Identities for Sale
When Fran Langton* bought a Nissan from a Baltimore area dealership, and arranged a car loan to pay for it, everything seemed to go smoothly. But six months later she received a call from the Detroit police: her Nissan auto financing paperwork — complete with Social Security number, bank account numbers, credit card numbers and date of birth — had turned up halfway across the nation in the hands of a busted fraud ring.
It was then that Langton received a crash course in identity theft, learning that the thieves had used her name to purchase a pricey Dell computer, open multiple credit cards and accrue thousands of dollars in cellular phone bills. She wasn't held responsible for the bills, but the resulting damage took up over 100 hours of Langton's time to sort out the problem. Even now, four years later, she occasionally gets bills from an account opened by the identity thief.
"I was actually very lucky," says Langton. "Most (identity theft victims) don't find out about it until much later. It could have been much worse." Indeed, the average identity theft victim spends 600 hours recovering from the crime with some needing as long as 10 years to clear their records, according to a study done in 2003 by California State University at Sacramento and the Identity Theft Resource Center of San Diego.
While the car dealership isn't the only place a consumer can fall victim to identity thieves, they are among the most common sites where the crimes occur. In fact, from the gas pump to the parking lot, the car can be a focal point for identity theft if you're not prepared.
"Identity thieves are like car thieves; they are highly opportunistic. If they have any difficulty in getting your info, they'll move on," says James Walsh, co-author of the book Identity Theft: How To Protect Your Name, Your Credit and Your Vital Information And What to Do When Someone Hijacks Any of These (Silver Lake Publishing, 2004). (To learn how to prevent identity theft, see "Tips to Prevent Identity Theft."
Not a Rare Occurrence
If you think identity theft won't happen to you, think again. A 2006 Gartner Research study showed that about 15 million Americans were identity theft victims.
"Information is the new currency; it has tremendous value," says Bruce Townsend, assistant deputy director at the U.S. Secret Service, the federal agency that investigates financial crimes, including identity theft. "There are people who pay thousands of dollars for this type of information."
The key to a successful identity theft is obtaining multiple forms of information from the same person. Hence, identity theft tends to show up in the buying, selling or maintaining a car because of the multiple forms of identification required to complete the process. Some of the most common scenarios involve car dealerships, while other situations involve individuals selling a vehicle in a private party sale. Some situations involve identifying information being stolen from a vehicle itself, when left in someone else's possession, such as a mechanic or a valet.
In one case in Florida, a salesman at a Chrysler dealer and his friend were arrested for using a customer's identifying information to get credit cards, purchase cell phones and to buy a new Mercedes-Benz in another state. The customer's information was stolen from his driver license and the car loan credit application he completed when he purchased a car at that dealership.
At a Lincoln-Mercury dealer in Montana, a salesman admitted to stealing identifying information from a customer's credit report. The salesman had called American Express and got a card issued in his own name. He was caught, but not before ringing up over $6,000 in merchandise. This, however, was not the first time the salesman had committed identity theft. When he was caught, authorities learned that he was also wanted for a similar case in Texas where he had obtained credit cards and fraudulently charged over $100,000 while living in that state.
Other opportunities for ID theft around the car range from having your wallet stolen from your vehicle or even being snookered at the gas station.
In one case in California, a crime ring installed skimming devices in the card readers at gas pumps. When a customer used a credit card at the pump, an error message instructed the person to go inside to the cashier. While it appeared the card reader wasn't working, it was actually capturing personal information from every customer.
Once credit card data is obtained, identity thieves work to match it with other identifying data. This can include stealing your mail or your wallet, going through your trash at your home or work or scamming you over the telephone.
"Using this method, many people will get one piece of information stolen, like a credit card, but only a small number of those people will become victims of identity theft because the thieves are able to obtain some other information on them," explains Walsh.
Dealers Can Get Burned, Too
While there have been many stories in the news about crooked employees hurting customers, the car dealerships have been scammed as well.
"In many cases, (the identity thieves) buy or lease the car, then alter the paperwork so it looks like they own it," Walsh notes. "Then they sell it in a private party sale." Because the identity thief bought or leased the car on someone else's credit, it is essentially a stolen car and the innocent buyer who purchased it from the identity thief will most likely have to surrender it. "So now you've got two innocent people involved — the identity theft victim and the person who bought the car," says Walsh.
Some identity theft scenarios get even stickier.
"There is a cloud of other illegal transactions that generally surround identity theft," says Walsh. "Illegal drug use and sales [are] especially prevalent." As a result, a person whose identity was stolen could conceivably find that a car he "owned" was involved in a crime or that he has been arrested for a crime he did not commit.
Townsend has worked on many cases in which identity thieves purchased cars using the identities they'd stolen. Sometimes car salespeople are so eager to make the sale that they overlook suspicious information. "Many times we've seen where the desire to get the sale means (the dealer) doesn't put the pieces of the puzzle together," he says. "A dealership has a clear responsibility to exercise due diligence, both in the oversight of the sale as well as in an employee's access to data."
When You Need to Provide Personal Information
When car shopping, a dealer will often want to see your driver license, and perhaps even proof of insurance, before allowing a test-drive. Some dealers will even want to make a copy of these documents.
"Once the test-drive is over, ask for the copy back," advises Walsh. "While there's nothing to prevent them from making more than one copy, this will at least prevent one copy from floating around at the dealership or being thrown away without being shredded."
Until recently, some states automatically used Social Security numbers as the driver's identification number on the face of the license. Today, many of those states offer the driver the choice of using his Social Security number or being assigned another number.
"If you have your Social Security number on your driver license, get it changed right away," advises Linda Foley, co-executive director of the Identity Theft Resource Center in San Diego.
Beyond driver license and insurance information, a dealer generally doesn't need any other information unless you are arranging auto financing at the dealer. A finance application will require a Social Security number, as well as bank accounts and credit cards.
Even paying cash for a car won't completely eliminate the need for providing identifying information. Dealers are required by law to complete IRS Form 8300, which includes the buyer's Social Security number, when there is any purchase involving $10,000 or more in cash.
If You're Concerned, Just Ask
Regardless of the company or situation, experts suggest asking if the need for personal financial information is really necessary before providing it. If it is, then consumers may want to ask further questions before deciding whether to do business with the company.
Foley advises consumers to ask:
- How will this information be used?
- Where is this document going to be stored?
- When and how will you dispose of it?
- Will this information be entered electronically? If so, is it in an encrypted file? How and when will you destroy the electronic version?
- Review your bank and credit card statements monthly for signs of suspicious activity.
- Secure personal information in your home and in your workplace. Do not leave personal information in your car.
- Remove your Social Security number from any identification you carry, such as checks, a driver license or your health insurance card. Both your health insurance company and the Department of Motor Vehicles will give you a new number if you request it.
- Before providing identifying information, especially your Social Security number, ask if the information is required.
- Never give out personal information to someone who contacts you by phone or via e-mail, even if it seems legitimate. Call the company back using a phone number from a bill (not a phone number the person who is calling gives you) or go to the home page of the company's Web site by typing the URL into your browser (not by following a link in an e-mail.)
- Add passwords to your credit card, bank and telephone accounts that are not the typical passwords, such as the last four digits of your Social Security number, your birth date or your mother's maiden name. If you are opening a new account that requests your mother's maiden name, use a password instead.
- Destroy all credit card offers as well as mail with personal information using a crosscut shredder, which cuts paper into confetti-like pieces instead of strips.
- Check your credit reports from the three major credit bureaus, Equifax, Experian and TransUnion, at least twice a year and correct any inaccuracies.
- Consider "freezing" your credit with the credit bureaus. "Frozen" credit blocks all access to your credit reports until you personally "thaw" your file by providing a security code to the credit bureau and telling them the company that will be calling. You can also thaw your file for a period of time, such as for a week of shopping for a car.
Unfortunately, it is up to the victim of identity theft to clear up his name and credit on his own. If it happens to you, the Federal Trade Commission suggests you take these steps:
- Call the toll-free fraud alert number at any of the three major credit bureaus and place a fraud alert on your credit report. The bureau will notify the other two bureaus automatically. (Fraud alert numbers: Equifax: 800-525-6285; Experian: 888-397-3742; TransUnion: 800-680-7289.)
- File a report with your local police department, even if you have no proof that the theft took place in your area.
- File a complaint with the Federal Trade Commission (FTC) on-line at http://www.ftc.gov/bcp/edu/microsites/idtheft/consumers/filing-a-report.html or by calling 877-ID-THEFT. The FTC will enter your information into a secure database that can help law enforcement locate the identity thieves.
- Review your credit report and all of your monthly account information to identify any accounts that have been tampered with or opened fraudulently.
- Contact each creditor directly to notify them of the situation and ask for the company's fraud dispute forms. Some companies will accept the ID Theft Affidavit for unauthorized accounts.