Identity theft- now what?
April 29, 2010 6:06 AM Subscribe
Someone's been submitting credit card applications with my name and SSN.
Two nights ago, I received a letter from a hardware store's credit card department, informing me that my application for a store card had been denied. Hmm. I never filled out an application. Fishy. Last night, another one showed up from Neiman-Marcus, with the same story. Uh-oh.
I did a bit of digging, and got in touch with the fraud department at the credit agency listed on the first rejection letter. He gave me some very helpful but not specific leads: told me that the request had been made via their website on date X, from an IP that originated in Pennsylvania, with a Massachusetts driver's license number that wasn't mine, a phone number in a 631 area code, my name and social security number, my old address, and some answers to personally identifying questions that were completely wrong. (Wrong maiden name for Mom) He wouldn't give me any more specifics on driver's license # or IP address unless I was law enforcement, so I headed down to the police station to file a report. They now have everything on file, and I'm waiting for a detective to contact me.
I'm in the process of contacting the three major credit agencies to put a freeze on my credit history--they'll waive the fees with a police report, and two of the three have forms for freezing your account through their respective websites. I'm expecting to see more letters from more credit cards in the next few days, and will do some legwork to hand over to the detective when s/he calls in a few days. Since the thief is using my old address, and doesn't have answers to specifically identifying questions, any request he makes is getting bounced by the credit check, and when that bounce happens, it gets mailed to my old address (which gets forwarded to me with a few days of latency). However, that won't help if he starts trying to open accounts with cell phone providers or cable companies or what have you. So, specifically:
Thanks in advance!
Two nights ago, I received a letter from a hardware store's credit card department, informing me that my application for a store card had been denied. Hmm. I never filled out an application. Fishy. Last night, another one showed up from Neiman-Marcus, with the same story. Uh-oh.
I did a bit of digging, and got in touch with the fraud department at the credit agency listed on the first rejection letter. He gave me some very helpful but not specific leads: told me that the request had been made via their website on date X, from an IP that originated in Pennsylvania, with a Massachusetts driver's license number that wasn't mine, a phone number in a 631 area code, my name and social security number, my old address, and some answers to personally identifying questions that were completely wrong. (Wrong maiden name for Mom) He wouldn't give me any more specifics on driver's license # or IP address unless I was law enforcement, so I headed down to the police station to file a report. They now have everything on file, and I'm waiting for a detective to contact me.
I'm in the process of contacting the three major credit agencies to put a freeze on my credit history--they'll waive the fees with a police report, and two of the three have forms for freezing your account through their respective websites. I'm expecting to see more letters from more credit cards in the next few days, and will do some legwork to hand over to the detective when s/he calls in a few days. Since the thief is using my old address, and doesn't have answers to specifically identifying questions, any request he makes is getting bounced by the credit check, and when that bounce happens, it gets mailed to my old address (which gets forwarded to me with a few days of latency). However, that won't help if he starts trying to open accounts with cell phone providers or cable companies or what have you. So, specifically:
- What is the thief hoping to accomplish by filling out applications with my old address? If he were to succeed, wouldn't the cards then be mailed to that address, useless to him? (The old address was a rental in a three-family house just outside of Boston, with a locked mailbox. I don't suspect the new renters, because the fraudulent requests came from hundreds of miles away)
- What should I expect from law enforcement? Is it likely that the detective try to track the offender down with his ISP? If the IP address resolves to a uniquely identifiable address, will they send in storm troopers, or is this one of those low priorities for law enforcement? If they do send in storm troopers and nail the guy, will I have to go to Pennsylvania to testify?
- I suspect the breach is from a mortgage application I made in August of last year. I'm insanely paranoid about identifying information--I shred mail that has anything identifying in it, get into shouting matches with people who ask me for a SSN when they don't need it, and don't send emails with confidential info in them. While applying for a mortgage, I applied with three lenders, two of which were consummate professionals and whose data protection seemed up to my insane standards. The third was wildly incompetent, and I severed the relationship with him after he made this apparent. Unfortunately, by the time I realized this, he already had digital copies of everything I had, including transactional bank records, year-end summaries of every account I have, and copies of a driver's license and social security card. These were given to him encrypted, but I am 100% confident that he immediately decrypted them and did something akin to standing on top of his building shouting account numbers into a megaphone. Is it worth mentioning this to the police, given that I cannot actually prove this?
- What other attack vectors do I need to concern myself with? Will banks and 401(k)'s respond favorably if I inform them of the breach, and of the possibility that someone has literally every identifying piece of information that he could need to access these accounts? The fraud attempts that I know about have been pretty bush-league, so it is possible that the thief is not in possession of everything, but am I better off getting replacement cards, new account #s, etc.?
- My then-fiancée (now wife) also sent all of her identifying information to the same idiot mortgage broker. She is now on the lookout for any similarly suspicious rejection letters, but has not taken any active steps with banks or credit agencies. Do we need to nuke the site from orbit just to be sure?
- The Social Security website makes it sound like you need an act of god for them to issue a new SSN, but I have a police report and proof that my number is actively being used fraudulently. Should I apply for a new number?
- Is there anything I can do to shield myself from accounts opened in my name that don't require a credit check? I'm very confident that anyone who tries to open an account that requires a credit check is in for a surprise, but does instituting a a credit freeze now also have the effect, five years down the line, of giving me legal standing to say "that's definitely not my cable account with the $8000 balance"?
Thanks in advance!
We haven't been through credit cards scams. My husband has recently been through fraudulent check writing scam. They stole checks out of his "man purse" and began writing and passing them to friends, etc. to the tune of $1,000,000+. It was a banking nightmare and he did file a report. Three months later a police station far from where the crime occurred called asking if we would want to press charges. That was 2 months ago. We still haven't heard anything.
Call every bank card you have or have apps for. Inform them of the issue plus copies of the police report. Call their fraud department. Stop everything. Sign up for credit monitoring to ensure your SS# isn't being used for other loans. Call anything you have money or tied your SS# with to inform them to put activitiy on monitoring. It's going to be a pain though. You'll get contacted a lot by them for "can you confirm you did X". Get a new debit/check/bank account number.
Screw the broker that jacked things up. Call his bank, boss, company and report him to their fraud department. They can figure out if he committed a crime or not.
And new renters or not, they may know him and are helping him. Or he's breaking into the box. Could be a post office worker who has a key. One never knows.
I hate that apps for cards come in the mail. I shred them too because people can take them and fill them out in your name.
God people are assholes. Sorry you're going through this. It's going to be a hassle for a while.
posted by stormpooper at 6:23 AM on April 29, 2010
Call every bank card you have or have apps for. Inform them of the issue plus copies of the police report. Call their fraud department. Stop everything. Sign up for credit monitoring to ensure your SS# isn't being used for other loans. Call anything you have money or tied your SS# with to inform them to put activitiy on monitoring. It's going to be a pain though. You'll get contacted a lot by them for "can you confirm you did X". Get a new debit/check/bank account number.
Screw the broker that jacked things up. Call his bank, boss, company and report him to their fraud department. They can figure out if he committed a crime or not.
And new renters or not, they may know him and are helping him. Or he's breaking into the box. Could be a post office worker who has a key. One never knows.
I hate that apps for cards come in the mail. I shred them too because people can take them and fill them out in your name.
God people are assholes. Sorry you're going through this. It's going to be a hassle for a while.
posted by stormpooper at 6:23 AM on April 29, 2010
Best answer: Resident card fraud detection specialist here again! While I can't completely answer all your questions, I can at least give you a bit of information on what I've experienced in my line of work.
1. Most commonly, thieves will fill out applications with previous addresses, get approved, claim they never received the cards, then have the cards sent to some random location where they can safely pick them up. They're using an address associated with you to seem genuine, then will likely change the address as soon as they're approved.
2. I can't speak for all the banks, but our investigators work with law enforcement to find exactly where the request came from, and prosecute accordingly. I don't know how they prioritize this; my hand in the process ends once the investigation starts.
3. This is just me being me, here, but I'd report the jerk to the BBB. If he's being careless with people's identifying information, hell, I'd make sure that others aren't going to make the same mistakes.
4. Absolutely report this to every financial institution you deal with. Identity theft is more than credit card fraud. Place passwords on your accounts that only you would know. Encourage your banks to ask different questions other than mom's maiden name (public record, hello). Check with your issuers to make sure no new cards have been sent out and no changes to your account have been made, then place those passwords right away. Naturally, I can only speak for the bank I work for, but we don't give entire account numbers over the phone, so I don't think you have much to worry about if new items haven't been issued.
5. Yes, nuke it from orbit. Have her place the same warnings on her credit. No sense in not doing so, especially if you believe your info was compromised.
6. Yes, I'd at least ask. The worst they can say is no.
7. I can't verify this 100%, but I would think that with the police report, credit freezes and whatnot, you have a lot of ground to stand on for any "surprises" that may come up. Besides, with cable bills and whatnot, you can pretty easily prove that you don't reside at that address, and likely can also prove that you never made the call/request for service by working with law enforcement.
You've got pretty much everything covered that I can think of; just keep diligent, and check your credit report. Absolutely dispute everything that was attempted in your name. Report them as fraud apps even if they were denied--multiple requests are still hits to your credit.
Also, I tossed up a list of fraud department contacts for various financial institutions in a previous thread like this, so here it is again if you need it.
If you have any questions you don't want to ask out here, feel free to toss me a MeMail.
Good luck.
posted by Verdandi at 6:29 AM on April 29, 2010 [13 favorites]
1. Most commonly, thieves will fill out applications with previous addresses, get approved, claim they never received the cards, then have the cards sent to some random location where they can safely pick them up. They're using an address associated with you to seem genuine, then will likely change the address as soon as they're approved.
2. I can't speak for all the banks, but our investigators work with law enforcement to find exactly where the request came from, and prosecute accordingly. I don't know how they prioritize this; my hand in the process ends once the investigation starts.
3. This is just me being me, here, but I'd report the jerk to the BBB. If he's being careless with people's identifying information, hell, I'd make sure that others aren't going to make the same mistakes.
4. Absolutely report this to every financial institution you deal with. Identity theft is more than credit card fraud. Place passwords on your accounts that only you would know. Encourage your banks to ask different questions other than mom's maiden name (public record, hello). Check with your issuers to make sure no new cards have been sent out and no changes to your account have been made, then place those passwords right away. Naturally, I can only speak for the bank I work for, but we don't give entire account numbers over the phone, so I don't think you have much to worry about if new items haven't been issued.
5. Yes, nuke it from orbit. Have her place the same warnings on her credit. No sense in not doing so, especially if you believe your info was compromised.
6. Yes, I'd at least ask. The worst they can say is no.
7. I can't verify this 100%, but I would think that with the police report, credit freezes and whatnot, you have a lot of ground to stand on for any "surprises" that may come up. Besides, with cable bills and whatnot, you can pretty easily prove that you don't reside at that address, and likely can also prove that you never made the call/request for service by working with law enforcement.
You've got pretty much everything covered that I can think of; just keep diligent, and check your credit report. Absolutely dispute everything that was attempted in your name. Report them as fraud apps even if they were denied--multiple requests are still hits to your credit.
Also, I tossed up a list of fraud department contacts for various financial institutions in a previous thread like this, so here it is again if you need it.
If you have any questions you don't want to ask out here, feel free to toss me a MeMail.
Good luck.
posted by Verdandi at 6:29 AM on April 29, 2010 [13 favorites]
When I was a victim of ID theft (someone used my SS# to get two auto loans and then defaulted) I filed a police report because I needed it to get the effin' bank that issued the loans to finally believe they weren't mine. I was astonished a few weeks later when a police detective called with information about how the fraud had been perpetrated and by whom. Nobody was prosecuted; the party most likely at fault (the car salesman) was gone. But I was amazed the police actually followed up on it for me.
I've been astonished at how easy it was for that first fraud to happen (when I asked a representative of the bank whether it wasn't a red flag for them that the name on the loans didn't match the name on the SS#, I was told that they "just assumed" I must have gotten married and changed my name. Thanks, idiots!)
I've also had fake store credit card scams like yours. One thing the thief can accomplish is to buy merchandise on the spot with one of those "open a card today and get 15% off" deals. They may never get physical possession of the card, or be able to use it again, but in both cases it's happened to me the person charged a bunch of stuff right away when they filled out the application (and the fraud alert on my credit report did me no good because the clerk, possibly an accomplice, didn't actually check my credit record before issuing the card; in fact, I strongly suspect clerk involvement because in both cases I'd formerly had accounts at those stores and no longer did, and I wonder if somehow my information from those old accounts was available to an employee.).
I have never felt at risk in a way that made me feel like I should get new cards for other accounts. But if you feel like possibly your whole mortgage application was stolen/leaked/fell into the wrong hands, it might be worth it for the peace of mind.
For that original problem with the auto loans, I ended up putting together a "fraud affidavit" for the bank (that god-damn bank that kept reassuring the credit agencies that the loans sure were mine!) that included all the information I had plus what the police detective found. I have now probably sent copies of that affidavit off to three or four other entities to get other problems (like my state tax refund being garnished for debt that wasn't mine) resolved. So, yes, I think that any documentation you put together now of this fraud will help resolve that $8000 cable bill a few years down the road.
I have a depressing degree of experience with this now, and will say that it seems to be the gift that keeps on giving: the woman who originally got the auto loans still shows up as one of my names on my credit reports, and I keep writing letters to have it removed. It's like playing Whack-a-Mole. I continue to get collections calls and letters about three times a year for her, usually for debt that was never thought to be mine, but my address and phone number seem to be associated with her in databases. Someday I'll be 90 and drop dead of a heart attack because I just cannot believe I've gotten another phone call trying to collect from that b*tch.
posted by not that girl at 6:53 AM on April 29, 2010
I've been astonished at how easy it was for that first fraud to happen (when I asked a representative of the bank whether it wasn't a red flag for them that the name on the loans didn't match the name on the SS#, I was told that they "just assumed" I must have gotten married and changed my name. Thanks, idiots!)
I've also had fake store credit card scams like yours. One thing the thief can accomplish is to buy merchandise on the spot with one of those "open a card today and get 15% off" deals. They may never get physical possession of the card, or be able to use it again, but in both cases it's happened to me the person charged a bunch of stuff right away when they filled out the application (and the fraud alert on my credit report did me no good because the clerk, possibly an accomplice, didn't actually check my credit record before issuing the card; in fact, I strongly suspect clerk involvement because in both cases I'd formerly had accounts at those stores and no longer did, and I wonder if somehow my information from those old accounts was available to an employee.).
I have never felt at risk in a way that made me feel like I should get new cards for other accounts. But if you feel like possibly your whole mortgage application was stolen/leaked/fell into the wrong hands, it might be worth it for the peace of mind.
For that original problem with the auto loans, I ended up putting together a "fraud affidavit" for the bank (that god-damn bank that kept reassuring the credit agencies that the loans sure were mine!) that included all the information I had plus what the police detective found. I have now probably sent copies of that affidavit off to three or four other entities to get other problems (like my state tax refund being garnished for debt that wasn't mine) resolved. So, yes, I think that any documentation you put together now of this fraud will help resolve that $8000 cable bill a few years down the road.
I have a depressing degree of experience with this now, and will say that it seems to be the gift that keeps on giving: the woman who originally got the auto loans still shows up as one of my names on my credit reports, and I keep writing letters to have it removed. It's like playing Whack-a-Mole. I continue to get collections calls and letters about three times a year for her, usually for debt that was never thought to be mine, but my address and phone number seem to be associated with her in databases. Someday I'll be 90 and drop dead of a heart attack because I just cannot believe I've gotten another phone call trying to collect from that b*tch.
posted by not that girl at 6:53 AM on April 29, 2010
You could check with your homeowner's insurance to see if you have identity theft protection. If you do, call them, they may have a specialist who will assist you.
posted by theora55 at 7:45 AM on April 29, 2010
posted by theora55 at 7:45 AM on April 29, 2010
This thread is closed to new comments.
posted by NoMich at 6:18 AM on April 29, 2010