I am a victim of identity theft

This weekend I found out that I am a victim of identity theft. It is very unsettling, and feels like a total violation of my privacy.

My girlfriend Chrissy and I were discussing the potential of me getting a new car in the next few months. I am having some repairs coming up on my current car, like the air conditioning leaking refrigerant, fixing a small oil leak and a few other little but annoying things that will add up. It would be nice to avoid those repairs and getting a new car where I don’t have to worry about service for a few years.

We looked around online for cars that could be interesting and I found some good deals. I started working on a budget to figure out what I could afford and Chrissy asked me what my credit score was. I had to admit to her that I had no idea. After my divorce in 2003 I took some bad hits to my credit, as I was not able to keep up with all the bills for the house by myself plus my car payment, utilities and other expenses in addition to paying child support all of the sudden. So I had been scared of even looking at my credit score.

Chrissy had used Credit Karma before for herself so Sunday I started setting up a new account there. I entered my social security number, address and some other information to setup the account.  I selected a password and submitted the form. To my surprise the reply from the site said that I already had an account, but using another email address. It did not show the address in clear, it was masked so I could only see the domain (@att.net), but I have never had any address in that domain. I sat there shocked for a while and tried to think of what could be going on.  Chrissy and I talked about it and worried that it might be identity theft.  So we called a lawyer who is a relative of hers who also works in this field.  We found out quickly that the act of someone accessing my credit report without my permission is a felony at the state and federal level. If they tried to take out credit or did take out credit in my name it is another felony.  Doing these things over the computer is yet another charge.

So to figure out the truth I had to make copies of my id and fill out a form that we sent through the mail to Credit Karma, to prove my identity and get access to “my” account. This will probably take a little while though.  🙁

But I am furious that someone managed to find out enough about me to be able to setup an account to monitor my credit. The person must have my social security number, my date of birth and probably also my address. A lot of people have this information, actually. This article mention some ways people can get unauthorized access to someones credit report, for example a rogue employee in HR or a company or law firm otherwise allowed to pull a credit report.  It could just be someone who have your social security number, address and knows a little bit about you.

Just a few years ago, both Chrissy and our friend Mark were victims of identity theft. Someone broke into the mailboxes in their neighborhood and stole pre-approved credit cards and other personal information, and were able to take out credit cards in their names.  Before moving here, I know there were a couple of mailbox break-ins at my old place. The persons who stole their identity were caught using the stolen credit and arranged a plea deal that resulted in 40 years in federal prison.  Thought they will likely serve only half of that, 20 years is a long time.

I recently went through surgery, and I was in contact with different medical providers, both in person and on the phone. I had to give out my full social security number and address several times. Seems like there have been a number of cases where nurses or other medical staff have been stealing personal information from patients. I am not saying this is what happened in my case because I don’t know yet, but very few other people should have my social security number so I am looking very carefully at that.

I went to another site and ran my credit report there, and I did not see any unknown accounts taken out in my name. So I put a fraud alert on my credit report, so it should be harder/impossible to setup any accounts in my name without me knowing/being alerted.

So what else do I need to do? I have been doing some research, and one of the first things I had to do is to file a police report. If I didn’t do that, and someone takes out a credit card in my name, I may be responsible for the charges or seen as being part of the crime.

As we were told by the lawyer, it is a federal crime just to access someones credit report:

Under the Federal Fair Credit Reporting Act (FCRA), any person or organization who knowingly and willfully obtains a credit report under false pretenses (such as getting a credit report on an individual without a permissible purpose as outlined below), is subject to a fine of up to $5,000 or imprisonment of up to 1 year, or both.

So even if no credit cards were taken out in my name, just the act of accessing my credit report is a felony.  And I am still not completely sure that there are no accounts taken out fraudulently.

I live in Texas, and the state laws regarding identity theft is actually stricter than the federal laws. So the person that did this will face a felony charge in one of the two jurisdictions.

We also requested Credit Karma to provide me with the email address was used to sign up for “my” account, as well as what IP address it was done from, as well as the date/time and all the times it was accessed.  The police can then contact the Internet provider that owns that IP address and request to know what customer used it at that specific time. So it should not be too hard for the police to find out who it was.

I am furious. I feel violated and like I am looking over my shoulder all the time. Did my doctor or nurse do this? Did someone break into my mail? Could someone have hacked my computer? It is almost as bad as when my house was broken into back in 2004 and I lost a lot of personal items. I hope this will not affect my credit rating, or cause me not to be able to get the car I want. I am worried about that but it seems like with a police report and cooperating with authorities I can get things cleared up.

From years of tracking down spammers back in 1999-2002, I know how you can find out a lot from electronic tracks left behind. As soon as they have the information from Credit Karma about the account the authorities will have no problem to find out who it was. And then I get to file charges and prosecute to the fullest extent of the law. I will enjoy that!

Update 2014-08-28: I have found out who did it, and the issue have been dealt with. There was no major financial loss, just some time and money spent driving to several different police departments trying to file in the correct jurisdiction. Thanks everyone who supported me!