I found out today that I’m a victim of identify theft. Specifically, the bad guys have gotten a hold of my name, SSN, and probably other fun tidbits of my personal information. My best guess is that this is a result of the Equifax breach, not that it matters.
How Did I Notice The Identity Theft?
I am enrolled in a free credit monitoring service that notifies me when things happen on my credit report. (I’m not recommending a particular monitoring service. The one I’m using is tied to a bank where I’m a customer, and it’s good enough.) There were two “hard inquiries” listed within a few days of each other.
There are hard and soft inquiries. As I understand it, a hard inquiry means you’ve applied for credit, and the lending institution is trying to figure out whether or not they’ll extend you the money. If you see a hard inquiry and you’re not applying for credit, that’s a red flag. Soft inquiries are for things like pre-approved credit card offers that you didn’t ask for but receive in the mail anyway.
One of the hard inquiries was from the Small Business Association government agency. The thief was fraudulently applying for an SBA Covid relief loan. The other was for a retail store credit card issued by Capital One.
In both cases, I called the appropriate numbers, and spoke to people who see fraud like this every day. Neither person found the event unusual. They took some information from me, and assured me that the application would be stopped and no account opened.
How Will I Control The Identity Theft Going Forward?
There is no way to reclaim the information that the bad guys have. They’ve got my info. They’ve very possibly got yours. Data breach record dumps aggregated from many incidents are easy to obtain if you know where to look.
Therefore, the issue isn’t how to get my SSN out of the hands of the bad guys. Rather, it’s how to control the situation to prevent lines of credit being opened in my name.
I’ve done two things to try to stem the tide of fraudulent applications.
- Credit freeze. All three credit reporting agencies–Experian, TransUnion, and Equifax–allow you to place a freeze on the credit reporting data they gather. This means that hard inquiries will fail, making it highly unlikely that a lender will approve a loan application. A credit freeze is free and easy to set. The credit freeze is also easy to remove if you legitimately are applying for a credit card, loan, etc.
- Initial fraud flag. All three credit reporting agencies allow you to indicate that you’re a victim of fraud. This “initial fraud” indication is good for a year and easy to do online. I set this at the same time I enabled the credit freeze. This flag indicates that lenders are to take unusual steps to verify the identify of the applicant. There are other, more serious, fraud flags you can set on your account if you choose, but I didn’t feel they were right for me.
Based on this stolen identity experience, I believe I could have saved myself a minor headache by freezing my credit reports ahead of time. I had always meant to, but never got around to it…until today. The bad guys forced my hand.
For More Information
There are plenty of useful articles an internet search will turn up on the topics of credit freezes and initial fraud. That’s why I didn’t belabor the details.
But there was one article I found especially useful on credit freezes by the Federal Trade Commission: Credit Freeze FAQs – ftc.gov.
If topics like identity theft and personal privacy interest you, you might also like one of my favorite podcasts: The Privacy, Security, and OSINT Show – inteltechniques.com.