Identity theft is on the rise according to statistics by the Federal Trade Commission, and trends show it will continue to be a serious issue around the globe. A 2018 survey by The Harris Poll determined that up to 60 million Americans have been affected by identity theft, up from 15 million in 2017. It can be costly, time-consuming, and emotionally distressing to resolve issues should you become a victim. While it isn’t possible to completely eliminate the possibility of having your personal information compromised and your identity stolen, there are many things you can do to help prevent this from happening, or, at the very least, make it difficult enough that you become a less-attractive target. Many of these options are low-to-no-cost. We’ve published topics related to identity theft and online account protection on TWC’s Blog before, but this article seeks to combine a variety of useful information into one comprehensive overview of identity theft and the steps you can take now to help prevent it. Many thanks to fellow NAPFA advisor, Kaleb Paddock, CFP® with Ten Talents Financial Planning, who contributed much to this piece and whose suggestions both aligned with TWC’s existing efforts to help clients protect themselves and presented considerations we had not previously included.
Let’s start with what identity theft is. According to the U.S. government’s identity theft website, “Identity (ID) theft happens when someone steals your personal information to commit fraud. The identity thief may use your information to apply for credit, file taxes, or get medical services. These acts can damage your credit status and cost you time and money to restore your good name.” This can be far worse than having your credit card compromised or financial loss from fraudulent account withdrawals. Identity theft can have far-reaching consequences if the thief uses your information for the purposes of filing tax returns, filing for social security, obtaining medical services and reimbursements, applying for loans or other accounts with your personal information.
Don’t despair! There are steps you can take to make it less likely that identity theft will happen to you. Let’s take a closer look.
Safeguard Your Passwords
- Use a password manager to store your account credentials. There are several secure options, some of them free, such as LastPass’ base consumer plan. Do some research and find one with features that fit your needs. SafetyDectives.com recently published a blog post comparing various free password managers.
- Be sure the master password for your password manager account is long, strong, and unique. The current recommendation is to create a “passphrase” of at least 20-30 characters. The combination of words can make sense to you and be easy to remember. It’s the length that matters here.
- Use two-factor authentication on your password manager, ideally by means of an “authenticator app.” More on that below.
- Many password managers have a feature that allows you to check to see if your email is associated with any known account breaches. You can also visit https://haveibeenpwned.com. If any of your accounts are identified, change those passwords immediately. Password managers often have features that analyze the credentials stored in them to identify duplicate and weak passwords.
Protect Your Online Accounts
- Set unique passwords for all of your accounts with a minimum of 10 characters.
- Turn on two-factor authentication for your financial, email, and social media accounts, at a minimum.
- The most secure two-factor authentication employs the use of an “authenticator app” that you download to your smartphone. The app generates a one-time, quickly-expiring passcode to use when logging into your two-factor enabled accounts. Check with your online service providers to see if this option is available. You can also browse Two Factor Auth for a list of websites and whether or not they support two-factor authentication. Is this level of two-factor necessary on all accounts? Maybe not, but you should definitely consider it for your password manager, financial, email, and social media accounts.
- Create your free Social Security account. Why? Because by establishing your personal my Social Security account (which has mandatory multi-factor authentication), you prevent an identity thief from doing so. Plus, there are several great features such as requesting a replacement card, setting up/changing direct deposit, and address changes for beneficiaries.
Be Mindful of Phishing Scams
- These scams usually come in the form of an email or text crafted to get you to click a link or open an attachment. They may claim there’s a problem with your account or that you need to confirm some information. Or it may be a fake invoice or attached voicemail message. Even the innocuous coupon offer, or customer survey, could actually be a means of installing malware on your device.
- Never open attachments that you aren’t expecting to receive, even from a trusted source (they may have fallen victim to a breach or malware). Verbally confirm with the party that they sent it.
- Do not click links, even in legitimate-looking emails, especially those claiming to have noticed suspicious activity or log-in attempts or that ask you to confirm payment or personal information. Go directly to your account and log in. If there is some action required on your part, you will be promoted or notified there.
- Learn how to recognize, protect, and report phishing attacks by visiting the Federal Trade Commission’s Consumer Information website.
Freeze Your Credit Report
- A credit or security freeze is a free means of restricting access to your credit report. Why is this helpful? It makes it more difficult for an identity thief to open new accounts in your name.
- There are four, independent credit bureaus: Equifax, Experian, Transunion, and (lesser known) Innovis. You must place a freeze with each entity separately.
- A freeze does not prevent you from obtaining your free, annual credit report, nor does it affect your credit score.
- A freeze will NOT prevent an identity thief from making changes to any existing accounts they may have gained access to. Continue to monitor all financial, credit card, and insurance statements.
- Keep in mind that you must lift the freeze in the event you want to open new accounts or apply for loans. The good news is that the lift must occur within one hour of you contacting the bureau(s) by phone or following their online process.
- A less rigid option is to place a fraud alert instead of a freeze. A fraud alert protects your credit from unverified access for one year. You must remember to renew the alert each year and it still allows access to your credit report, provided they take the steps to verify your identity. This is not a good option for victims of identity theft, but may be an alternative if your circumstances require the frequent opening of new accounts or loans and would make lifting and lowering a security freeze burdensome. Certainly consider a fraud alert if your wallet, social security card, or financial, personal or other account information have been stolen or lost.
- Parents should consider placing a security freeze for all minor children. Sadly, identity thieves can use your child’s social security number to apply for government benefits, file fraudulent tax returns, or open accounts. If this occurs, it can be years before the fraud is discovered, making the damage repair even more laborious. Placing a security freeze on a minor’s account is best accomplished by calling each of the four credit bureaus, as you may be required to provide additional information such as their birth or adoption certificate and your own identifying information.
- The National Consumer Telecom & Utilities Exchange (NCTUE) is another consumer credit reporting agency. If you have ever held a utility, television, or telecommunications account, your consumer information is accessible in a database to NCTUE member companies. You can request a copy of your data report and place a fraud alert or security freeze with NCTUE just as you can with the four main credit bureaus.
Additional Considerations
- Visit optoutprescreen.com to opt out of receiving prescreened/preapproved offers for credit or insurance. Under the Fair Credit Reporting Act, the credit reporting companies are permitted to include your information on lists used by creditors or insurers to make these offers. Placing a security freeze does not opt you out of these offers. Whether or not you choose to opt out, you should shred any offers you receive.
- Shred financial and other sensitive documents before discarding.
- Safeguard yourself from mail fraud by requesting electronic statements.
- Sign up for USPS Informed Delivery, which allows you to digitally preview letter-sized mail and manage their packages.
- Monitor all financial statements and set up alert notifications on your accounts.
- Steer clear of public Wi-Fi and be sure the network you connect to is legitimate and secure. When in doubt, use your cellular service or your personal hotspot from your mobile phone or other cellular device.
- Be on the look-out for unsecure websites when entering payment or personal information into a website. Secure websites will begin with HTTPS. Unsecure websites lack the “s” in that phrase at the beginning of the URL.
What About Credit Monitoring?
You may be wondering when this article is going to mention identity theft protection services. These services aren’t really the focus here. True, there are many reputable monitoring services that provide (for a fee depending on the services and features you want) credit and/or identity monitoring, alerts, dark web surveillance, and other features designed to make monitoring your information less time-consuming in the quest to help limit your exposure to identity theft. Some of these services also offer identity theft insurance and help to connect you with fraud resolution resources if you do become a victim of identity theft. These services can provide peace-of-mind, but many components are already available to consumers for free. If your financial situation is complex or you feel overwhelmed by the responsibility of monitoring your accounts, you may decide that you’d like to add an extra layer of identity theft protection via a paid service. Be sure to research what you are getting. Keep in mind that credit monitoring and identity monitoring are different, with the former only warning you about activity that shows up on your credit report. Educate yourself to the types of information identity theft services may not be able to monitor for, such as tax or government benefit fraud and social security fraud. There are many services out there; you may wish to start your research by reading U.S. News’ guide to the Best Identity Theft Protection Services of 2020. Identity Theft Protection Services shall remain a topic for another blog post!