I was the victim of an identity theft nightmare - and it could happen to you. AMA

which was the single most frustrating bureaucratic entity you had to deal with during all this?

The credit bureaus. They are private businesses, but you can't opt out of participating if you want a bank account in America. They maintain tons of information about you but they don't seem to care at all about protecting that information, or helping you when the information they have is bad.

When I was finalizing reporting on this story in September, I looked through my credit reports with all three bureaus. All three of them still had incorrect information about me, like the thieves' addresses. I filed disputes with all three of them, and each of their sites was broken in some way. As a consumer, it doesn't feel like they're accountable to anyone.

Here's what happened when I tried to dispute that stuff in September:

-I submitted disputes to TransUnion and got an error message about a technical issue where I might not be notified after my dispute was resolved.

-I tried to submit disputes to Experian and got an error message that said identity theft disputes could not be processed online.

-I was able to submit my disputes to Equifax, and received a notice that the disputes had been resolved, but every time I tried to click the PDF with the results, I got an error message.

I decided to check in on those disputes just now. Here's what happened:

-Equifax: worked fine, disputed information is gone (hurray!)

-Experian: The login screen resets every time I enter my info

-TransUnion: it says "view my report" but when I click that I get a blank screen

Again........ these companies track your every financial move, yet seem to have zero interest in maintaining their systems. Awesome. Love this for us, as a society

absolutely wild that the FBI doesn’t track what is obviously a major kind of crime - why doesn’t the federal govt seem to care, and what could be done to incentivize more support there?

So, this story was about twice as long when I first filed it. For space reasons, and also to keep the narrative flowing, we had to cut a lot out.

I had originally written a lot more about my conversation with Shima Baughman, particularly her work on what she calls "the police myth": the belief that the law enforcement exists to control and solve crime. Statistically speaking, they do not. Certainly not for cyber crime, but also not really for traditional crime. Her work on clearance rates showed 97% of people who commit burglary are not held responsible for their crime by police.

I think identity theft and other cyber crimes are newer types of crime, and law enforcement - from the FBI down to local police - are more invested in violent and property crime. In my piece about potential solutions for identity theft, I wrote about how tracking cyber crime like those other types of crime would be a good start.

People need to make more noise about this. A lot of victims of identity theft and other cyber crimes - stalking and harassment, scams, revenge p*rn, etc - are ashamed. They blame themselves. Don't be. Reaching out to your representatives (over email, or even just tagging them on Twitter) and asking why the FBI doesn't track cyber crime is a good place to start.

The FTC does track the and FBI has access to these numbers, when people take the time to report it.

https://www.usa.gov/stop-scams-frauds

They are basically in information-gathering mode, and won't open investigations into individual cases unless they involve other crimes like money laundering.

Right, but that data doesn't go into NIBRS, which is what most police departments, institutions, and journalists refer to for crime reporting and demographics. You can look up violent and property crime rates through the FBI's crime data explorer, but you can't look up cyber crimes.

https://crime-data-explorer.fr.cloud.gov/pages/explorer/crime/crime-trend

What should I be doing now as a parent to help protect my child's identity from ever being stolen?

Great question! If your child is under 16, you can ask the three major credit bureaus to place a freeze on their credit. (It's a lot of paperwork, which the credit bureaus love, apparently.) Make sure any documents with personal information, like their birth certificate and Social Security card, are stored safely in your home. Wipe phones and computers before trashing, selling or donating them.

And be thoughtful about the information you share about your child. Places LOVE asking me what my baby's Social Security number is. Does his pediatrician really need to know that? Does his daycare? I don't think so. I leave that field blank wherever possible.

Say you report an ID theft via police report — as I recently had to — and the police never contact you. Were you ever assigned a detective, and did you find that you needed to badger them to look at your case? It’s been a month for me and I don’t know if the cops will be any help…

Oh, you absolutely have to follow up. I did. Multiple times. I called the station repeatedly and asked for the name of the detective assigned to my case, and I regularly left him voicemails and emailed him. He was not particularly helpful. The only reason I know who stole my identity is because they were caught doing other crimes.

Really, the benefit of reporting identity theft to the police is having that police report as evidence when debt collectors start calling you. It is statistically extremely unlikely that police will do much to help you.

Your bank seemed totally unhelpful. If your identity is stolen, is there a way to get your bank to do something that would help protect you?

Yeah, the banks seem remarkably cavalier about all of this. To them, fraudulent accounts are a cost of doing business. They would rather write off 100 bad charges than possibly prevent one person from becoming their customer.

I think if you use smaller banks and/or credit unions, you are more likely to get good customer service. I have my checking and savings through a smaller bank, and they were great - the thieves were never able to access those accounts, even though they tried repeatedly. But the major banks involved (Bank of America, Wells Fargo and others) were wildly unhelpful.

What is the benefit of freezing your credit? Is there any downside?

The benefit is that no one can open a new line of credit using your identity. The downside is that if you want to do something like apply for a mortgage or a car loan, or get a store credit card somewhere, you have to un-freeze it. But you can download the apps for the credit bureaus and do that in seconds from your phone.

The credit bureaus don't want you to freeze your credit because they make money by making your information available to creditors. You are less valuable to them if your credit is frozen. To me, that is a good thing.

One interesting thing I learned while reporting this: Equifax, Experian and TransUnion are the major players, but there are more than 100 related bureaus that monitor your financial activity, including ones for checking accounts, payday loans, phone lines, utilities, etc. There is no way to completely "freeze" your financial identity with all of them at once. Frustrating!

I didn't know they each had apps! It'll look into that next time I'm expecting to unfreeze my credit.

The benefit is that you can freeze and unfreeze your credit. The downsides are that the apps now take up space on your device, track you, and profit from your data.

You do not need to download the apps to freeze or unfreeze your credit; it just makes it convenient if you think you'd need to do that on the go.

If you are concerned about entities tracking you and profiting from your data, I have very bad news about what the credit bureaus do.

Don't they each charge a fee for freezing and unfreezing an account?

The credit bureaus used to charge for this, but they don't any more. It has to be free. They will try to upsell you on additional products that cost money, which you should say no to.

Do you think the social security number system will go away/change at some point in the future?

Yes, but only at the point that the entire system is worthless. Eventually, you'll probably be able to google Social Security numbers just like you can search for people's phone numbers and home addresses right now. If you think your SSN doesn't exist somewhere on the dark web (and, increasingly, with "light web" data brokers), you are wrong.

So yes, at some point, we will need to move beyond static data like SSNs and the tiny photo on your driver's license. I think we'll see more financial and government institutions adding the option for things like Face ID or fingerprints for identification. That tech isn't perfect either, but it's a lot better than a 9-digit number.

With the amount of places you have to enter your full SS# and the amount of people it passes through basically everyone is compromised. Once it’s out there there’s nothing you can so about it but hope you aren’t randomly selected by a thief. Not like you can request a new one.

Yup. Agreed on all counts.

Not like you can request a new one.

Are you certain about that? It's literally one of the reasons you can get a new number.

https://faq.ssa.gov/en-us/Topic/article/KA-02220

The bar is very, very high to get assigned a new Social Security number. Knowing yours is compromised from a data breach is not enough. Even being a victim of identity theft is not enough, unless you continue to experience issues after taking a number of steps to fight it.

With so many transactions being done online, how would Face ID or fingerprints even work?

Well, you don't show your driver's license for online transactions, either. It's more about adding layers of identification for opening new accounts. For instance, when I was getting FMLA benefits earlier this year when I had a baby, I had to take a face scan video and send it in.

But, online transactions could be more secure. More cards could add two-factor authentication for online purchases. It's just a balance between convenience and protection, and right now most institutions lean toward convenience.

A face or fingerprint are also static and can never be changed, ever - remember digitally they are still data being sent over whatever protocol. We also have "AI"s that can regenerate your face, in different poses and animated, and they are getting better constantly. That's worse than SSN.

I disagree that facial identification is less secure than a string of nine digits, but I agree that we don't have a perfect method yet.

Identity theft is not a joke Jim! Millions of families suffer every year!

What's your favorite movie/tv quote?

Dwight is absolutely correct!!! (Fun fact: Rainn Wilson and I went to the same high school. Not at the same time.)

My favorite TV/movie quote - or at least the one I repeat the most often - is from The Simpsons movie, when Bart says, "this is the worst day of my life" and Homer says, "the worst day of your life so far."

In your opinion, if my wallet goes missing like yours, what is the absolute first step I should make ASAP?

Freeze your credit! I was really surprised at how easy it was to do that. It took me 15 minutes to set up accounts and freeze my credit with all three bureaus.

And, if possible, report your stolen wallet to the police. They probably aren't going to do anything about it, but having that report was vital when I was dealing with debt collectors and investigators. I basically had to mount a court case in defense of my innocence over and over again. The police report about the stolen wallet showed how it all had started.

Did you ever get the free facial?

No!!!!! I really am still sad about that.

How did you first realise and is there anything you could have done, in hindsight, to have stopped it happening?

My wallet was stolen in late November. I first realized something was going on in mid-January, when I got a bunch of mail congratulating me on my new checking and savings accounts with Bank of America and Wells Fargo, and getting alerts from my free credit monitoring that there were new inquiries on my report.

In retrospect, I should have frozen my credit when my wallet was stolen. Really, I should have left it frozen all the time (and so should you, and everyone else reading this). But I had no idea what people could do with a wallet that only had my driver's license, a couple credit cards and some gift cards and a couple bucks in cash in it. I didn't realize how vulnerable I was, and that even though I'm financially conscientious and tech-savvy, anyone can be a victim with the way our systems exist now.

If I had frozen my credit before the thieves got their hands on my wallet, they probably would have had trouble opening those checking accounts. Because I used free credit monitoring and acted quickly once I realized what was going on, they weren't able to take out any credit cards in my name (though they sure tried! a lot!). They still would have been able to use my driver’s license to steal the car and various other crimes, because California does not flag licenses that have been reported stolen to banks or law enforcement. There was no single thing I personally could have done to stop everything they did.

*edit - typo

Am I correct to assume you put fraud alerts on all your credit reports?

Yes, I placed initial fraud alerts on all three back in 2019. Those last a year.

One thing I didn't mention in my original stories: Identity theft insurance. I got tons of emails and tweets asking me about it and whether I'd left it out intentionally. Honestly, I had never used LifeLock or anything like that, and I wasn't really sure what they did. So I decided to look into it.

I published a story today about whether ID theft protection is worth it. The tl;dr version: For me, yes. For you? Maybe.

Did you get a second SSN and CA DL#?

When I had my ID stolen in the 90s, that was the response from federal and state entities.

I debated it, but ultimately decided against it for both. I was so overwhelmed with this stuff in early 2019 - I just couldn't add any more bureaucratic paperwork to my plate. I was (and am!) furious at how much work I was expected to do to clean up after someone else's mess, and going in person to appointments with the Social Security office and the DMV sounded like a new circle of Hell.

The bar is very, very high to get a new SSN. Even as a victim of identity theft, I'm not sure I would quality. Leaving my credit permanently frozen and locking down my identity in other ways is sufficient for me, for now.

Hey, I heard you on what the hack podcast. Nice job documenting everything and fighting for your rights.

What was the most stubborn company to set you right, and why? Did it finally ended?

For the folks here, it's worth listening: https://adamlevin.com/2022/11/28/jessica-roy-was-that-close-to-stopping-her-identity-thief/

Thanks for sharing that! I had a great time on that podcast.

The most stubborn company was probably the bail bond people. They really, really wanted me to come in person with printouts of all my reports before they'd believe I didn't write that bad check. I was determined not to lose any more time or money than I had to in order to fight this, so I refused to do that on principle.

Eventually, they sent a lawyer after me - I can't remember if it was their lawyer or a debt collection agency's lawyer - and I was able to work it out with them over email.

You said in another comment response that you had to leave a bunch of stuff out of your article for space reasons. Have you considered posting a much longer story with all the details someplace or writing a book about how to avoid or minimize your risk of identity theft and what to do if it happens?

Yes I have!