How Identity Fraud Affects Your Finances and How to Prevent It
Recovering from identity fraud, identity theft, and other identity-related crimes can be daunting. It’s a long, complicated, stressful process, and it takes a toll on your life. And this toll is not just financial and emotional. Depending on the crime, it can affect your life in different ways. And access to your accounts can let criminals manipulate your friends and family by pretending to be you.
See 10 Types of Identity Crimes with Eva Velasquez for a complete transcript of the Easy Prey podcast episode.
Eva Velasquez is the president and CEO of the Identity Theft Resource Center (ITRC). The ITRC is a 501(c)(3) nonprofit providing free recovery services to victims of identity crimes and identity compromise. People are sometimes skeptical that all their services are free – and Eva supports a healthy skepticism. But they are a legitimate charity, and you can look them up on third-party accreditation services like the BBB, GuideStar, and Charity Navigation. They have been around since 1999 providing identity fraud recovery help, risk minimization, and education.
Defining Identity Theft
There is some confusion around what “counts” as identity theft. Part of that confusion comes from how much information we make available on the internet. Birthdays, family members, information that could lead to where we live, or even our actual addresses are all online. Even the information that isn’t publicly available can be exposed. The more websites that have this information, the more likely it is to get into the hands of thieves through a data breach.
The real challenge is that we are putting more and more of our personal information out there online.
Patrick Glennon
Patrick defines identity theft as when someone pretends to be you for the purpose of getting access to credit, loans, credit cards, new phones, or anything else they can purchase in your name. Usually, but not always, the consequences of identity theft are financial.
Someone purchasing your credit card information online and using it to purchase things isn’t usually identity theft. Those thieves aren’t pretending to be you, they’re just using your card. This is just credit card fraud, and card issuers like Visa and MasterCard have programs to deal with that. However, credit cards can be used as an authentication method for other things. If someone is using your credit card to try and prove that they are really you to get access to something else, that’s identity theft.
There’s so many different ways that somebody can take minimal amounts of information and gain access to credit, to cash, to phones, to cars, to loans, to all sorts of things that can be done in your name.
Patrick Glennon
Identity Theft Methods
Criminals are creative. Every day they come up with new approaches and mechanisms to steal your identity. They have a wide variety of tactics. Here are a few of them.
SIM Swapping
SIM swapping is a relatively new method. Thieves get access to information you use for security questions, and they call your phone provider and convince them to switch your phone number to a new SIM card. That lets them receive your texts and calls. When your bank or credit card sends you a text with a code to prove it’s really you trying to log in, they receive that code and can access your accounts.
This happened to one of Patrick’s relatives, and it was very difficult to sort out. Even more scary, most of us turn on two-factor authentication for better account security, and text messages are a common way to get those security codes. But without taking some measures for identity theft protection, a SIM swapper can get access to those security codes. PayPal even has an option to get a code to bypass the password – if your phone number is switched to a new SIM card, a thief doesn’t even need to guess your password to get into your account.
Change of Address
If an identity thief gets your name and address, they can submit a change of address form in your name. They redirect your mail to a PO box they’ve rented, and then they go through your mail for those preapproved credit card offers. With those offers, addressed to you and preapproved for you, they can get access to credit in your name.
Classic Information Gathering
It’s not all shiny new techniques. Many identity thieves still use classic methods. They find, buy, steal, or phish enough basic information – your name, address, birthday, and Social Security Number – to effectively pretend to be you. Then they can open loans, apply for credit cards, buy cars, and do all sorts of other things in your name.
Purchasing Credentials
There are lists on the dark web that has information from old data breaches. If you’re the kind of person who reuses usernames or passwords, or haven’t changed your passwords in years, thieves can purchase that information for cheap and use it to access your accounts.
Using Social Media
Once identity thieves have access to one person’s account, they use it to get more information. A new version of this happens with Instagram. The thief gets access to one person’s Instagram account and changes the name in a very small way. Then they message the account’s friends, saying, “Hey, I want you to answer a survey about me, I’ll send you a text in a few minutes.” When the friend gets a text with a link from an unfamiliar number, they aren’t suspicious – they think it’s the survey from their friend they were expecting. They click the link, and now their Instagram account is compromised. The thief now has access to more private information on someone else.
Merging the Data
The criminals stealing your identity are working together, and they’re merging the information they get from you. Every detail they get can unlock more of your private information. They might start with a phishing email claiming your buddy wants you to fill out a survey or take a quiz. That gives them an answer to an Instagram security question and now they’re in your Instagram account. With the information from your Instagram security questions and your mother’s maiden name from Facebook, they then call your phone provider and SIM swap you.
Your age doesn’t matter, whether you’re a private citizen or a company, whether you’re part of a utility creator or whether you’re part of a bank, everyone’s getting targeted. And the methods are getting more sophisticated.
Patrick Glennon
Merging information from multiple sources is vital to criminals. And they’re targeting everyone. Often people caught by fraudsters feel like they were targeted specifically. Identity thieves aren’t targeting anyone in particular. The people who got defrauded were just the ones who weren’t thinking too much about identity theft protection. The fraudsters cast a wide net, and they just happened to be the ones who answered the phone or clicked the link.
Seeing the Gaps in Victim Support
Eva started her career in law enforcement. She spent twenty-one years at the San Diego District Attorney’s office, and the last eleven of those focused on consumer protection and investigating white-collar crime. She was on the side of “let’s catch the bad guys.”
But she also saw firsthand how dismissive we are of identity crimes and identity crime victims. There weren’t any resources for victims of identity fraud. When the ITRC was founded in 1999, Eva was thrilled because she now had somewhere to send people who needed more help than law enforcement could offer. Her job was to investigate fraud. She couldn’t provide recovery services or support – it wasn’t part of her job or skill set.
Looking at Eva’s career from the outside, it may seem like a dramatic change to go from working for a district attorney’s office to leading the ITRC. But it was really a natural evolution. From her time in law enforcement, Eva began to understand the victim experience, see how coercion was often used in identity fraud, and experience firsthand how victims weren’t getting the help they needed. When the founders of the ITRC retired, Eva jumped at the opportunity. She’s been running the ITRC for the last ten years.
Identity Theft Protection and Your Information
Many people’s personal information is just floating around online. There was the Yahoo hack in the early 2000s, as well as the Equifax breach in 2017. Chances are good that your information is already exposed somewhere.
Your information is probably already out there. It’s probably getting handed around and it’s probably getting resold.
Patrick Glennon
People in the identity theft protection industry often look at credit alerts and credit scores. If your information is already out there, making identity theft protection about keeping the information private is a lost cause. The key is to make sure you know the minute someone tries to do something with your information. That’s the point that your exposed information actually means something. And that’s when it actually becomes dangerous. Once someone starts using your information, they can harm your time, your finances, and your reputation.
When we talk about identity theft prevention, what we’re really talking about is spotting the scenarios where someone has got a hold of that information and is now using that information to try to obtain for themselves something in your name.
Patrick Glennon
Often the damage is financial. It only takes a few pieces of information to open a credit card or obtain a loan in your name. With a little bit more, they can do a SIM swap to get your two-factor authentication codes and access your accounts. But the damage isn’t always in terms of dollars. The CEO of Twitter got SIM swapped, and the criminals posted racist, misogynistic, and other horrible things on his Twitter account. The damage was reputational – it wasn’t financial, but it was still harmful.
Identity Fraud from a Law Enforcement Point of View
From a law enforcement perspective, identity fraud and identity crimes are so difficult because they’re often anonymous. The victim doesn’t know who stole their identity. There aren’t a lot of good leads. Most of the leads law enforcement can get lead back to the victim because the criminal is using their identity. Not only are most identity crimes not solved, most are not even investigated because there are no leads to follow.
The vast majority of these [identity] crimes… don’t just go unsolved, they’re not even investigated. The great challenge with this particular crime is it’s so anonymous.
Eva Velasquez
Eva is always telling her friend and colleagues in law enforcement that they need to do more. There needs to be more victim support and more resources provided to the visions that investigate identity fraud. But she also understand how hard it can be to investigate when there is nothing to follow.
She tells victims that focusing on getting their “pound of flesh” is not going to give the resolution they hope. The likelihood of even figuring out who did it is incredibly small. Getting a conviction is even harder. Even with convictions, the penalties just aren’t that strong. They vary between states and what exactly the criminal is charged with, but it’s rare to see an identity thief get years in jail. If they’re convinced, most sentences are less than twenty-four months.
Trying to hunt down the person who stole your identity and get them convicted just isn’t as satisfying as most people want it to be. Eva thinks your energy is better spent towards recovery.
A Broad Definition of Identity Crimes
At the ITRC, they have broadened the language. Instead of more common terms like “identity theft” and “identity fraud,” they group them all under “identity crimes.” That’s because there are so many different ways that an identity can be compromised and misused. The compromise piece is often forgotten because we don’t think of simple compromise as a crime, but it is.
There are so many different ways an identity can be compromised and misused.
Eva Velasquez
When Eva talks about identity crimes, she’s talking about a variety of situations. There are scams where criminals collect your info. They may trick you into thinking you’re talking to a legitimate business, a real government agency, or your real friend and convince you to “self-compromise” you information. That’s an identity crime. Data breaches are also a form of identity compromise. You gave an organization your information legitimately, but that data was taken, exposed, and sold. That is the actual theft part of it – your identity information has been stolen from where you gave it permission to be and given or sold to someone who doesn’t have your permission to use it.
Identity Theft or Identity Fraud?
When most of us think about identity theft, we’re actually thinking about identity fraud. The theft part is only where our information is stolen. It becomes identity fraud when your personally identifiable information, Social Security Number, financial information, or anything else is actively being misused. Usernames and passwords are even identity credentials now – it’s how we authenticate ourselves online. Having someone access your online account without permission is identity fraud.
Account takeovers especially are increasing exponentially. Eva has spoken to thousands of people who had their accounts taken over not through hacking or technical cyberattacks, like many people expect. They’re not even using credential stuffing, where they buy one username and password combination and try it on a bunch of different sites, hoping the victim reused passwords. Instead, they’re using social engineering. They convince you to share your credentials through false pretenses. Some of the reasons they give sound very legitimate, and it’s difficult to tell that they are fake.
Using Social Engineering in Identity Fraud
Account takeover spreads like wildfire because of borrowed trust. Once the scammers have access to a few accounts, they can commit identity fraud to use the real account owner’s identity to convince their friends they’re legitimate.
Say you’re friends with Eva on Facebook. One day, Eva sends you a message and says, “Hi! I lost my phone, and I have two-factor authentication set up on my account. Since I can’t use my number anymore, can I send my code to your number to get into my account?” If you’re like most people, you want to help out your friends. So you say, “Sure, Eva! Happy to help!”
There are two problems here. First, that’s not how two-factor authentication actually works. Eva wouldn’t be able to change what phone number the code goes to without successfully logging in first. Second, the code being sent to you is for your account. The scammer likely already has your login credentials somehow, and they just need to convince you to send them that two-factor authentication code. You send the code thinking you’re helping your friend Eva, and now your account is taken over.
Eva hears stories like this all the time. Often casual users don’t realize right away that their account has been taken over because they don’t log in very often. That gives the scammer more time to pretend to be you and scam your friends.
Go to the Source
Eva tells people to go to the source. With any incoming communication – a social media DM, an email, a text, a phone call, or anything that you didn’t initiate – where you’re being asked to provide data, send money, or spend your time doing something, go to the source and verify. If you get an email from your friend, pick up the phone and call them. If you got a call from your boss, walk down the hall and double-check in person. Verifying from the source can help identify if you’re looking at a legitimate request or identity fraud.
Some families have a “keyphrase” they use to verify. It’s something they wouldn’t normally say and that they don’t tell anyone else or put online. That way if Susan calls Mom and asks for money, Mom can ask for the keyphrase. If Susan can’t tell her, Mom knows it’s not actually Susan calling. This can be a great solution for some people. But it’s hard to scale up, so if you have several dozen extended family members, it may not be the best option. Not all solutions work for all groups, and that’s okay. Find the ones that work for you.
An interesting thing with social media is that Eva often hears that they don’t have a way to do this. The person making the request is a social media friend only, and they don’t have another way to contact them. In that case, question why they are asking you. Don’t they have friends and family in real life who can help them? It seems strange that someone you have never meet and don’t know outside of social media is asking you for your information, money, or time. Just say no.
The Challenge of Saying No
No one wants to say “No” to a friend who needs help, especially if it’s a kind of help you’re able to give. It’s even harder to say “Sorry, I can’t do this for you because I can’t verify you are who you say you are,” especially to someone we think of as a friend.
That’s what makes these kinds of identity fraud so unconscionable. Even if we are suspicious, we don’t want to say no to a friend. People have talked for years about how bad actors leverage our “lesser urges” like greed, fear of missing out (FOMO), and urgency. But now they’re also leveraging our altruism and our desire to help friends and family. It’s terrible, but it’s very effective.
Types of Identity Crimes
There are a wide variety of identity fraud, identity theft, and identity-related criminal behavior that can be included in the “identity crimes” umbrella. We commonly talk about financial crimes, like opening new loans and credit cards in someone’s name, and theft of social security numbers. But it goes beyond that, even to some areas we might not think about.
Financial Identity Fraud
Identity fraud is a broad term that covers misuse of identity credentials. Most of what we think of as identity theft is actually identity fraud. It’s not just financial, but the financial aspects are most well-known. A thief can use your identity to open new credit cards and bank accounts, take out bank loans, car loans, mortgages, or payday loans, or misuse any kind of financial instrument in your name.
Account Takeover
This was discussed earlier in this article, but it is a type of identity fraud. A scammer gets access to your account, and depending on what kind of account they took over, they could end up with access to important areas of your life, or the ability to pretend to be you to compromise your loved ones’ accounts. Once they get in, they can even change the username, email address, and password to lock you out entirely.
Data Breaches
Data breaches are actual identity theft. You provided your information to a platform, system, or company. That platform, system, or company was compromised and your data was stolen. It is a crime, and it puts you at extremely high risk for identity fraud of all types.
Government Identity Fraud
In this type of identity fraud, criminals use your information to defraud the government. This includes benefits fraud, where they apply for benefits like unemployment or SNAP in your name, and tax fraud, where they file fake federal or state tax returns and get the tax refund due to you. Any time criminals use your information to scam government systems is government identity fraud.
Medical Identity Theft
In medical identity theft, criminals use your information to obtain medical goods or services. This can include things like prescription drugs and durable medical equipment.
Criminal Identity Theft
In criminal identity theft, someone being arrested provides your information to law enforcement instead of their own. It can result in you having a criminal record for something you never did.
The Struggle to Recover from Identity Fraud
Medical and criminal identity fraud are much less common than other types. Last year, only 4% of the ITRC’s cases were criminal identity theft and only 1% was medical identity theft. However, they are some of the most complicated to resolve and recover from because there aren’t standardized processes in place. In medical cases, it has to be resolved provider by provider and insurance company by insurance company because they don’t interface. In criminal cases, it’s complicated because there are so many law enforcement agencies and jurisdictions to deal with – in the United States alone, for example, there are 17,000 distinct law enforcement agencies.
This makes these cases especially difficult to deal with. In one case, a victim was carjacked in 2018 and had ongoing issues with medical and financial identity fraud. Recently she was arrested for a criminal case. She was released on bond due to having just had a C-section, but now is trying to prove that it wasn’t her. In another case, an immigrant to the United States found out in 1998 that an out-of-state driver’s license had been used for criminal activities in Florida. It has been twenty-five years and he still has not been able to get it resolved. He was unable to get a job in his field because he couldn’t pass the background check process. While his kids were at home, he was a stay-at-home dad while his wife was the breadwinner, but now that they’re grown he feels hopeless.
The Emotional Impact
The ITRC sends surveys to victims about the emotional impact of being a victim of identity fraud. The number of victims who are suicidal is growing. In 2021, it hit double digits – 10% of victims don’t see another way out. Part of it is because they have no support, and part is because they don’t see a path to a resolution. This is especially true of people who used the processes in place and the processes failed. They did everything they were supposed to do, and they still can’t escape the trouble of identity fraud.
I don’t think people understand how traumatizing this can be.
Eva Velasquez
Steps to Minimize Your Risk
If no one ever called us again because identity crimes were solved, I would die a happy woman. This has been my life’s mission. We’re not there yet.
Eva Velasquez
Many people find taking steps to reduce their risk of identity fraud daunting. There are lists out there of fifty different things you have to do, and that seems overwhelming. But Eva reminds people that they don’t have to be done at once. There may be fifty things that you can do, so why not pick one a month and make small changes? Some things are one-and-done actions, others become practices.
The IRTC calls it “identity hygiene” because it’s not just one thing you have to do. It’s a set of practices that you do on a regular basis for a great end result. If you go to your doctor and say, “What’s the one thing I need to do to be healthy?” they’re not going to give you just one thing. Instead, they’ll give you a list of things to do to varying degrees. Some, like getting your vaccines, only have to be done once or on an occasional basis. Others, like eating healthy, need to become habits. And that doesn’t mean every meal has to be perfectly healthy – just try for most.
You can look at identity fraud protection practices like that. There are some that need to be done infrequently, and some that should become habits. You don’t have to be perfect, but just making a consistent effort will go a long way towards protecting yourself from identity fraud. If you’re just getting started, Eva recommends a few places to start.
Good Password Management
We all need to upgrade our password game. It’s one of the identity fraud protection habits we should use every day. Use complex, unique passwords across all your accounts – even throwaway accounts and ones you don’t think are important. A lot of people put strong passwords on their financial accounts and the ones they consider important. That’s a really good start. But those accounts we think are less important can sometimes be used to access our more important accounts. To upgrade your security, use strong passwords across all accounts.
Any vulnerability can be a pathway into those other accounts that you consider more important.
Eva Velasquez
A strong password should be twelve character or longer. It should not have repeating patterns, it should be used on only one account, and it shouldn’t be something easy to guess, like your dog’s name, your kid’s birthday, or your favorite car. We share a lot of stuff on social media, and that information is a lot easier to find than we think. Pick something no one else would know and that you haven’t shared on social media. (And if you don’t want to spend the effort to memorize all these unique passwords, consider a password manager.)
Two-Factor Authentication
The other identity fraud protection habit we should use every day is two-factor authentication (2FA), also called multi-factor authentication (MFA). It’s already mandatory on some platforms, especially financial platforms. Banks did a really good job getting us to buy into it – it’s inconvenient, but we know it makes our accounts more secure and very few of us complain.
We should be using 2FA every time, even when it’s not mandatory. Eva encourages you to enable it anywhere that’s an option. It adds an extra layer of security if your credentials are breached or if you self-compromise. Without that code, a criminal can’t get access even if they have your password.
The important thing to remember here is that you should never share that code with anyone. It says in that text or email you get that you shouldn’t share it – listen to that. Social engineering is good at coming up with really compelling reasons to send the code, and they sound legitimate. But they aren’t. Don’t share it.
There is no legitimate reason to share that [two-factor authentication] code. None.
Eva Velasquez
A Note on Two-Factor Authentication Methods
There are three common methods that a 2FA code can be delivered. One is via an SMS message or email, another is through a dedicated app, or a physical token or key which either displays a code or which you plug into your device to get access. Security experts agree that SMS/email is the least secure way to get these codes, so some say that it’s pointless to do it that way. Eva disagrees. She looks at things in terms of good/better/best. In her opinion, an app is best. But they’re not necessarily intuitive and not for everybody. She hopes that if people hear that’s the best, they may put in the effort to learn.
What she doesn’t want is people thinking, “Well, the app is best, but I don’t get it and I don’t know anyone who can teach me, so I’m not going to do it at all.” 2FA through SMS or email still provides good protection against identity fraud, even if it’s not “the best.” If SMS is the one that you will use, use it – it’s better than nothing. Just be sure that if you’re using SMS or email that your phone or email account is secure. Put a passcode on your phone, and guard your email like you would a financial account, because anyone who has access to those can get access to almost anything.
Guard Your Email
Some people say they don’t care if someone gets into their email account because they’re not talking about anything important. But these people aren’t thinking about the risks of identity fraud. Is your bank account connected to your email? With email access, someone could change your bank password, change the bank account email, and delete the emails about the changes. Now you’re locked out of your bank account and don’t even know how.
In the future, email will probably become even more important than your Social Security Number. Your SSN is a necessary credential, but it’s static data. Email has so many access points and is being used in a variety of different ways. If you have a main account for important stuff and a “throwaway” account, that’s not a bad idea. But safeguard both. People might still know it’s you, and it can be used to perpetrate scams and identity fraud against your loved ones.
Examining an Attempt at Identity Fraud
In one scam, the scammer pretends to be calling from your bank. They know what bank you use, so at first it sounds legitimate. They tell you that someone got into your account and are trying to transfer money out, but they need you to send them the code they just texted you to verify your identity. That code is really the 2FA code for your bank. They got your username and password, and once you send them that to “verify your identity,” they now have access to your bank account.
Then they tell you that they are going to disable outbound transfers. You’ll get a confirmation text, and all you have to do is type “1” to confirm. In reality, they know your bank’s transfer process sends you a text before the money will transfer. By pressing “1,” you have actually authorized the transfer to the scammer’s account. This works because they get you afraid – someone’s in your account and trying to steal your money – and they use that fear to keep you reacting fast and not reading the texts your bank is sending.
If you get a call from someone pretending to be from your bank, you have an ace up your sleeve – you know how to contact your bank! Hang up and call the number on the back of your card, or log in through the bank’s app or website and talk to them there. You will know they’re really your bank because you initiated contact. Then you can confirm if that was really your bank on the phone.
Identity Theft Protection for Ourselves and Others
We need to stay on top of identity theft protection methods to protect ourselves. But we also need to make sure it’s not just ourselves who are protected. We all have family members, elderly and young, who are vulnerable to identity thieves’ tricks because they’re unfamiliar to them. They might see a credit offer that they think will be great, but it’s actually stealing their identity.
You not only want to be educated for your own sake and for your spouse’s sake, you want to be educated for your parents’ sake and you want to be educated for your children’s sake.
Patrick Glennon
Patrick has a 21-year-old child and a 16-year-old child. The older one is brand new to the world of credit, and the younger is about to enter it. He and his wife both have elderly parents. People we love are at risk. We need to be educated not just to protect ourselves, but to help them and provide them with some protection. When the oxygen masks come down on the plane, put on your own first, but once you have it on, help your kids and your parents and anyone else in your sphere that you want to be protected.
Learn more about IDIQ on their website, idiq.com. There, you can get information about their plans and services, enroll in their services, or check out their articles. They provide information about what new tactics are popping up, how to protect yourself, how to recover from identity theft, and what tools are available.
The Challenge of Trust
It’s unfortunate that you can’t trust anyone who initiated contact with you. Eva doesn’t want to be paranoid or fearmongering, but there is good reason to be. We are deluged with scams. With so much identity fraud happening, it’s difficult to know who is real and who is a scammer.
If you tell someone on the other end of the phone that you need to verify they’re legitimate so you’re going to hang up and call directly, a legitimate business won’t start yelling. If the person you’re on the phone with is really from your bank, they will appreciate your commitment to security. They may offer you an extension number or tell you what department to ask for, but they won’t get upset. That’s the kind of reaction you want. If they get upset, try to convince you not to hang up, or start bullying you, that’s a huge warning sign that they’re not who they say they are.
We have to flip the convenience versus security dichotomy on its ear. A lot of customers say they want security. But when they’re presented with a little friction to improve their security, they disengage or leave. Criminals are exploiting our desire for frictionless, convenient actions. Eva encourages people to rethink it. When you encounter some inconvenience verifying your information at your bank, a retailer, or anywhere you are trying to do business, you should thank them. They’re protecting your credentials.
Identity Fraud Services from the ITRC
You can think of the ITRC like AAA. Where AAA helps you out with car-related problems, ITRC helps with identity fraud and other identity issues. Keep them in your back pocket, and reach out when you need them. You can even reach out before you make a decision. Maybe you’re applying for a job and want help verifying it’s not a job scam. Maybe you were told you qualify for a grant or won a sweepstakes and aren’t sure it’s legitimate. The ITRC both helps people who have gone through identity fraud and want support recovering, and operate as a sounding board for people who aren’t sure if they’re looking at a legitimate opportunity or a scam.
The Identity Fraud Recovery Process
It’s hard to make general statements about the process of recovering from identity fraud. If you had only one or two incidents, they were all recent, and they were all financial identity fraud, that can probably be resolved in about a week. But once government, criminal, or medical identity fraud are involved, now we’re talking about months. If you have a persistent thief – someone with lots of data who keeps trying new ways to monetize it – it’s even harder. Even if you froze your credit and locked down your accounts, they’re going to keep trying. It’s almost like the identity fraud goes into remission and then pops back up again. It can be difficult to determine if you’re fully recovered or if the identity fraud is just in remission.
Depending on how early it was caught, what kind of identity fraud it was, how many incidents there were, and how many entities are involved, resolution can take anywhere from a day to a decade. It’s very situation-dependent and wildly inconsistent. You’re never going to know how long it will take until you do discovery and know what you have in front of you.
Support is Available
The good news is, you don’t have to do it alone. There are some great, legitimate resources out there. The FTC has a hotline and resources, and they offer the ability to get an identity theft affidavit that can help with legal processes. The AARP has a Fraud Watch network for seniors. And there’s always the ITRC. There’s no limit to the amount of time, number of calls, or amount of effort the ITRC spends on your case. They can support you every step of the way.
There’s no shame in asking for help. This is really complicated.
Eva Velasquez
Identity fraud recovery is complicated. Eva has been doing it for years and is still learning new things. There’s no shame in asking for help and looking for resources, especially if you’ve never done it before. Reach out for help and have someone show you the path to identity fraud recover.
You can reach the ITRC on their website at idtheftcenter.org, where you can chat with a live advisor during business hours. You can also call them toll free at 888-400-5530. After business hours, you can leave a message and an advisor will reach out to you.