and get connected at idtheftcenter.org. There, you can contact them by chat, phone, or online form. They also have an annual Trends and Identity Report that discusses trends in identity theft and a Consumer Impact Report that discusses the non-financial impact of identity crimes. You can also connect with Mona on LinkedIn.