A massive database containing over 2.7 billion records has reportedly ended up on a criminal forum. These records belong to individuals in the U.S. and were allegedly stolen from National Public Data (NPD). While the accuracy of the leaked data could not be verified, the hackers reportedly obtained sensitive information such as names, mailing addresses and Social Security numbers. The scale of this breach is so vast that if you live in the U.S., it's likely that some of your data is included.

What you need to know:
Bleeping Computer reported that the database was posted on the criminal forum Breachforums, where threat actors often post such leaks. What’s interesting is that the stolen database was up for free download. The user who posted it credited a hacker named "SXUL," saying, "There’s a new player in town." Usually, hackers sell leaked databases like this one for huge sums.

NPD is facing consequences:
NPD, owned by Jerico Pictures, is facing multiple lawsuits for not protecting people’s data. One lawsuit, filed by California resident Christopher Hofmann, says NPD was negligent and breached its fiduciary duties and a third-party contract. The plaintiff wants the court to order NPD to delete all the personal info it has collected and start encrypting data from now on. They’re also asking for more than just money, like having NPD set up data segmentation, run regular database scans, put in place a threat-management program and get a third party to check its cybersecurity every year for the next 10 years. We reached out to NPD for a comment but did not hear back before our deadline.

Webmaster here – I know it isn’t ID Theft, but it is the Theft of one of your major assets.

They appear like ghosts in the night, standing outside your house, one holding up an antenna while the other crouches next to the car parked on the driveway. Within seconds, your car is gone, yet another victim amid a surge in auto theft enabled by the technology designed to make it easier to unlock and start vehicles.

Auto technology has evolved and many newer cars use wireless key fobs and push-button starters instead of traditional metal keys. The fob sends a short-range signal, so when the driver approaches the car, it automatically unlocks the door. This saves you the hassle of digging out your keys when you've got your hands full with groceries.

But that technology also makes things easier for thieves. The wireless fob will continue to emit a signal even if you're not using it. Thieves prowl neighborhoods at night looking for cars parked outside so they can carry out so-called relay attacks. Using portable equipment that can pick up the faint signal from a fob inside the house or parking lot, they relay it back to a transmitter that can clone the signal.

Officials have urged carmakers to reduce the security vulnerabilities and warn owners about the risks.

So what can you do to reduce the odds that your car will be gone in 60 seconds? "It’s relatively easy for drivers to protect themselves," said Steve Launchbury, principal engineer of automotive security at Thatcham Research, a U.K.-based automotive risk intelligence company. Here are some tips:

USE A SIGNAL BLOCKER

A simple but effective way to stop auto bandits from purloining your key fob signal is to use a Faraday bag or pouch. They're lined with a conductive metal mesh that blocks the transmission of electromagnetic signals.

The pouches aren't expensive, and you can also get boxes that do the same thing. But experts advise testing to make sure they work. Just put the key fob inside and approach your car. If the doors don't automatically unlock, then the signal is being blocked.

It's also important to remember to use it whenever you leave your vehicle, and don't forget to put all of your key fobs inside, including any spares.

But ignore some advice making the rounds on the internet telling you to put your fob in the microwave or freezer. It doesn't have the same effect as a Faraday bag, and you risk damaging your key.

GET AN OLD-FASHIONED LOCK

Try an old-school solution by using a physical lock. Some police forces advise car owners to use them to make your vehicle look less tempting to steal. The reasoning is that a would-be thief might be deterred by the effort needed to cut through the lock and instead turn their attention to an easier target.

Locks, in the shape of a disk or a long bar, clamp onto the steering wheel and make it difficult to steer. There are also versions that prevent the car from being put in gear. The downside is you'll need extra time to attach or remove it whenever you aren't driving.

CHANGE UP YOUR SETTINGS

For many cars, it's possible to deactivate the wireless setting so that you can't open the door remotely. For Fords, Hondas and Audis, use the touchscreen menus. If you own a Toyota, you can temporarily disable the signal by holding down the fob's lock button and at the same time pressing the unlock button twice. If you've done it correctly, the fob's indicator light should blink four times. Be aware that the next time you press any button, remote unlocking will be reactivated.

The method will vary depending on make and model so consult your owner’s manual for the exact process. If it sounds complicated, there are YouTube videos that walk you through it. Don't forget that in most cases you’ll now have to manually press the fob's unlock button.

Automakers have started adding motion sensors to key fobs. If the sensor doesn't detect recent movement because it's been, say, left on the kitchen counter after you come home, the fob goes into sleep mode and stops transmitting. If it lacks this capability, check with your dealer whether it's possible to upgrade it.

If you buy a used car, some experts also advise getting the keys reprogrammed, just in case the previous owner kept one of the fobs.

WATCH OUT FOR NEW METHODS

Researchers have uncovered a new auto theft technique that doesn't target radio signals. The controller area network, or CAN, is "a feature of modern cars which allows different components and systems to communicate, (and) has recently been targeted and exploited by thieves," said Thatcham's Launchbury.

The network allows sensors and control modules to talk to each other directly, instead of going through a central node. Thieves take advantage by accessing the network from the car’s exterior, usually by removing a headlight and connecting a device that can "inject" a signal, tricking the car into unlocking and starting.

While automakers work on improving CAN security, "there are steps drivers can take today to add layers of security and deter criminals," such as using a physical lock, Launchbury said.

Aftermarket electronic immobilizer systems "should render a criminal’s theft tool useless," and might even get you a discount on auto insurance, he said. Thatcham and other companies offer them but the downside is they can be quite pricey.

Every year, enterprising thieves find new ways to separate people from their money. In many cases in the United States, this involves several methods of check fraud, which occurs when thieves use a personal or business check to steal money, services, or goods. The Boston Fed reports that the United States Federal Reserve System collected a total of 19 billion in 1993. By 2022, the number of checks collected had declined to approximately 3.4 billion.

This smaller, yet still significant number leaves many opportunities for thieves, who steal mail from residential and United States Postal Service blue mailboxes. They sort through stolen mail, searching for personal and business checks, as well as bank account and routing numbers. The USPS reported 38,500 mail thefts in 2022, and 25,000 in the first half of 2023. Despite the use of checks becoming less common, due largely to the ease of online banking, the incidence of check-related crimes continues to increase. According to a report issued in 2023 by the Federal Reserve Bank of Boston, the number of checks collected on an annual basis over the past 30 years by the Federal Reserve declined by 82 percent. There were approximately 680,000 reports of check fraud in 2021, double the amount reported in 2020. A 2024 NASDAQ report indicated just over $21 billion in check fraud.

The term “check fraud” covers a lot of territory, but the one factor all variations have in common is that an innocent person loses money or goods.

One example is called paperhanging, in which a person writes a check from an account they opened, knowing there are insufficient funds on deposit to cover the amount. Other frauds include check washing, forgery, the use of counterfeit checks, and overpayment.

In check washing, thieves remove the ink from the check, often by applying acetone, then write in a new date, amount, and payee information.

Forgery involves intercepting and stealing new checks from mailboxes or collection boxes when they are being mailed to the account holders, then forging the signature to use them to drain bank accounts.

According to RelyCo.com, a business check printer, more than 500 million checks are forged each year in the United States alone. Due to the sheer volume of incidents, only 25 percent of the cases are prosecuted.

“Residential mailboxes are fertile grounds for scammers,” Zulfikar Ramzan, Chief Scientist and EVP of Product and Development at Aura, a digital safety platform that protects people against scams, told The Epoch Times. “Do not leave your mail unattended; send checks via a post office collection box when at work, or hand them directly to your carrier.”

He advised, “Whenever possible, eliminate the use of paper checks altogether.”

Writing Checks: Precautions to Take

Mr. Ramzan offered a clever yet simple tip to help avoid falling victim to stolen checks, “Use indelible black gel ink pens. The Better Business Bureau (BBB) urges consumers to sign their checks with long-lasting (indelible) black gel ink. This ink is particularly tough to scrub off, making it nearly impossible for scammers to erase the original contents of the check.”

Michael Scheumack, chief innovation officer at IdentityIQ, a private firm providing identity protection for consumers, suggested restricting the check. That way, it can only be deposited in the bank account of the intended recipient. “To do this, you should write ‘For deposit only’ on the back of the check where the signature goes.”

Additionally, “You should never include additional personal details, such as your date of birth, driver’s license number, or Social Security number, on the check,” Mr. Scheumack said.

Monitor your checking account. “Use your online banking features. Be on the lookout for any discrepancies in amounts paid out, or any overdraft notices, reconciling the records every 30 days,” Mr. Ramzan said.

He further advised consumers, “Always shred sensitive documents such as unused or canceled checks, pre-approved credit notices, and bank statements before discarding them.” “Scammers can steal these out of the trash and ‘wash’ them,” he explained. “Make a point to examine your check supply regularly, and report any missing checks to your bank. And never write checks payable to ‘cash’ or ‘bearer’ since anyone can take that money.”

As a final word of caution, Mr. Ramzan advised using a bank that provides checks with at least one of the following features:

• A mixture of visible and invisible fibers that can be seen under close examination or by exposure to UV light.

• A 3D, reflective holostripe made of metal that makes counterfeiting almost impossible.

• High-resolution microprinting as a font around the border of the check, which is difficult for scammers to replicate.

• Watermarks that are only visible at certain angles, and can’t easily be copied.

• Chemical voids that produce the word VOID if photocopied or exposed to “washing” chemicals.

While high-tech thieves can overcome many anti-counterfeiting measures, the idea is to make it as difficult as possible.

Counterfeit Scams: When It’s Too Good to Be True

The common factor in most “too good to be true” scams is how they use the lure of “easy money” to deceive victims. Thieves with access to advanced graphics programs and printing equipment can create very authentic-looking counterfeit checks. In one instance, scammers convince unwitting victims to cash or deposit the counterfeit checks. Then they ask the victim to refund some portion of the amount very quickly, or forward it to another person in the form of cash, a prepaid debit card, a personal check, a bank electronic wire transfer, or a person-to-person transaction like Zelle. When the victim becomes aware of the fraud, they can never reclaim the funds they sent.

Here are some examples of scams:
•    You were hired as a mystery shopper after responding to an online ad, and were sent a check as initial payment before doing any work, with instructions to deposit it and send a portion to another mystery shopper. This is a scam designed to steal the amount forwarded.

Research any companies offering employment as a mystery shopper. Look up the company’s contact info yourself. Don’t use any information provided in the email, letter, or call. If the offer came via email, check the postmark against the city listed on the letterhead or email signatures and email addresses.

These prize money scams rely on the victims sending the money before the bank discovers the check is fake. In addition to being defrauded of the money they sent to the scammer, the person depositing the counterfeit check can be held liable by the bank for the full amount.

“Do not accept overpayments,” said Mr. Ramzan. “Receiving a check in the mail for an item more than your asking price usually turns out to be some form of bank scam.”

“Do not deposit these checks, or checks from unknown senders, or checks associated with out-of-town banks.” He also advised closely scrutinizing the check date, sender name, and financial institution for errors or dubious characteristics.

Has any of your mail gone missing this year?

An unfortunate nationwide trend could be to blame, impacting your holiday season gifts and checks. Reports across the country this year tell of thieves stealing mailbox keys, then grabbing checks out of blue mailboxes.

It happened recently to Dorothy Glass, who had a check go missing over the summer.
"We put some in the blue box one time, and it got taken," she said.

David Maimon, a criminal justice professor at Georgia State University, says the problem is getting worse, not better.

His team monitors the number of checks being sold by criminals online, who "wash" the ink off them, then offer the blank checks to the highest bidder. It started with about 115 checks per week in October 2020. A year later, he said, he found 300 checks per week offered for sale.

But now it's a crisis, with many more stolen checks up for sale to thieves.
"Nowadays, we're talking about almost 3,000 checks every week," Maimon said.

In most cases, he said, they were stolen from USPS mailboxes by thieves with a key.

Ways to protect your mail

People are telling us they've gotten emails warning that their sensitive personal information is being sold in the shadowy marketplaces of the dark web. Some emails list the stolen information, like all or part of the person's Social Security number, date of birth, and driver's license number. If you've gotten one of these emails, take steps to help protect yourself against financial loss from identity theft.

Credit freezes and fraud alerts can help. Both are free and make it harder for identity thieves to open new accounts in your name. One may be right for you.

Have you seen:
An unfamiliar account on your credit report?
An unfamiliar transaction on your bank statement?
Did the IRS say you already filed a tax return?

Taking steps to protect your personal information can help you minimize the risks of identity theft. But what if a thief gets your information anyway? Here are some of the ways thieves might use your stolen information and signs you can look out for.

It’s the second day of Identity Theft Awareness Week and today we’re talking about steps that can help reduce your risk of identity theft.

Many of us access our online accounts — credit cards, investments, insurance, or checking and savings accounts — nearly every day. In our digital world, bits of our personal information are everywhere. Identity thieves know this and look for ways — both high-tech, like lifting our passwords, or low-tech, like stealing our mail — to get their hands on our money and personal information.

Since identity theft can happen to anyone, here are some ways to keep your money and personal information safe.

The things we do throughout the course of our day give businesses access to information about our habits, tastes, and activities. Some might use it to deliver targeted ads to you, or to give you content based on your location, like stores nearby or the weather forecast. Others might sell or share that information.

Some of you are celebrating your second COVID-19 vaccination with the giddy enthusiasm that’s usually reserved for weddings, new babies, and other life events. You’re posting a photo of your vaccination card on social media. Please — don’t do that! You could be inviting identity theft.

Your vaccination card has information on it including your full name, date of birth, where you got your vaccine, and the dates you got it. When you post it to Facebook, Instagram, or to some other social media platform, you may be handing valuable information over to someone who could use it for identity theft.

Think of it this way — identity theft works like a puzzle, made up of pieces of personal information. You don’t want to give identity thieves the pieces they need to finish the picture. One of those pieces is your date of birth. For example, just by knowing your date and place of birth, scammers sometimes can guess most of the digits of your Social Security number. Once identity thieves have the pieces they need, they can use the information to open new accounts in your name, claim your tax refund for themselves, and engage in other identity theft.

Want to share the news about your vaccination? How about a photo of a nifty adhesive bandage on the injection site? (You can show off your tattoos and deltoids at the same time.) Or, post a photo of your white or orange vaccine sticker. The stickers are really cool.

7 FTC Consumer Information Short Articles

Equifax data breach: Pick free credit monitoring! - Just last week, the FTC and others reached a settlement with Equifax about its September 2017 data breach that exposed personal information of 147 million people. We’ve told you to go to ftc.gov/Equifax, where you can find out if your information was exposed and learn how to file a claim with the company in charge of the claims process. The public response to the settlement has been overwhelming, and we’re delighted that millions of people have visited ftc.gov/Equifax and gone on to the settlement website’s claims form.

But there’s a downside to this unexpected number of claims. First, though, the good: all 147 million people can ask for and get free credit monitoring. There’s also the option for people who certify that they already have credit monitoring to claim up to $125 instead. But the pot of money that pays for that part of the settlement is $31 million. A large number of claims for cash instead of credit monitoring means only one thing: each person who takes the money option will wind up only getting a small amount of money. Nowhere near the $125 they could have gotten if there hadn’t been such an enormous number of claims filed.

So, if you haven’t submitted your claim yet, think about opting for the free credit monitoring instead. Frankly, the free credit monitoring is worth a lot more – the market value would be hundreds of dollars a year. And this monitoring service is probably stronger and more helpful than any you may have already, because it monitors your credit report at all three nationwide credit reporting agencies, and it comes with up to $1 million in identity theft insurance and individualized identity restoration services.

For those who have already submitted claims for this cash payment, look for an email from the settlement administrator. They’ll be asking you for the name of the credit monitoring service you already have. Or, if you want to change your mind, you’ll have a chance to switch to the free credit monitoring. The email from the settlement administrator will tell you what to do next, in either case. And the settlement administrator has said that the claims website will soon be updated with that information, too.

Please also note that there is still money available under the settlement to reimburse people for what they paid out of their pocket to recover from the breach. Say you had to pay for your own credit freezes after the breach, or you hired someone to help you deal with identity theft. The settlement has a larger pool of money for just those people. If you’re one of them, use your documents to submit your claim.

You don’t need to pay a company to protect you from criminals who put their names on your home title. You can protect yourself for free with these steps.

In 2008, the FBI identified “house stealing” as the “latest scam on the block.” Since then, it has popped up periodically in cities such as Chicago, Dallas, Detroit, Los Angeles, New York City and Philadelphia. Is it a growing problem? That’s hard to know because the FBI doesn’t break it out separately in its crime statistics. The American Land Title Association doesn’t have data on the problem, either. “I suspect that companies that offer title-monitoring service use that [the claim] as a marketing strategy,” says Jeremy Yohe, vice president of communications at the association.

The scheme works like this: Fraudsters pick out a house—often a second home, rental, vacation home or vacant house—to “steal.” Using personal information gleaned from the internet or elsewhere, they assume your identity or claim to represent you. Armed with forged signatures and fake IDs, they file paperwork with the county’s register of deeds to transfer ownership of your property to themselves or a third party. They then sell the home or borrow against it, stealing your equity. When they fail to make payments on a loan secured by your property, you could end up in foreclosure or be unable to sell, refinance or pass the home on to heirs.

Home Title Lock is one of the services that says it will monitor your home’s deed 24/7 to prevent title fraud; it costs $15 a month ($150 annually, two years for $298). But you can protect yourself—for free—by periodically checking your property record on the website of your county’s register of deeds. Look for deeds that you or your attorney didn’t prepare or sign, or loans you didn’t take out, as well as liens of contractors, subcontractors, real estate brokers or attorneys whose services you didn’t hire, or court filings, says the Cook County (Chicago) recorder of deeds.

Even better, many counties now provide a consumer notification service. Register for free, and you’ll quickly receive an e-mail or text any time a document is recorded on your property.

The New York City department of finance advises homeowners to make sure the appropriate authorities have the correct mailing address for you or the person who should receive notices about your property. In your absence from your home, have mail forwarded or ask someone you trust to pick up mail or visit your home. Visit a vacant house periodically to ensure that no one has taken up residence illegally.

You may get clues when title fraud occurs: You stop receiving your water bill or property tax assessment or bill, for example. Utility bills on a vacant property rise suddenly, or you find people living there. You stop receiving your tenants’ rent payments and learn that they’ve been making the payments to another person and location. You receive payment books or other information from a lender with whom you haven’t done business. Or you find yourself in default on a loan or notified of foreclosure proceedings.

If you experience or find something amiss, notify the register of deeds and local law enforcement. In New York City, for example, homeowners who think they are victims of deed fraud are urged to act quickly to report fraud to the city’s sheriff, get a certified copy of the fraudulent document from the city register’s office, report the crime to the district attorney’s office in the borough where the property is located, and consult an attorney to help confirm ownership of the property. (Legal action known as “quieting the title” may be required to resolve any questions about your ownership of the property.)

Is identity theft just a problem for people who submit information online?

You can be a victim of identity theft even if you never use a computer. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans.

The internet has made it easier for thieves to obtain personal and financial data. Most companies and other institutions store information about their clients in databases; if a thief can access that database, he or she can obtain information about many people at once rather than focus on one person at a time. The internet has also made it easier for thieves to sell or trade the information, making it more difficult for law enforcement to identify and apprehend the criminals.

How are victims of online identity theft chosen?

Identity theft is usually a crime of opportunity, so you may be victimized simply because your information is available. Thieves may target customers of certain companies for a variety of reasons; for example, a company database is easily accessible, the demographics of the customers are appealing, or there is a market for specific information. If your information is stored in a database that is compromised, you may become a victim of identity theft.

Are there ways to avoid being a victim?

If you’re thinking about upgrading to a new phone, make sure you remove your personal information before you trade it in. Why? Because your phone could have a lot of sensitive, personal information on it – like your passwords, account numbers, emails, text messages, photos, and videos. If that information ends up in the wrong hands, someone could use it to wreak havoc. They could open accounts in your name, spend your money, hack into your email, or take over your social media accounts. Here’s how to remove your personal information before you trade in your phone.

Having your data exposed in a breach feels inevitable, so securing your information online is a must. But with terms like VPN, SSO and HTTPS being bandied about, it’s hard to know where to start. It’s true, there are many, many steps you could take to improve your security — some involving acronyms — but experts say a few basics will help a lot.

“It can seem overwhelming, but it’s really not,” says Kelvin Coleman, executive director of the National Cyber Security Alliance. “Low-hanging fruit can be very, very effective in keeping you safe.”

These simple habits will protect you against some of the most common threats to your personal and financial data, such as identity theft.

Use secure passwords

“Unfortunately, a significant number of people still use 123456 and password1,” as well as other easy-to-guess login credentials, Coleman says. If you reuse the same password, it’s easy for criminals who’ve hacked one of your accounts to access others. If you’re not interested in designing and remembering complicated passwords for all of your approximately 500 online accounts, Dukes recommends a password manager — consider 1Password or Last-Pass — that can suggest and store them for you.

Erin Shepley, Cybersecurity Awareness Month Lead for the Department of Homeland Security, also suggests using multifactor authentication on your most important accounts, such as your email and bank logins. This process requires you to approve a sign-in on a separate device — such as your phone — making it easier to detect and foil unauthorized logins. If your account offers it, the option is typically available under security settings. (Google calls it “two-step verification.”) “If it takes more time for the malicious actor, they’ll move on to someone who doesn’t have that in place,” Shepley says.

Be wary of public Wi-Fi

You’ve heard it before, but “public wireless ‘hotspots’ are just that, public,” Dukes says. Information you transmit on them — including credit card data or logins — can be intercepted by a hacker on the same network. Networks without passwords, such as the ones you’ll find at some airports or hotels, are especially risky. Not only that, but criminals might spoof a legitimate access point. It’s always smart to confirm you have the correct network name before you use it, according to the DHS.

If you really must do sensitive tasks — such as shopping or checking your bank balance — outside of your home network, using your own personal hotspot is safer than public Wi-Fi. And always make sure the URLs you’re using for these tasks begin with “https://,” Shepley says.

Don’t fall for phishing scams

It’s not new, but criminals still do it because it works: They contact you, claiming to be someone — maybe someone you know — who needs your financial data, Social Security number or other personal information. They can then use this data to access your accounts.

“Phishing is still the threat vector of choice,” Shepley says. “They prey upon the human nature in people.”

It’s not always easy to tell a legitimate message from a scam, but if you’re being asked for money, login credentials or other personal data, you should verify the message before responding. For example, if you receive an email purporting to be from your bank, the DHS recommends calling your bank for confirmation on a phone number you have Googled; don’t click any links within the suspicious email.

Update your devices

“Security software is quite effective against known malware,” says Curtis Dukes, executive vice president of the Center for Internet Security. That’s because engineers are constantly creating new versions in response to current threats. Your computer and mobile devices likely have security software built into their operating systems, and they should notify you of updates automatically. The pop-ups might feel intrusive, but they’re there to protect you.

So you should resist the urge to delay updates. “I wish I could lobby to have that ‘or later’ button deleted,” Coleman says.

Safety doesn’t have to be complicated. Once you have mastered these steps, you can absolutely take further action to lock down your online presence. You might even be inspired to set up a VPN, or virtual private network, a service that can create a secure connection on a public network.

But the good news is that simple changes — like using unique passwords — can go far in keeping you safe online. “It won’t save you every time. But … it’s better to have it than not have it,” Coleman says.

Identity theft, or identity fraud, once meant crooks were churning out fake credit cards. But as that became easier to detect, a more insidious crime has evolved: the creation of completely new identities. Known as “synthetic identity theft,” it involves fraudsters using a combination of fake information, such as a fictitious name, and real data, like a child’s Social Security number, to create fraudulent accounts. It is a growing problem, says Eva Casey-Velasquez, president and CEO of the nonprofit Identity Theft Resource Center. But the scope of the problem is difficult to determine because the crime can go undetected for years, she says. However, the rate of children’s identity theft was more than 50 times that of adults, according to a 2011 report by Carnegie Mellon University’s CyLab, which studied the identities of over 40,000 children. And that report was published before a change in the way Social Security numbers are issued made identity thieves’ work a bit easier.

How does synthetic identity theft work?
First, thieves assemble an unused Social Security number — typically that of a minor — along with a fictitious name and birthdate, and an address controlled by the thief. With those pieces in hand, identity thieves apply for a credit card. While an initial application will be turned down because the “applicant” doesn’t have a credit profile, it creates a record of a “person” who doesn’t actually exist. The next step is to add that “person” to a legitimate account, or more likely several.

One way to do that is by “piggybacking” — or becoming an authorized user — on a legitimate account, perhaps that of an accomplice or a patsy, who doesn’t understand what’s going on, Casey-Velasquez says. A second, more pernicious piggybacking involves paying a credit-boosting company for the persona to be temporarily added as an authorized user to someone else’s card — a card that has a long history and low utilization. It doesn’t include getting a physical card or a card number or having charging privileges.

In time, there will be a credit history and score for this fictitious person, making it easier to qualify for credit. Casey-Velasquez said the identity often includes an occupation and income, and as long as it seems reasonable, it can go undetected by card issuers. Over a period that can span years, identity thieves may make small charges and pay them off, thus building a good credit score and receiving higher credit limits. Then, when they decide the limits are high enough, they do what is called a “bust-out”; suddenly charging the cards up to their limits, paying nothing and discarding the identity.

How do thieves get minors’ Social Security numbers?
Taking over a child’s Social Security number was made easier after the federal agency’s switch to randomization in 2011. Before then, the digits were tied to birthdate and geography, so it was more difficult to use a child’s Social Security number without it being discovered. Now a child’s number can more easily be used to establish a credit history. Minors are especially vulnerable because they are likely to have an unblemished credit history.

Some thieves have even been able to make made-up, random numbers work. Casey-Velasquez said criminals have used Social Security numbers that haven’t even been issued yet — and when that number is eventually assigned to a newborn, parents find out that the number already has a credit history. In some cases, thieves get access to a child’s stolen Social Security number. And since address verification measures for credit applicants are often out of date, anyone with a printer can produce a fake utility bill for an abandoned property to “prove” the fictitious person lives there.

What are the uses of synthetic identity?

According to the Government Accountability Office, there are three main reasons people create these false identities:

• Identity fraud for nefarious activities: stealing money or benefits. This is the one that costs businesses the most in terms of credit card fraud.
• Identity fraud for residency or work: a false identity created to live or work in the U.S.
• Identity fraud for credit repair: the perpetrator combines his or her real name with an unblemished Social Security number to create an alternate credit history.

Who is most at risk?

Randomized Social Security numbers put children born after 2011 at especially high risk for synthetic identity theft — and the theft of a child’s Social Security number can go undetected for years. Only later, when a victim tries to apply for credit using that number, is he or she likely to discover it has been misused. For example, a high school student applying for a student loan or a first job might find their Social Security number is already in use. Then, it’s their mess to clean up. Anyone with a pristine credit history can be a target. Data breaches mean a lot of Social Security numbers are out there and up for sale. It’s best to assume those digits aren’t private and to try to ensure they aren’t misused.

How can you protect your child?

• Freeze your child’s credit: If this is an option in your state, consider it. Most states now require that a record is created for the purpose of freezing a child’s credit. But that protects your child from only one kind of identity theft — credit identity theft. Synthetic identities have also been used to file fraudulent tax returns and to qualify for benefits and medical care, and freezing credit won’t help that.
• Minimize exposure: Don’t provide your or your child’s Social Security number when requested on a form. In many cases, there’s no issue. If someone requires it, ask why, and how the information will be protected.
• Monitor communications carefully: Investigate anything that seems unusual or suspicious. If you or your child gets a medical insurance Explanation of Benefits that doesn’t make sense, follow up.

Hackers are hijacking cell-phone numbers as a way to take over financial and social-media accounts.

How it works: A hacker calls your mobile-phone service provider, claims to be you, says that your phone was lost or broken and asks to have the phone number and account transferred to a different cell phone—one that the hacker controls. If the customer service representative doesn’t fall for the ruse, the hacker keeps calling back until he/she reaches a rep who does.

To verify customers’ identities, many sites send a onetime security code to a phone number that the customer ¬provided—which now may be the number that the hacker controls. If accessing an account also requires a password, the hacker may claim to have forgotten this password and ask to have it reset, knowing that a new temporary code will be sent to the number he now controls. Using this method, he might be able to loot your financial accounts, take over your social-media accounts and/or send messages in your name to your contacts.

What to do: Ask your cell-phone service provider whether it’s possible to add a special verbal “call-in” password or PIN to your account that will have to be provided by anyone trying to make changes to the account over the phone. Most providers now will do this upon request. Also avoid entering your cell-phone number on forms unless it’s mandatory—prying eyes at many companies could be collecting numbers. Supply a landline phone number instead.

Ask your financial companies whether they offer “app-based” two-factor authentication, and sign up for it if they do. With this, the onetime code needed to access your account is sent to your phone not as a text message but through a password-protected app on your phone, creating an additional layer of security.

If your phone screen says “no signal” or “emergency calls only” when you are somewhere where you usually have reception, and turning the phone off and back on does not fix the problem, immediately contact your cellular provider from a different phone to ask whether any changes have recently been made to your account.

Today I'd like to give you the top 5 things I did immediately after I knew I was a victim of identity theft.

1. Pull everything!
Pull your credit reports, financial statements and bank account information and highlight all items that are not correct. This will help to show you the depth of the assault on your credit.

2. Contact the financial institution involved in the fraudulent transaction(s).
They need to know immediately that what's been done was a criminal act. In my experience, they handled it professionally and took me seriously. I was very clear with them I did not complete this transaction and had nothing to do with it. I told them I would like them to investigate what happened so it didn't happen again to somebody else.

3. Put a fraud alert or freeze on your credit reports.
I did this with all three credit reporting agencies (Equifax, Experian and TransUnion). Initial fraud alerts are free and will be in place for at least 90 days. I doubled down and subscribed to constant monitoring from Equifax to make sure once anything changed on my credit report, I would be alerted immediately.

Protecting Dead Relatives Identity

By Adam Levin, as published in Bottom Line Personal June 15, 2017

Don’t assume that the risk of having your identity stolen lasts only as long as you are alive. More than two million dead Americans become victims of identity theft each year. To an identity thief, the recently deceased are ideal targets. Unlike the living, the dead never notice that they are being victimized and don’t take steps to stop these crimes.

There is a system in place that is supposed to prevent this when Americans die, their Social Security numbers are added to the Social Security Administration’s “Death Master File.” Once that occurs, credit-reporting agencies note the deaths in their files and credit issuers should not issue new credit. But this process can take months, leaving plenty of time for identity thieves to strike. During these months, it falls to surviving spouses, heirs and executors to protect the identities of the deceased. It’s in their best interests to do so.

Although these spouses, heirs and executors are not legally responsible for financial losses caused by postmortem identity theft; it’s the duped creditors who are left holding the bag. These crimes can cause them major headaches as they struggle to convince creditors and bill collectors that the debts are not the responsibility of the estate.

And if the executor of the estate is not paying close attention, identity theft could even go unnoticed, meaning that fraudulent account withdrawals might not be corrected and/or fraudulent bills might be paid, reducing the size of the estate.

Here’s what you should do…

SAFEGUARD SENSITIVE INFORMATION

If you are a surviving spouse or heir, take the following actions to reduce the odds that identity thieves will steal the deceased’s identity…

Edit the obit. Do not mention the deceased’s home address, birthday or mother’s name in his/her obituary. Some identity thieves scour the obituaries for potential targets, and this information could be useful to them.

Watch the wallet. There have been cases of hospital or emergency services personnel stealing credit cards from the wallets of the deceased. These thieves sometimes leave most of the contents of the wallet in place in order to decrease the odds that a loved one will realize anything is amiss. What to do: Cancel the deceased’s credit cards as soon as possible. Carefully check the final bill for charges that occurred after the deceased went to the hospital and/or passed away.

Discard the deceased’s documents with care. Identity thieves have been known to pick through garbage cans outside the homes of the recently deceased. They’re hoping that heirs threw out sensitive paperwork while cleaning out the house. Documents that should be shredded with a paper shredder include tax returns…financial account statements…credit card statements…bank account statements…and anything with a Social Security number.

Relocate the wake. If you hold a wake or reception in the deceased’s home, an identity thief (or burglar) could show up, claim to be an old friend of the deceased and then slip away from the crowd to steal sensitive information, credit cards and small valuables. Also, an employee working for the caterer, florist or cleaning company you hire for the event could be a crook bent on ID theft.

Prevent over-sharing on social media. Some identity thieves search the social media accounts of the recently deceased to find the facts they need. If the deceased has Facebook and/or other such accounts, log into each of these and either delete the accounts (assuming that you can gain access or, if you prefer to leave the accounts open as a way to remember the deceased, at least confirm that the account settings restrict access to only a small circle of family members and friends.

Also read through the posts, deleting any that mention ID-related information such as mother’s maiden name or birth date. If you do not log into the account because you don’t have the password and cannot find it near the deceased’s computer, report the death to the social-media site. This often leads to the account being shut down or “memorialized” in a way that could at least limit access, though this can vary depending on the site and the settings that the deceased selected.

Have the deceased’s mail held at the post office or forwarded to the estate’s executor. Otherwise, mail containing account information and other sensitive data might sit in the deceased’s mailbox where an identity thief could grab it. Exceptions: This is not necessary if a spouse or some other trusted loved one still lives at the deceased’s address…and/or the deceased has a post office box or locking mailbox.

SPREAD THE WORD

Even if you take all the right steps to safeguard your deceased loved one’s sensitive information, he/she still could be victimized by an identity thief. There have been so many data breaches of retailers, financial institutions, government agencies and others in recent years that the information an identity thief needs might already be in circulation. What’s more, postmortem identity theft sometimes is committed not by a stranger, but by a family member who has access to the deceased’s sensitive information. Informing key agencies and institutions about the death can at least contain the damage that a postmortem identity thief can do. Obtain copies of the death certificate as soon as possible—death certificates typically are available through the funeral home or mortuary—and send them along with letters reporting the death to…

Government agencies including the IRS, Social Security Administration, Department of Motor Vehicles and the tax authority in the deceased’s state. This should prevent identity thieves from having duplicate driver’s licenses, Social Security cards or other documents issued to them in the deceased’s name. Notifying the IRS and state tax authorities promptly should prevent an identity thief from filing a phony tax return in the deceased’s name and receiving a refund.

The deceased’s creditors and other financial institutions. This includes investment companies and advisers, banks, credit unions, credit card issuers, lenders and insurance companies. If you are not certain which financial companies the deceased used, go through his recent mail, checking account registers, filing cabinets, recent tax returns and wallet in search of clues. Or identify these creditors and financial companies by obtaining a free copy of one of the deceased’s credit reports at AnnualCreditReport.com.

To obtain this report, you will have to provide identifying information about the deceased, including his Social Security number. It generally is easier to obtain the credit report before the credit-¬reporting agencies are informed of the death. After they learn of it, extra steps might be required for the estate’s executor to obtain a copy.

The three major credit-reporting agencies. Ask Equifax, Experian and TransUnion to place a “deceased alert” on your loved one’s file. This is like putting a security freeze on the file—it prevents the credit-reporting agency from releasing the file, which should, in turn, prevent new credit accounts from being opened in the deceased’s name. Send certified copies of the death certificate along with brief letters identifying the deceased by full name, Social Security number, last five years of addresses, date of birth and date of death to…

Equifax, PO Box 740241, Atlanta, GA 30374

Experian, PO Box 4500, Allen, TX 75013

TransUnion, PO Box 2000, Chester, PA 19016.

Helpful: If there are signs that identity theft is occurring despite your efforts—these signs might include money disappearing from the deceased’s accounts…or account mailings arriving from creditors that the deceased did not have—the estate’s executor should call the credit-reporting agencies and the deceased’s financial institutions as quickly as possible to confirm that they received the death certificate and placed a death alert on the file or account. The executor also should call the Social Security Administration and ask whether the deceased’s Social Security number has been added to the Death Master File. If it hasn’t, explain that identity theft is occurring and ask whether anything can be done to speed along the process.

As published in October 15. 2016 BottomLine PERSONAL

Cyber thieves might use your smart-phone to steal money from your bank account. In this scam, the thieves sneakily get you to download malware onto your phone, possibly by sending you a link to a free app for a card game or risqué content. The malware, known by names such as Acecard and GM Bot, has been around for years but has been adapted to specifically target banking apps on smart-phones. Using the malware, thieves record credentials, such as your user name and password, when you log into your bank account. With that information, they can initiate electronic transfers from your account to accounts they control.

You can’t necessarily rely on typical bank security measures, such as the use of a verification code that the banks send you by text, because some forms of the malware can capture that code, too. And most smartphone owners don’t use anti-malware software on their phones. Federal law says you can get all of your money back if you notify your bank within 60 days after the fraudulent transaction appears on your bank statement. However, you also typically are required to show that you weren’t lax about safeguarding your information.

Self-defense: Don’t click on a link in a text message if you don’t recognize the sender. Download apps only from reliable sources such as financial apps on your bank’s website or other apps at Play.Google.com or iTunes.Apple.com. Also, install security software, and make sure it automatically updates. Recomended: For smartphones and tablets with Android operating systems, Malwarebytes Anti-Malware (Malwarebytes. org)...for iPhones and iPads, Avast SecureLine (Avast.com). Both are free.