Identity Theft: Protect Yourself, Secure Your Future

Contents

What Is Identity eft? ......................................................2

How Can I Avoid Becoming a Victim?

.............................8

I ink My Identity Has Been Stolen - What Can I Do?......14

Tools.................................................................................21

Maryland Oce of the Attorney General

Consumer Protection Division

Identity eft Unit

Identity

Theft:

Protect Yourself,

Secure Your Future

What Is Identity Theft?

Identity theft occurs when someone uses your personal information to:

• Purchase goods,

property, or services

without your consent;

• Create fake nancial

accounts in your

name;

• Impersonate you for

nancial gain or to

receive medical care;

• File fraudulent tax

returns under your

name to obtain your

refund; and/or

• Commit other crimes

that can damage your

personal credit and

reputation.

Identity theft is one of the

fastest growing crimes in the

country, aecting over 15 million Americans each year. Victims often

spend hundreds of hours and thousands of dollars to x the damage

caused by identity thieves.

is booklet will help you learn what identity theft looks

like and how it happens, how to reduce your risk of identity

theft, and give you specic guidance to help recover if your

identity is stolen. Look for this symbol for quick tips to help avoid

identity theft.

What Does Identity eft Look Like?

Identity theft can take many forms. Often, identity thieves like to

simply steal money. is is called nancial identity theft. Financial

identity theft generally takes one of two forms: existing account

fraud or new account fraud.

Existing account fraud is extremely common, and there is a good

chance you have already experienced it at some point in your life.

is type of fraud happens when an identity thief gains access to an

account that you created. For example, if an identity thief makes a

purchase using your stolen credit card number, you are a victim of

existing account fraud. Existing account fraud can be relatively easy

to spot, but dicult to prevent.

Diligently monitoring your account statements for

unauthorized activity is one of the best ways to spot

existing account fraud. Be sure to check your ac-

count statements at least once a month, but more frequently

if possible.

New account fraud occurs when identity thieves use stolen infor-

mation to create a new account in your name. By using your stolen

information (name, date of birth, or Social Security number, for

example), someone may be able to open a credit card or utility ac-

count in your name. is type of fraud can be very dangerous because

it may go undiscovered for many years. Victims often discover the

new accounts when they are contacted by a debt collection agency or

applying for credit.

New account fraud can be hard to spot, but it’s easy to prevent.

A free tool, called a credit freeze is extremely eective at prevent-

ing new account fraud. For more information about credit freeze,

see page 13. Checking your credit report annually from each of the

three major credit reporting agencies is a good way to see if an iden-

tity thief has fraudulently opened an account in your name. e

three major credit reporting agencies are Equifax, Experian, and

TransUnion. See page 17 for instructions on checking your credit

reports.

Check your credit report from all three major credit

reporting agencies at least once per year. Also

consider placing a credit freeze with all three credit

reporting agencies before identity theft happens. This is one

of the only preventative tools in the world of identity theft.

Other common forms of identity theft include medical, criminal,

and income tax fraud.

• Medical identity theft occurs when an unauthorized person

uses your personal information to receive medical care. is

is dangerous because it could negatively aect your insurance

rates, or potentially lead to an inaccurate diagnosis or dan-

gerous drug interaction.

• “Criminal” identity theft occurs when a person uses your

personal information in the commission of a crime, often as

an alias or during a trac stop.

• Income tax identity theft occurs when a person uses your

personal information to le a fraudulent tax return to obtain

a tax refund. e identity thief will submit phony tax infor-

mation to receive a large tax refund in your name.

Identity thieves seem to be endlessly inventive. As a result, the list

of miscellaneous forms of identity theft is ever-growing. If identity

thieves can nd a way to benet from using your stolen information,

they will. Common examples include government benets, Social

Security payments, jobs, apartment rentals, student loans, utility

accounts, and much more.

How Does Identity eft Happen?

Identity theft happens when identity thieves obtain your personal in-

formation. ey can do this in one of three ways: they steal it, obtain

it from publicly shared social media, or trick you into giving it away.

Identity thieves can

steal information in many

ways. Some methods, like

physically stealing your

wallet or purse, don’t rely

on technology. Physically

stealing your information

can limit identity

thieves to a par-

ticular location or

a limited number

of stolen les. Other

methods, such as hack-

ing into your email or

a business database can

happen from anywhere in

the world using

sophisticated

technology. Steal-

ing data from a

government or

business database is sometimes called a “data breach.” Data breaches

can allow a single person to steal a massive amount of information.

For more information on data breaches, see page 6.

Consider that what you post on social media sites is

visible to many people, not necessarily just your

close friends. Be cautious about posting information

(like your birthday or birthplace) that could help an imposter

steal your identity.

Identity thieves can also use information that you gave away. Be

mindful about what you publicly post on social media because iden-

tity thieves can search out useful information even if you think it’s

harmless to share. For example, it may seem harmless to post your

birthday on a social media site, but thieves can use this information

with other information about you to steal your identity. More com-

monly, however, identity thieves use fraud to trick you into giving

away private information. Some of the most common ways to trick

you into giving away valuable information are scams called “phishing”

and “imposter fraud.” More information about these and other types

of scams is available on the Maryland Attorney General’s website,

www.marylandattorneygeneral.gov, by clicking on Services, and then

Consumer Protection.

What Are Data Breaches?

A data breach occurs when sensitive or condential information has

been accessed, viewed, stolen, or used by an unauthorized individual.

Data breaches, also called security breaches, can expose your personal

information, such as Social Security numbers, nancial account infor-

mation, user names and passwords, medical records, and more.

A data breach can occur when a business’s website is hacked, a com-

puter is stolen, data tapes or other records are lost in the mail, or

through an unintentional release of private information. e Mary-

land Personal Information Protection Act (PIPA) requires any busi-

ness that keeps electronic records containing the personal information

of Maryland residents to notify those residents if their information

is compromised. e business must also provide notice to the Oce

of the Attorney General. is enables Marylanders to protect them-

selves from fraud and identity theft. ese notices are posted on the

Attorney General’s website under “Security Breach Notices,” and are

searchable by the business’s name.

Take it seriously if you receive a notice from a busi-

ness that they have experienced a data breach and

your personal information may be at risk of being

exposed or stolen. If you have any questions about the au-

thenticity of the notice, reach out to the Attorney General’s

Identity Theft Unit at [email protected]

or 410-576-6491.

Often a business that has experienced a

data breach will

oer comple-

mentary credit

monitoring ser-

vices. Consider

taking advantage of the oer if, after you

review its details, you think it will be bene-

cial. Contact the business that is extending

the oer, the credit monitoring agency, or

the Attorney General’s Identity eft Unit if

you have additional questions about credit monitoring services.

To further minimize the risk of identity theft following a data breach,

consider changing your user name and password and, if the breach

involved a bank or other creditor, requesting new credit or debit card

account numbers.

If you have received a data breach notice, use this checklist to help

reduce your risk of becoming a victim of identity theft.

 Place a fraud alert with each of the three major credit reporting

agencies (page 15).

 Obtain a copy of your credit report from each of the three major

credit reporting agencies (page 17).

 Make appropriate changes to your impacted information

(change passwords, cancel cards, or close accounts, for example).

 Take advantage of any free credit monitoring oers provided by

the aected business.

 Keep detailed records of all communications related to

the incident.

 Consider placing a credit freeze on your credit reports (page 18).

How Can I Avoid Becoming a Victim?

You can’t eliminate the risk of identity theft. However, you can reduce

your risk by taking certain steps to protect your private information.

Protecting Yourself at

Home

Although identity thieves can

strike from the other side of

the world, it’s important to

secure information in your

own home, because it’s likely

where you spend most of your

time and keep many of your

sensitive documents. Some

identity thieves know or have a

relationship with their victim.

For example, party guests

or neighbors may be able to

physically steal documents

from you that are left unse-

cured. Mobile smartphones with cameras eliminate the need to actu-

ally steal your documents—the identity thief can simply capture the

information in a quick photograph. Follow these tips to help protect

your information at home.

• Shred sensitive documents you no longer need, such as credit

card oers, nancial statements, and medical documents;

• Use a locking mailbox;

• Use a safe or locked le storage system to protect sensitive

documents;

• Opt out of pre-screened credit card oers by calling

1-888-5-OPT-OUT (1-888-567-8688) or visiting

www.OptOutPreScreen.com; and

• Opt out of “bulk” mail by visiting www.DMAChoice.org.

Keep your sensitive documents in a locked, secure

location in your home. Thieves no longer need to

physically steal your paperwork—they can just take a

photo of it with a smart device, like a phone or tablet.

Protecting Yourself on the Go

It’s easy to accidentally—and unnecessarily—carry sensitive informa-

tion in your purse or wallet. Unless you specically need the informa-

tion for a job interview or an appointment, you should leave your

Social Security card, bank account PIN, insurance cards, and other

important documents in a secure place at home. You may also want

to make copies of important documents, including your credit

cards (front and back), Social Security card, and insurance cards. If

your purse or wallet is stolen, you will have all the information at

home if you need to replace cards or close your accounts.

Don’t give out your Social Security number unless it’s absolutely

necessary. Sometimes you will be required to use your Social Security

number for tax purposes, Medicare, or to request a credit report from

a credit agency. If you have a membership card that uses your Social

Security number, ask for a randomly generated identication number

instead.

Protecting Yourself Online

Protecting your sensitive information online is be-

coming more and more dicult. Technology makes

it very easy for identity thieves to steal both your

money and information through “phishing.” Phish-

ing occurs when identity thieves send emails that

appear to be from a trusted source (your bank, a

utility service provider, or a friend, for example)

in an eort to trick you into providing private

information. Often, these emails use stolen or

counterfeit graphics, and may ask you to

“conrm” a password or other sensitive

account information, enter payment

information, or open an attachment.

Keep these tips in mind to protect

your information online:

• Financial institutions never ask

for personal information by

email;

• Don’t click on links in unfamiliar

emails. ose links can contain a virus or

malicious software that can infect your computer; and

• Delete any suspicious emails immediately.

A Note About Passwords

It’s nearly impossible to keep track of all the unique passwords we use

online, so here are a few ways to keep your accounts more secure.

Consider using multi-factor authentication (MFA), which requires

your password AND an additional piece of information to access the

account. Usually the additional piece of information is a short code

sent to a smartphone, email, or other trusted device. Even if someone

is able to successfully guess your password, they will be unable to

access your account unless they also have the second piece of informa-

tion required.

Do NOT use the same password for multiple sites! If one website

is hacked, and the identity thieves learn your password, they may be

able use it on other accounts if you reuse the same passwords.

Write down clues or reminders rather than your actual passwords if

you have trouble remembering them. Compare the following remind-

er phrases like “my third dog and dad’s birth year” versus “Spot1950.”

One will be meaningful to you, but meaningless to someone who

may view the written clue.

Consider using fake answers for password recovery questions. If you

have ever forgotten your password, you know that many online ac-

counts will ask you a series of questions to recover your password.

If you have a prominent social media presence, or you suspect an

identity thief knows a lot about you, you can use nonsense answers

for your recovery question. For example, “Where did you grow up?”

is a common recovery question. Many people that know you or have

access to your personal information may be able to accurately answer

that question. However, if you put something that’s clearly not true

( “e Moon,” for example), it will be much harder for an identity

thief to compromise your account.

What Are Credit Reports?

ere are three major nationwide credit reporting agencies: Equifax,

Experian, and TransUnion. Credit reporting agencies collect and

maintain information about consumers and their nancial history in

something called a “credit report.” Credit reports are used to generate

something called a “credit score,” which is often used by lenders and

creditors to decide whether to provide you with a service and if so,

on what terms (for example, interest rates). Generally, a better credit

score results in more access to lender and creditor services, and on

more favorable terms.

While a credit score is important, the underlying information on a

credit report is what determines a credit score. erefore, it’s impor-

tant that your credit report is accurate and free from fraud. A credit

report includes some personal information as well as your nancial

history, such as whether you pay your bills on time and if you have

led for bankruptcy.

If you are a Maryland resident, you can receive up to

six free credit reports each year. Federal law entitles

you to one free report from each credit reporting

agency each year, and Maryland law entitles you to an addi-

tional free report from each credit reporting agency each

year.

You may request a free copy of your credit report from each of the

three major credit reporting agencies once a year. is is one of the

easiest and most eective ways to see if you are a victim of identity

theft, specically new account fraud (page 3). Maryland residents

are entitled to an additional free credit report each year, which can be

obtained by directly contacting any of the three credit reporting agen-

cies. You can also obtain free credit reports through Annual Credit

Report, an organization authorized by federal law to provide credit

reports from Equifax, Experian, and TransUnion. See page 17 for

instructions on obtaining your credit reports.

How to Protect

Your Credit Report

You can completely

block the information

on your credit report

from would-be credi-

tors or lenders through a

credit “freeze.” Freezing

your credit report is one

of the only ways to help

prevent identity theft. If

you have a credit freeze

in place, any new ac-

count opened in your name must get your approval. In other words,

you are the one who decides what accounts can be opened in your

name, rather than a creditor or lender making that decision.

Most businesses will not open credit accounts without rst checking a

consumer’s credit history through a credit report. Even someone who

has your name and Social Security number might not be able to get

credit in your name if your credit reports are frozen. You can freeze

your credit reports at no cost.

While a credit freeze can help protect against identity theft, it may

not be for everyone. If you plan to apply for a credit card or to rent

an apartment in the near future, it’s likely that your credit report will

need to be accessed and you will need to lift the freeze (this also called

a “thaw”).

You can also freeze the credit of a minor dependent, which can

help protect them against fraud and identity theft.

In 2012 Maryland became the rst state in the nation to give parents

or guardians the ability to freeze a child’s credit report so that the

child is not victimized before they turn 18. When parents or guard-

ians take advantage of this opportunity, they can ensure a child will

begin their adult life with a clear credit history. is law extends pro-

tection to other consumers who meet certain eligibility requirements.

Contact the Attorney General’s Identity eft Unit at 410-576-6491

to nd out who may be eligible for this protection.

To place a credit freeze for your child, a parent or guardian must sub-

mit this information to the addresses listed below:

• e requestor’s complete name, address, and any of the fol-

lowing: a copy of a Social Security card, an ocial copy of

a birth certicate, a copy of a driver’s license or any other

government-issued identication, or a copy of a utility bill

that shows the requestor’s name and home address; AND

• e child’s complete name, address, and any one of the forms

of identication listed above.

Experian Security Freeze, P.O. Box 9554, Allen, TX 75013

Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348

TransUnion LLC, P.O. Box 2000, Chester, PA 19022

I Think My Identity Has Been Stolen—

What Can I Do?

If any of the following have happened, you may be a victim of iden-

tity theft:

• Your bank or credit card statements never arrive in the mail;

• You receive acknowledgments of new accounts opened that

you don’t recognize;

• You receive calls from collection agencies demanding payment

for accounts you never opened or purchases you never made;

• ere are mysterious charges on your credit card bill;

• Accounts that you didn’t open appear on your credit reports;

• ere are excessive credit inquiries or any unfamiliar activity

on your credit reports;

• You are denied credit or oered less favorable credit terms,

such as high interest rates; or

• Law enforcement has warrants for a crime committed in your

name.

Treat any unfamiliar activity in your account state-

ments, credit reports, or mail as suspicious. Don’t

assume the unfamiliar activity is an error and will go

away on its own.

Identity eft Recovery Steps

If you are—or think you may be—a victim of identity theft, follow

these six steps for the best chance of recovering your nancial standing.

Keep detailed records of your identity theft resolution

process. Disputing identity theft can take weeks or

months, and it’s easy to lose track of with whom you

spoke or what information they gave you.

Place a Fraud Alert on Your Credit Reports

(Please note: this is not the same thing as a “credit freeze”)

When you rst become aware that you may be the victim of iden-

tity theft, you should immediately place a fraud alert on your credit

report and request a copy of your credit report by calling one of the

three credit reporting agencies (see contact information, below).

Whichever agency you call is required by law to notify the other two.

A fraud alert lasts for one year, and can be renewed by calling any of

the credit reporting agencies. Review your credit report for any un-

usual activity, especially accounts in bad standing. Often your credit

report is the only way to detect accounts in your name that were

opened fraudulently.

Equifax

888-766-0008

www.alerts.equifax.com/AutoFraud_Online/jsp/fraudAlert.jsp

Experian

888-397-3742

www.experian.com/fraud/center.html

TransUnion

800-680-7289

www.transunion.com/personal-credit/credit-disputes/fraud-alerts.page

Report the Crime to Police

Report the crime to your local law enforcement agency.

Maryland law requires your local police to take a report

of identity theft and give you a copy regardless of where in the world

the crime occurred (Md. Code, Criminal Law, Article §8-304).

Get Free Credit Reports

A credit report includes some personal information

as well as your nancial history, such as whether you

pay your bills on time and if you have led for bankruptcy. Credit

reporting agencies sell the information in your report to creditors,

insurers, employers, and other businesses that use it to evaluate your

applications for credit, insurance, employment, or renting a home.

You may request a free copy of your credit report from each of the

three nationwide credit reporting agencies—Equifax, Experian and

TransUnion—once a year; Maryland residents may request one addi-

tional report each year at no cost. is is one of the easiest and most

eective ways to prevent identity theft.

ere are three ways to request your credit reports:

• Phone: 1-877-322-8228

• Online: www.annualcreditreport.com

• Mail: See attached form on page 21.

Note: rough April 2021, three nationwide credit reporting agen-

cies—Equifax, Experian and TransUnion—are oering free weekly

online credit reports. e free weekly credit reports are only available

through www.annualcreditreport.com.

Contact the Federal Trade Commission

Report the fraud to the Federal Trade Commission by

calling 1-877-438-4338 or go online to www.identi-

tytheft.gov. You can compile a record of what happened in a central

document, called an Identity eft Report, through this site. e

report can be useful when disputing fraudulent accounts or charges

(see the sample dispute letter on page 22).

Dispute Fraudulent Accounts

Many businesses have established policies and proce-

dures for dealing with identity theft victims. If you have

trouble closing fraudulent accounts, disputing charges on existing ac-

counts, or need sample dispute letters, contact the Attorney General’s

Identity eft Unit.

Write to collection agencies that are demanding payment and

inform them that you are a victim of fraud, and are not responsible

for the payments. Include a copy of your police report, an identity

theft adavit that you may have lled out, and any other support-

ing documents.

See page 22 for a sample dispute letter that you can use as a template.

Consider a Credit Freeze

(Please note: this is not the same thing as a “fraud alert”)

A credit freeze (sometimes called a security freeze) com-

pletely blocks the information on your credit report from would-be

creditors or lenders.

Most businesses will not open credit accounts without rst checking

a consumer’s credit history. Even someone who has your name and

Social Security number might not be able to get credit in your name

if your credit les are frozen. You can freeze and thaw your credit

reports at no cost.

If you decide to obtain a credit freeze, you will need to contact each

of the credit reporting agencies.

Equifax

• Phone: 1-888-298-0045

• Online: www.equifax.com/personal/credit-report-services

• Mail: Equifax Security Freeze, P.O. Box 105788, Atlanta, GA

30348

Experian

• Phone: 1-888-397-3742

• Online: www.experian.com/freeze/center.html

• Mail: Experian Security Freeze, P.O. Box 9554, Allen, TX

75013

TransUnion

• Phone: 1-888-909-8872

• Online: www.transunion.com/credit-freeze

• Mail: TransUnion LLC, P.O. Box 2000, Chester, PA 19022

If you are requesting a credit freeze by mail, you will need to include

all of this information:

• Your full name, address, Social Security number, and date of

birth;

• Prior addresses and proof of prior names, if you have moved

or had a name change in the past ve years;

• A copy of a government-issued ID card; and

• A copy of a bank statement or utility bill conrming your

current address.

Other Forms of Identity eft

ere are additional steps you can take to help recover if any of the

following forms of identity theft happen to you.

Tax Fraud

• Federal: Contact the Internal Revenue Service Identity Protec-

tion Specialized Unit at 1-800-908-4490.

• Maryland: Contact the Questionable Return Team at the

Maryland Oce of the Comptroller at 410-260-7449.

Student Loans

• Contact the school that opened the loan and explain that you

are a victim of identity theft. Ask to close the loan and follow

their instructions on what they will need from you to dispute

the loan.

• If the fraudulent loan is a federal student loan, contact the

U.S. Department of Education Oce of Inspector General

hotline at 1-800-MISUSED (1-800-647-8733) or the U.S.

Department of Education Federal Student Aid Ombudsman

at 1-877-557-2575.

Checking Accounts

• Order a free copy of your ChexSystems report, which com-

piles information about your checking accounts. To get your

ChexSystems report, call 1-800-428-9623.

• If someone is writing bad checks against your account, con-

tact your nancial institution. Report the stolen checks, close

your account, and ask your nancial institution to report the

fraud to the check verication system.

• Contact check verication companies Telecheck (1-800-

710-9898) and Certegy (1-800-237-3826). Report that your

checks were stolen and ask them to tell businesses to refuse

the stolen checks.

Tools

Additional Resources

Sample Dispute Letter

[Date]

[Your Name]

[Your Address]

[Your City, State, Zip Code]

[Name of Company]

[Fraud Department]

[Address]

[City, State, Zip Code]

[RE: Your Account Number (if known)]

Dear [Name of Company]:

I am a victim of identity theft. I recently learned that my personal

information was used to open an account at your company. I did not

open or authorize this account, and I request that it be closed imme-

diately. Please send me written conrmation that I am not responsible

for charges on this account, and take appropriate steps to remove

information about this account from my credit les.

I have enclosed a copy of my Identity eft Report and proof of my

identity. I also have enclosed a copy of my police report. When you

receive a request like this with an Identity eft Report, you must

stop reporting fraudulent debts to credit bureaus.

Please send me a letter explaining your ndings and actions.

Sincerely,

[Your Name]

Enclosures: [List what you are enclosing] • Identity eft Report • Proof

of Identity [a copy of your driver’s license or state ID] • Police Report

Identity Theft Prevention

Checklist

Check your credit report annually.

Consider placing a credit freeze for yourself and family

members.

Monitor nancial statements and health records for suspicious

activity.

Opt out of junk mail and pre-screened credit card oers.

Enroll in the Do Not Call Registry.

Keep sensitive documents in a locked, secure location.

Shred documents containing personal information that you no

longer need.

Be very suspicious of unexpected calls from someone demand-

ing money or personal information.

Don’t post information online that could help an imposter

steal your identity.

Keep your computer’s virus protection software up-to-date.

Notes