PORTLAND, Maine — The identity of one 17-year-old boy was being used by 12 different strangers across multiple states racking up nearly $60,000 in bad debt, including a $30,000 car and apartment rent that had gone unpaid for months. Another girl, also 17, had her identity used by eight other people to accumulate more than $725,000 in debt.
A recent Carnegie Mellon University study, which looked at 40,000 U.S. children’s records, found that more than 1 out of every 10 had their identity stolen and used for some sort of financial activity.
“The youngest of the victims was 5 months old. Another of the kids had a property in foreclosure in another state,” said Jane Carpenter, formerly of the Maine attorney general’s consumer protection office.
According to the most recent victimization study conducted by the University of Southern Maine’s Muskie School of Public Service, identity theft has become the most prevalent crime in the state. In 2011, 15 percent of Mainers said their accounts or identifying information was used within the previous year without their permission. That was an increase from just more than 10 percent five years earlier, and represented a greater rate of victimization than overall property crimes such as car thefts and burglaries or violent crimes such as assaults.
And as banks, credit agencies and law enforcement officials get savvy about fortifying themselves and their adult clients, identity thieves are evolving to strike victims still largely unprotected.
“For kids, who are just on the verge of becoming adults and are looking to buy their first car or rent their first apartment, someone will run a credit report and they’ll find that they’ve been victimized for years. And that’s really sad to see,” said Carpenter, who this fall launched Maine Identity Services LLC to help victims recover from the crime and provide training to police investigating it.
“You can take that information and, just by changing one [birth date] digit, pretty quickly start building up a credit history,” said Stan Snow, Maine representative for LegalShield, which offers prepaid identity protection services through its partnership with heavyweight investigative firm Kroll. “I’ve heard of cases where people’s sons turned 18 and immediately found bad checks on their credit history.”
‘Sick to my stomach’
While outright credit card theft is still troublesome, Snow said identity thieves are now more likely to find victims’ personal data online by tapping into wireless networks or hacking into company databases.
“Somewhere along the line, people who were committing identity theft realized there was a lot more to be gained than a credit card,” Snow said. “If you could get hold of a whole person — not just their card, but their credit abilities, their good name — the opportunities would be endless. I can take your car, and I can sell it once. I take your identity, and I can sell it hundreds of times all over the world.”
Carpenter said a piece of someone’s identifying information “could trade for anywhere between $3 and $25” on the black market — which is increasingly used as a funding source for terrorism and organized crime, Snow said.
“If you’re a hacker and you’re looking at getting $3 for a record, it may not be worth your time,” Carpenter said. “But if you can attack a database that has millions of records in it that you could sell in an Internet back room somewhere, that’s where you’re going to make your money.”
With children, the victims may go years without seeing the damage because they only start to investigate their credit scores when they are old enough to buy their first cars or apply for college or jobs.
“He was only 3 years old when somebody started using it, and the thought of that made me sick to my stomach,” one father — who learned an identity thief had financed a $605,000 home in California after almost a decade using his then-14-year-old son’s Social Security number — told Carnegie Mellon researchers in their report.
In its first-of-its-kind study of child identity theft, Carnegie Mellon conducted identity protection scans in 2009-2010 of 42,232 Americans under the age of 18 pulled from a pool of 800,000 identity records. Of the minors scanned, 4,311 had someone else using their Social Security numbers — which, at 10.2 percent of the total, was a rate more than 50 times greater than the adults in the same pool.
While that report did not break down the victims by state, it emphasized the fact that identity theft is not a hyperlocal crime that respects boundaries. Unlike in cases of property theft or violent crimes, where people may be less likely to be victimized simply because of where they live — Maine consistently has one of the lowest crime rates in the country, for example — people face about the same risk of identity theft no matter where they are.
That’s because most of the personal data sought by identity thieves is stored digitally in virtual locations unrelated to a potential victim’s physical address. And that data is often equally accessible from the same remote distance, hundreds or thousands of miles away, given the technology.
“The bad guy used to be almost always local — it may not have been right in this town, but it was usually somewhere in this county,” said Penobscot County Sheriff Glenn Ross. “But these guys are often from outside the country. Finding the criminals when they’re halfway around the world is almost an insurmountable problem. For us, it’s really about educating people about how to avoid getting into these situations to begin with, because once you’ve been victimized, it’s very hard to recover your resources and it’s very hard to recover your identity.”
Applying Carnegie Mellon’s 10.2 percent rate of childhood identity theft victimization to Maine’s population suggests that nearly 27,000 Mainers under the age of 18 are having their identities used elsewhere by strangers — and the research suggests they probably are unaware of it.
Ross said that he’s more likely to see another population of Mainers victimized by identity theft — the elderly — but that both groups share similar characteristics in that they are less likely to regularly check their credit activity. Senior citizens, in many cases, are settled in homes and don’t need to seek loans or apply for jobs, the sheriff acknowledged, meaning that, like children, they could go years without noticing that their Social Security numbers are being used by criminals elsewhere.
“When you see those types of things, it’s heart-wrenching, and when you know they’re never going to be able to recover those losses, it’s even worse,” Ross said.
“You can reduce the risk, but you can’t necessarily prevent it,” Snow, of LegalShield, said. “It’s important to reduce the risk and be prepared when it happens to you. If you’re prepared, you can reduce the damage dramatically.”
Carpenter, who founded Maine Identity Services, said that while apprehending the thieves is still often difficult for authorities, state and federal governments and banks are adapting to make life easier for victims after they discover the crime has been committed.
“Years ago, you used to hear stories about how it took people years to clear their names and thousands of dollars to clear their name. I’m pleased to say things have gotten better,” she said. “I think those horror stories are fewer and farther between.”
Carpenter acknowledged that restoring a victim’s credit can be time-consuming and complicated, especially if a victim doesn’t know the government procedures in place to do so, but said she launched her company to help navigate that process.
She said the first thing a person victimized by identity theft — or his or her parents — should do is file a police report. The 2011 Muskie School study indicated that only about 21 percent of Maine identity theft victims reported the crime to police.
“Federal laws that offer ways for victims to clear their names all require police reports,” Carpenter said. “About seven years ago, there was a law passed by the Legislature and signed into law by the governor that established that for residents of Maine victimized by identity theft, it’s considered to be a crime committed in Maine, no matter where the criminals hacking into the computers are located. Local police are required to take a report and give you access to it.
“That has helped,” she continued. “People should be able to get a police report, then they can send a copy of the police report to the creditors, and protection mechanisms kick in that banks and creditors have to follow.”
Kate Leifeld of the Internal Revenue Service’s Taxpayer Advocate Service in Augusta said some identity theft victims may learn that their Social Security numbers are being used when they receive notices of unpaid taxes or other tax filing activities.
“Our advice is, if you get a notice from the IRS that doesn’t make sense to you, respond to the notice as soon as you can [and explain the discrepancy],” she said. “Our main goal at the Taxpayer Advocate Service is to help taxpayers navigate the system. To fix these problems, they’re often complicated.”
Richard Power, a distinguished fellow with Carnegie Mellon’s CyLab research collaborative, wrote in his report that parents should remain on the lookout for pre-approved credit cards or unsolicited financial offers arriving in their children’s names. Those offers are indicators that the recipient likely has an open credit file, he wrote.
Perhaps most importantly, identity theft researchers and law enforcement officers alike urge all Mainers to stay vigilant and educated about the latest identity theft trends. Once the public, banks and creditors catch on to the latest identity theft schemes, the criminals will look for new ones, Snow said.
“The face of it keeps changing, but it’s been a constant onslaught on the people of Maine,” said Ross.