With the COVID-19 pandemic driving a significant economic downturn, people across the country are turning their focus to their personal finances – shoring up liquidity, managing pensions, and seeking out the best ways to protect assets.
Further, a critical element of financial wellbeing is security – protecting yourself from cyber-criminals who can hack and drain accounts, steal identities and generally make life exceedingly difficult.
Of course, all these activities are important outside a national emergency, as we have seen with past significant data breaches, like the Equifax breach of 2017.
How to protect your identity
According to Bloomberg.com, credit card numbers sell for about $10-$20 on the dark web, the collection of internet forums and fronts where cyber-criminals hang out to trade tricks of the trade. And an underground hacker market is selling dossiers of identities — social security numbers, addresses and other pertinent details — beginning at $10.
So what is the best identity theft protection?
Data breach victims can take action to protect themselves from the unsavory results of consumer identity theft. There are four key strategies, each with steps: 1) Pay for protection; 2) Avoid the spate of scams the Equifax breach has spawned; 3) Establish a personal credit monitoring plan; and 4) File your taxes as soon as possible each year.
We’ll review each in detail using the Equifax breach as an example.
1. Pay for Protection
Following the Equifax breach, most identity theft experts cautioned that every American should just behave as if their data was stolen and freeze their credit.
Equifax offered those who may have been exposed their credit alert service free for a year along with foregoing its normal credit freeze fees.
To most credit protection and financial experts, freezing credit offers the best identity theft protection, but the credit bureaus may try to offer you something else. Finance columnist Teresa Dixon Murray on Cleveland.com cautioned consumers not to be bullied: “Don’t be scared into not freezing your credit. For example, TransUnion is working hard to discourage credit freezes. If you contact them online or by phone, TransUnion will try to convince you to ‘lock’ your credit instead of freezing it. They gush that it’s free and easy, while cautioning that freezes can be a hassle and cost money. I think all of the bureaus may start pushing some kind of ‘lock’ instead of a freeze because freezes are regulated by law, locks aren’t. Plus, if you’re file is frozen, the bureaus won’t be able to sell your information to creditors and other companies for those pre-screened credit offers and other marketing purposes. If you want to freeze your credit, then do it. Don’t be talked out it by a pushy credit bureau.”
2. Guard Against Scams
Equifax victims not only wonder about the long-term effects and costs of protecting their personal information that may have been stolen, and could be sold at any point in the future, but they need to watch out for scam artists taking advantage of the confusion. It also doesn’t help that Equifax pushed out a spoof scam site via their own social media channels. There are several types of scams that target consumers:
Email Scams: Any links sent via email or social media that claim to help figure out whether your social security number was compromised in the Equifax breach is a hoax. It’s low-hanging fruit for data theft rings, but people are trying it. MoneyWatch cautioned that the more information a thief has about you, the more sophisticated the email phishing scam becomes. If you download malware that copies the keystrokes you use to log into your retirement account, they could attempt to steal the funds.
Telephone Calls from Equifax: Someone pretending to be from Equifax or a third-party could call to verify your information. Don’t verify it. They may also claim they are calling to fix a problem with your credit. Get a name and a case number, and call back the official Equifax or credit monitoring company offering assistance.
Typo Scams: Typosquatting is when a Web address or telephone number is similar to the real McCoy, but it’s actually a scam. Look closely, is the URL spelled “Eq1fax,” or does it go to a country Web extension like, .uk, instead of .com? Don’t just judge by the website appearance – identity thieves can recreate very official-looking websites. Just ask Bank of America, it’s still dealing with an email phishing scam that brings their customers to a fake website log-in.
3. Develop a Credit Monitoring Plan
The best identity theft protection for security breach victims might be the victims themselves. Consumers do have cost-effective resources – the federal government, their creditors and the credit bureaus themselves.
Freeze Credit: Paying for credit protection to Experian, TransUnion and Equifax in the form of freezing your credit, as well as unfreezing and then refreezing it when you actually need your credit, discussed above, seems to be all the credit and security experts’ best identity theft protection method.
Stagger Official Free Credit Reports Every 120 Days: Brian Krebs, a journalist who investigates security issues, says anyone concerned about identity theft – second to pursuing credit security freezes at all the major credit bureaus – should periodically order a free copy of their credit report, but only at Annualcreditreport.com. All big three credit bureaus are mandated by law to each offer one free credit report per year to consumers through this website.
The best way to take advantage of this: Make a notation in your calendar to request a copy of your report every 120 days, to review the report and to report any inaccuracies or questionable entries when and if you spot them. Avoid other sites that offer supposedly free credit reports and then try to trick you into signing up for something else.
By staggering requests to each of the three credit agencies, a consumer can perform a comprehensive review of all lines of credit associated with their social security number. If you find something foreign on a credit report or an alert, call the creditor right away to register a fraud claim and continue to follow up with the company until the fraudulent item no longer appears on your credit report.
Learn more about how to use the Annualcreditreport.com government website on NerdWallet.
Note that most credit and security experts say this is the only place to get your official credit report from the three bureaus safely – never use a third party with a similar Web address advertising free credit reports, and never pay for a credit report.
Review Free Credit Monitoring Opportunities: In between, credit-monitoring programs can send alerts whenever your identity is used for credit that would trigger a credit check. It’s not just Equifax that is offering free credit monitoring, numerous other companies – from clothing retailers to health insurers – that have had data breaches are also offering free credit monitoring programs. Check the list on the California Attorney General’s website.
Opt Out of Consumer Credit & Insurance Offers: Krebs and other credit experts suggest opting out of credit and insurance offers. There are two options – opt out for five years or opt out permanently – at Optoutprescreen.com. Without these offers, the chances of your credit being tainted with goes down.
Shred any portion of these mailed offers that contain your personal information.
Check All Credit Card Statements Every Month: As part of the Equifax breach, more than 200,000 credit card numbers were also stolen, according to Krebs. Call credit card companies right away to flag fraudulent purchases you find on monthly statements, reissue a credit card account number and file a fraud claim. Continue to follow up to make sure the fraudulent activity does not appear on your credit history.
4. File Taxes Early
In the last few years, there has been a rise in the number of fraudulent tax returns filed. The person who uses your stolen identity to get a refund check from the Internal Revenue Service in your name may cash it before you have even made your annual appointment with a tax preparer.
All the experts, including CBSNews MoneyWatch, recommend filing early. If an identity thief already filed taxes in your name, IRS will tell you that more than one return was filed in your name, that you owe additional tax or that IRS records indicate you earned more than the amount of wage you reported.
If you are a victim of tax fraud, MoneyWatch advises file a police report, a fraud report with the FTC Identity Theft Hotline at 877-438-4338, and complete IRS form 14039, the Identity Theft Affidavit. Consumers can also call the IRS Identity Protection Specialized Unit at 800-908-4490.
