TERENCE SMITH: Earlier this week federal officials announced that they had broken up the largest identity theft ring in history, more than 30,000 people allegedly victimized, losses totaling upwards of $2.7 million.
Three men have been arrested so far, charged with selling access to personal credit report information. U.S. Attorney James Comey explained how it worked during a press conference Tuesday.
JAMES COMEY: Once this credit information - and you have some idea -- if any of you have looked at your credit reports - what's on one of these printouts, but every credit card you have, every bank account you have, your mortgage, all of your loan transactions going back for years and years got in the hands of the criminals who were supplying the wish list. They were exploited in every way imaginable.
For example, bank accounts of victims were depleted, addresses were changed on accounts, new checks were ordered, new ATM cards were ordered, new credit cards were ordered, new lines of credit were opened and quickly drained.
Credit cards were used, of course, without authorization, and people would - criminals would assume the identity of victims and order merchandise to have shipped to different locations. In short, a lot of people ruined financially, their credit --were ruined financially by this scheme.
TERENCE SMITH: For more on the case and the problem of identity theft we're joined by Betsy Broder, assistant director of the Division of Planning & Information of the Federal Trade Commission, and by David Lazarus, a business columnist with the San Francisco Chronicle. He is the victim in a second case of identity theft. Welcome to you both.
Betsy Broder, when you look at this case, I mean, explain to us who did what in this particular case.
BETSY BRODER: A lot of merchants who do a lot of credit transactions, for example, car dealerships, have computer terminals with direct access to the credit reporting agencies, and these are all serviced by one company that's developed software with special, customized access. Someone who worked at the help desk at this company was able to get the passwords for these computers and was able to cull from these databases credit reports from 30,000 different individuals and then went forward and sold them to a bunch of, a ring of identity thieves.
TERENCE SMITH: And they in turn would -
BETSY BRODER: They would pass them on and sell them on to people, who would then use that information to open up credit accounts in people's names, to use existing accounts to purchase products and services, do any number of commercial transactions, all of them fraudulent.
TERENCE SMITH: And this is an example, maybe the biggest example, but an example of a growing and larger problem.
BETSY BRODER: Certainly the problem that we're becoming much more aware of, both as consumers, victims, and also on the part of law enforcement; greater attention is being given to the horrific crime of identity theft.
TERENCE SMITH: David Lazarus, you've not only written about this, you've experience it firsthand. Tell us what happened to you.
DAVID LAZARUS: Well, in my case, first of all, I never imagined I would be a victim, let alone a victim of something like this. What happened was I was refinancing the mortgage on my house and in that process my credit history came back after the bank called it up and there were just red flags all over the field.
There were numerous credit cards that I had never even seen before that had outstanding credit and as I tried to start picking this apart to see what happened, it turned out that there was some guy in New England, Connecticut specifically, who had my Social Security number for the last 10 years and had been running up bills on nine different credit cards; he'd been using my Social to get jobs.
And in this case his credit record and my credit record mysteriously merged together and created a fictional third party: Derek J. Lazarus was that person's name - with my Social Security number, my address, his birth date and all of his debt. And once that happened I had a major problem on my hands. And I had to start first of all digging myself out of the hole by getting this guy out of my life.
TERENCE SMITH: What did you do, and, first of all, on your own credit reports and credit ratings, were you able to correct it?
DAVID LAZARUS: Well, there's a whole series of hoops you have to jump through. People who are victimized by this will repeatedly say that this is the crime that victimizes you again and again. And I hate to say it, but it's true.
In my case the first job, as it is for most people, is a police report. You contact the fraud division of your local police department; you tell them what happened; you explain the problem; they take it all down, and then what happens, nothing. Typically, law enforcement is just completely overwhelmed. They can't handle this at all.
Betsy, I'm sure will tell you, that fewer than two percent of these cases really ever get prosecuted, but the fraud report is crucial in going after the creditors. They require the police report as the first step even talking to you about the problem and trying to get the other person's bills off of your credit history, and then you deal with each creditor one by one, and each has a hoop to jump through.
I had a couple who even hung up on me during this process because they thought I was asking too many questions. You also have to deal with the three major credit rating agencies: that's Equifax; Experian; and TransUnion, all of whom were - got their comeuppance in this identity theft thing that we're talking about now. They each also have hoops you have to go through, and you can't just talk to one because each one has their own credit history of you, which is different from the others.
And then insult to injury you have go to the next step. If a guy is using your Social for work, as he was in my case, there's tax implications; there's Social Security implications. You're talking to the IRS; you're talking to Social Security; and you might as well give the DMV a call because you never know what you're going to turn up there as well.
TERENCE SMITH: All right. We'll pick up your story in just a minute. But, Betsy Broder, does this sound familiar?
BETSY BRODER: It's a nightmare. It's a nightmare to anyone who has experienced it, and just as David was saying, it's - when you have your wallet stolen, someone knocks you on the head, steals your wallet, you know you're a victim of crime. But with identity theft you may go months or even years before you discover that someone else is using your name to run their lives.
TERENCE SMITH: And how widespread is it?
BETSY BRODER: Well, I can tell you this from the FTC's perspective: Last year, in 2001, we received 86,000 complaints on identity theft through our toll free hotline, and our Web site at consumer.gov/idtheft. This year, the first six months of 2002, we already have 70,000 complaints. Is that an indication of the growth of identity theft?
I think actually it's more an indication that people are aware that the Federal Trade Commission is the place to go if you're a victim of identity theft, because we can both steer consumers into the direction to clean up their credit histories, as David was describing, it can be an ordeal, but we also share this data with law enforcement. So they're more likely to focus on this crime when they see a cluster or a spike in certain types of incidents.
TERENCE SMITH: David Lazarus, has law enforcement, or have you had any luck in tracking this fellow down?
DAVID LAZARUS: Well, law enforcement hasn't been much of a help, but I figured, hey, I'm an investigative reporter, I have a lot of resources at my disposal, why not go for a little bit of pay back, and that's exactly what I did. I thought, I'll get into this guy's life, and I started investigating. The fellow's name - I hope he's watching - is Derek Davis - I'm coming after you fella - he lives in Connecticut. About 10 years ago, he got my Social Security number somehow. What I know about him is he came from Jamaica originally; he might be a citizen, he might not be.
I'm suspecting that because he got my Social he needed that to get into the American economy. He's probably not a citizen. He's been working a series of relatively menial jobs, the last job I could trace him to was a catering company in New Haven, where he was working as a waiter.
I've also found that he's been going to Indian casinos in New England passing bad checks. I've found his past addresses. I've found some of his past phone numbers, but I've hit a brick wall at this point; unless I go out there and actually start knocking on doors, this guy might slip right through my fingers, which would be a real shame.
TERENCE SMITH: And law enforcement has not been able to track him down.
DAVID LAZARUS: It's really difficult. I'm in San Francisco; I've filed a report locally. The law says that San Francisco police need to pass that along their counterparts over in New Haven. I'm sure they've done that, but those guys have their hands full. It's not like some little one-page police report being faxed to them from San Francisco suddenly moves to the top of the pile. And this was the case nationwide, as Betsy can tell you, so it's really - you can't really hold your breath waiting for law enforcement to weigh in.
And the few cases in fact where I've heard about victims of ID theft actually getting a little payback and, you know, a little bit of victory is when they did the work themselves. You shouldn't have to; this shouldn't be something that someone should have to go through, but what we've seen is if you serve it up to law enforcement on a silver platter, that's the only way these people ever end up in court.
TERENCE SMITH: Betsy Broder, is it - yours is not a law enforcement agency, obviously, but is it a big law enforcement problem?
BETSY BRODER: It's a big law enforcement problem. So while we have no criminal jurisdiction at the Federal Trade Commission, we're doing our part to support criminal enforcement on this side, so for example we do on-site training around the country to local law enforcement on how to understand identity theft, how to investigate it, and then how to serve it up on a silver platter to a prosecutor, so that includes both using our database and then tracking down the criminals.
TERENCE SMITH: Now, if I understand it, people who have charges run up on their credit cards are not necessarily liable for those, but what about those who have bank accounts invaded, actual moneys lost?
BETSY BRODER: There's a question about liability there, but I think what David was talking about, the problem here, is cleaning up your credit history and sometimes when you think that you have exercised all your rights under federal law to dispute erroneous charges, they come up again. They come up again because the debt has been sold to a third party debt collector, it's not your debt, you're not liable for it; and it gets reported on to your credit history, so it's a real revolving problem, as David says. It's kind of the Sword of Damocles up there. You just never know when it's going to strike.
TERENCE SMITH: Let me ask you both, since you both know this problem-- what businesses are doing to protect some of this information and what individuals can do. David Lazarus?
DAVID LAZARUS: Well, I think one of the shameful things we talk about here is the role of credit issuers in this equation. You would think that the credit card - would be the first line of defense - in trying to prevent this problem, in making it harder for ID thieves to move into your life. The reality is this is I think a $1.3 trillion industry, the amount of fraud that these credit companies need to eat is a miniscule, a small fraction of that amount. They're prepared to eat that loss to prevent new laws and new regulations from being implemented that would tighten their ability to hand out credit.
In other words, they are actually actively lobbying out there to prevent any sort of restrictions on the credit industry because they can take that pain. Now that's really bad and as we see in California, the car dealers lobbied aggressively recently to keep fraud alerts on one's credit file, which is something that you're told to, put a fraud alert on your file; if someone tries to do any sort of shenanigan, you're going to - they'll let you know.
It turns out, fraud alerts aren't even mandatory; the credit issuer doesn't need to follow it; they don't need to tell you; when in California legislators tried to make it mandatory for a credit issuer to let you know, the car dealers fought it because they see car dealing as an impulse buy and the last thing they want is to have any sort of barrier to people being able to plunk down money on a new car.
TERENCE SMITH: All right. Betsy Broder, I wonder what your comment is on that, and specifically also what people can do, if anything, to protect themselves from that.
BETSY BRODER: Well, I think this has been a real wake-up call to business that it's in their interest to ensure the security of the data that they safeguard for each of us and I think each and every one of us is going to be very much aware of how our banks, how creditors that we deal with are going to use our information, and this - I also want to say at the same time the Ford Motor Company, which is one of the companies that was used as a front for these kind of reports, did all the right things.
They came forward as soon as they became aware of this problem; they contacted law enforcement, and they figured out how to contact each of the consumers whose credit reports were being given to them. There are two issues here: one is, what can do businesses do to safeguard our data, and we're really looking closely as those practices there, but what can each of us do to make certain that our information doesn't fall into the wrong hands, and with that, the overall message is, be very, very careful with how you use your personally identifying information.
Only give out your Social Security number or credit card account number when you know who you're dealing with, and how they're going to use it; be careful of what you put out in the garbage, because every week you're going to be putting out documents that may be a gold mine for identity thieves, and buy a shredder. Shred those bank statements, those credit card statements, your health insurance forms, because they may have your Social Security number, and your date of birth, each of which are key pieces of information for identity thieves.
TERENCE SMITH: Good advice. Betsy Broder, David Lazarus, thank you both very much.