How I Thwarted I.D. Thieves

Some 41 million Americans have been victims of identity theft, says a recent survey from Bankrate.com, but I (irrationally) always thought I’d be immune. Then, last September, I got the call.

My wife and I were in the Lake District of England, in a well-worn 18th-century hotel not far from the bucolic estate where Words­worth lived and composed his poetry. The caller was a woman from the fraud department of Capital One, asking if I’d applied for a second Capital One credit card. I had not. Capital One turned down the application, she told me in a soothing voice. “But whoever tried to open this account has your Social Security number and date of birth,” she said. The credit application raised a red flag because the imposter listed his (actually, my) address as Springfield, Ill. I live in Washington, D.C., and have for most of my life.

She told me to contact the three major credit bureaus, review my reports and consider putting a fraud alert on my accounts. I already knew the drill, because Kiplinger’s gives the same advice to all victims of ID theft.

Subscribe to Kiplinger’s Personal Finance

Be a smarter, better informed investor.

Save up to 74%

Sign up for Kiplinger’s Free E-Newsletters

Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.

Profit and prosper with the best of expert advice - straight to your e-mail.

Sign up

Maybe I shouldn’t have been surprised. Just before we left on vacation, I had spotted two small deposits to my checking account from PayPal—an indication that someone was trying to connect a PayPal account with my bank account. I had spent precious pre-vacation hours closing my checking account, opening a new one, ordering new checks, and changing direct deposits and automatic payments.

Now, from my hotel in rural England, with sketchy Wi-Fi, I logged on to the TransUnion website and placed an initial fraud alert on my file, which told creditors to verify my identity prior to issuing credit. The site assured me that the other two major credit bureaus, Equifax and Experian, would be notified and would automatically place fraud alerts on my accounts, too. I tried to relax and enjoy the rest of my vacation. I would have to wait until I was back at work to check my credit reports to see if any damage had been done. All the while, I couldn’t shake the discomfiting feeling that someone was stealing my name—and the sterling credit history I had built over several decades.

A tangled web. Ten days later, back at my desk, I went to www.annualcreditreport.com to get my free credit reports and make sure that no one had opened any accounts in my name. Damn. Someone had beaten me to the site, because each credit bureau in turn said that I had already claimed my free report for the year. (I had not.)

As a victim of ID theft, I had the right to free credit reports if I mailed in verification of my identity and my address, plus a police report, but I figured all that would take too long. I decided to pay for my reports. Despite the fraud alerts on my account, Experian and Equifax were more than happy to take my $10 (the cost varies by state). But TransUnion, to its credit, refused to acknowledge me without more verification.

I downloaded and scanned the two reports. Each had the Capital One inquiry, as well as one from Discover, but no fraudulent accounts or new addresses—yet. I called Discover, was connected to the fraud department, and learned that someone had filed an application for a credit card in my name. (This time the address was in Metcalfe, a tiny town in Mississippi.) I was assured that the application would be denied. I had to get creative to get my credit report from TransUnion. One of my Kiplinger colleagues contacted someone in public relations, who put me in touch with a Trans­Union rep, who gave me a link to download my report.

I was beginning to understand the tangled web that ID thieves weave (to paraphrase another Brit, Sir Walter Scott). Scammers like the one who targeted me try to steal your personal information and apply for credit in your name, but at a different address. If that application slips through the cracks and is approved, it gets easier and easier to open more accounts in your name, and soon your credit is a bloody mess.

The credit bureaus seemed more interested in selling stuff than protecting my credit. I was never able to speak to a live human, except for the TransUnion rep I reached through my Kiplinger connections. The websites were an obstacle course of dead ends, confusing information and pitches for products—credit scores at $8 a pop, credit monitoring at $20 a month, the ability to lock and unlock your report for another $20 a month. I wasn’t planning to apply for any loans or new credit cards, so I decided the best way to protect myself was to freeze my accounts.

How it happened. I called Eva Velasquez of the Identity Theft Resource Center to double-check my strategy. The center is a nonprofit organization dedicated to helping victims of ID theft. Call 888-400-5530 and you’ll be able to talk with an adviser, who will send you a remediation plan. You’ll find tons of information online (www.idtheftcenter.org), including an explanation of the options available to ID theft victims and templates for letters you can use to communicate with the credit bureaus.

Data breaches are incredibly common, and fraud rings have flow charts that help them determine when to sell stolen information, says Velasquez. My batch had probably just been sold.

I recalled that in 2015 I had received a notice from Anthem that my personal information may have been breached, but I stuck the letter in a folder and forgot about it. Maybe that was it? Maybe, she says, but “we tell people not to waste emotional energy trying to figure it out.”

I retrieved the letter from Anthem and signed up for the free credit monitoring I’d been offered from a service called AllClear ID. I still had six months of monitoring left. But Anthem had paid for AllClear ID to access only one of the three bureaus, TransUnion. “Free monitoring of one report is like locking one of three doors to the house,” says credit expert John Ulz­heimer. (Free credit monitoring from Credit Karma also checks only Trans­Union.) Services that monitor all three bureaus typically charge $20 a month.

By the end of October, I had managed to freeze my TransUnion and Equifax accounts. Experian said it couldn’t identify me to impose a freeze. To be absolutely sure no one had opened accounts in my name, I needed to recheck my Experian report and freeze it. But after a flurry of fraud-fighting, I had hit a wall of weariness.

Finally, in late April, I called the police and an officer stopped by our house, took notes and filed a report. I sent it, along with copies of my driver’s license and other documents, to Experian, asking for a freeze and a copy of my credit report (at no charge, because I now had proof that I had been a victim of fraud). Within two weeks I got a fat envelope from Experian.

An unsigned letter acknowledged that the freeze was in place, and my credit report was included. Under “Inquiries” was the Capital One listing that had started the whole Kafkaesque experience. And on the list of my addresses, there it was: Springfield, Ill., had become part of my official history. That’s why Experian couldn’t verify my current, real address. I just wish they had told me why. I also sent the police report to Trans­Union asking for an extended fraud alert, which lasts for seven years. Trans­Union shared that request with the other two bureaus, and now all my accounts are frozen and have an extended fraud alert.

I was lucky. No one actually managed to open an account in my name. And now that my accounts are locked down, I can finish cleaning things up and put the nightmare behind me. I hope.

Put your accounts on ice

A freeze prevents new creditors from viewing your credit report or score. The Identity Theft Resource Center says that ID-theft victims should strongly consider placing a credit freeze after they’ve cleared up their credit report—and it’s the best way to prevent ID theft in the first place, even if you don’t suspect any funny business. You can freeze your reports free if you provide a police report showing you were a victim of ID theft. Otherwise, it costs about $10 per bureau, depending on your state. You also have to pay to lift a freeze when you apply for credit.