By Walter B. Donaldson, Certified Fraud Examiner, and Senior Vice President, Investigative Services, Bank of America
dentity crime comes in many different forms as criminals gain access to personal information that they use to open credit card accounts or buy an automobile, a home, and more. Unfortunately, there are many ways to become a victim, ranging from basic shoulder surfing and dumpster diving to the more complex and modern phishing and malware, including polymorphic trojans, which can obtain personal data from your computer without being detected. The ease with which people become victims of identity crime makes prevention strategies an important message for law enforcement agencies to deliver to the public. Community members must have confidence that if they become victims of identity crime, officers will assist them and then investigate the perpetrators. There are many tips for preventing identity crime, which can be incorporated into a community policing or education program. One good starting point is the IACP’s ID Safety Web site, www.idsafety.org. The site is a useful tool for both the public and law enforcement agencies.
Knowledge Increases Credibility
When a community resident comes forward with a complaint of identity crime, the law enforcement agency with jurisdiction over that community has an obligation to assist the victim to the best of its ability. Citizens can easily be confused and overcome by all that is necessary to restore their good name after being victimized. Generally, victims become aware that their information has been compromised when debt collectors call their home, when they are declined for credit, or when they do not receive expected mail. When fraud is suspected, their first call is usually to a financial institution. Although all financial institutions will help victims begin the recovery process, the directions victims receive will vary among financial institutions and the internal process to which these institutions adhere. Many of these members of the financial services industry are also members of the Identity Theft Assistance Center (ITAC; www.identitytheftassistance.org). ITAC is a nonprofit organization that provides a free victim assistance service for customers of member companies and also works closely with the law enforcement community. Furthermore, ITAC adds victim information to the Consumer Sentinel Database (http://www.consumer.gov/sentinel), managed by the Federal Trade Commission (FTC; www.ftc.gov). These sites are excellent resources to educate officers in advance of taking a complaint, and they also provide tools and information to assist during the course of an investigation. Recovering from an identity crime takes consumers on average more than 25 hours of telephone calls, letter writing, and filing of police reports. Their out-of-pocket expenses are more than $500, while the average fraud loss currently exceeds $5,500. Law enforcement agencies can best help victims by taking the initial report from a victim and offering further assistance where possible. Knowing what constitutes an identity crime and the challenges that victims face will serve officers well. In the end, the best possible experience for a victim is to work with a competent, concerned law enforcement officer who helps the victim wade through the recovery effort.
Victim versus Suspect
Determining if a person filing a report is truly a victim can be a sensitive issue, one that must be managed carefully. Right now, about half of all states have a mandatory police reporting law in effect. This requires law enforcement officers to take a police report from people who reside in their jurisdiction and who believe they are the victims of an identity crime, even if the perpetrator resides or committed the crime in another jurisdiction. This is an important change, and all jurisdictions should follow suit. Every company must provide victims, by law, all documents associated with a fraudulent transaction if victims submit a request, in writing, accompanied by a police report. Credit applications, authorization logs, check copies, and other supporting documents related to the theft or misuse of a victim’s identity may be all the evidence available to support a case. These documents may be used to compare the victim’s signature with that of the fraud documents. Together, a police report, a signed and sworn affidavit the victim provided the institution, and an FTC complaint indicate that a victim is taking steps to prove the crime happened and to get help. More importantly, the documents may contain information about the identity criminal that may help in the investigation. Investigating officers can find additional information about state-specific laws at www.idsafety.org.
The Road to Recovery
As with all contingency planning, it is best to prepare for the worst-case scenario. How do law enforcement agencies help victims get on the road to recovery from an identity crime?
Victims will quickly accumulate a lot of documentation, notes, copies of statements, and other documents that may serve as evidence. Officers should advise victims to create a file to organize all information and communication with their financial institutions for future reference.
As a first step, victims should contact their financial institutions, such as banks, credit unions, credit card companies, mortgage companies, and brokerages, including all locations where victims suspect that a fraudulent account has been established or where an existing account may have been taken over by the fraudster. Each institution has a security or fraud division that handles claims on card, checking, or deposit accounts, as well as mortgages. Victims should file their claims, close all accounts, stop payment on all outstanding checks that they did not authorize, and request affidavits from the bank. Above all else, victims should document all conversations, requests, and expectations.
Once all financial accounts have been closed, victims should also contact major utilities and confirm that no changes have been made to their accounts. Examples include changes to victims’ postal addresses, telephone numbers, or e-mail addresses. All of these pieces of information allow fraudsters to obtain legitimate utility invoices that they can use to confirm their identity with landlords, rental agencies, and lenders.
Victims should be encouraged to place a fraud alert with each of the three major credit bureaus. This is a major step in informing future creditors that individuals have been victimized and helps to avoid any additional fraud. There are two different types of alerts:
- The initial fraud alert is used when individuals suspect that they are victims of an identity crime. For example, a person may lose a wallet or purse or have either stolen. Someone may unknowingly respond to a phishing scam. In each of these instances, the victim should ask the bureaus for an initial report. If victims place an initial fraud alert on their credit file, they are entitled to one free credit report from each of the three nationwide consumer reporting companies. The initial alert stays on the victim’s credit report for at least 90 days before dropping off.
- The second type of action is an extended alert that lasts for seven years and identifies the subject of the report as a true victim of an identity crime. For victims to take this action, they must provide the consumer reporting agency with an identity theft report, which is available online from the FTC.1 When victims place an extended alert on their credit report, they are then entitled to two free credit reports from each of the three nationwide consumer reporting agencies within 12 months. Additionally, the credit bureaus will remove victims’ names from marketing lists for prescreened credit offers for five years unless they ask to be added to the list. The three agencies are Equifax (www.equifax.com), Experian (www.experian.com), and TransUnion (www.transunion.com).
The FTC is responsible for taking complaints from the public under the Identity Theft and Assumption Deterrence Act. In that role, it collects information and assists victims by forwarding details to appropriate enforcement agencies and by giving victims a complaint form and letter that should accompany the police report. Officers can direct victims to the FTC and file an online form. The printed FTC ID Theft Complaint, in conjunction with the police report, can constitute an identity theft report. As mentioned earlier, this report is necessary to provide the credit bureaus a means to place the seven-year alert.
Are We There Yet?
The process of recovery for victims can be tiring and cumbersome. Even after spending considerable time and money, victims cannot enjoy an immediate restoration of their good name. Once victims reach an understanding with their financial institutions about the fraud and the credit bureaus place alerts, it can take an extended period of time for victims to get back on track financially. For this reason, they should check the credit bureaus four to six months after reporting the crime to guarantee that all fraudulent transactions have been removed.
The IACP’s Investigative and Training Resources
The IACP and Bank of America have partnered to create a national strategy to prevent and respond to identity crimes. One resource of this partnership is the Identity Crime Toolkit for Police Executives. This toolkit is available to all agencies to help them battle identity crime. Toolkits can be downloaded by visiting www.idsafety.org or requested by sending an e-mail message to firstname.lastname@example.org. ■
1See “Filing a Complaint with the FTC,” http://www.ftc.gov/bcp/edu/microsites/idtheft/consumers/filing-a-report.html (accessed November 6, 2007), for details.