Don't ignore signs of possible child identity theft

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.mcall.com/news/local/watchdog/mc-child-identity-theft-watchdog-20130914,0,5872953,full.column

Kids sure grow up fast these days. My 12-year-old son just started seventh 
grade. Days later he got his AARP card.

"Your membership has been reserved and is awaiting activation," AARP told 
him in a letter.

This was the second goofy solicitation my son had received in a few weeks. 
The first was from our health insurance offering him a Medicare planner.

I blew off that letter as a fluke, but when it was followed by the AARP 
card, I wondered if my son was getting on mailing lists because someone had 
stolen his identity and was applying for stuff — like credit cards — in his 
name.


Child identity theft isn't something that probably crosses the minds of 
most parents. But it happens, as children are attractive targets for 
identity thieves. A 2011 study by Carnegie Mellon University's CyLab found 
children were victimized at a higher rate than adults.

"Identity thieves know kids have clean credit, so if they're stealing a 
child's credit, they're getting a clean credit to use," said Lisa 
Schifferle, an attorney at the Federal Trade Commission.

That makes them appealing to even family members who can't qualify for 
credit on their own, said Peter Schoenrock, a senior vice president at 
Equifax Personal Solutions.

A study last year by Javelin Strategy & Research found 2.5 percent of U.S. 
households with children under age 18 experienced child identity theft.

A study by ID Analytics in 2011 found that 140,000 children are victims of 
identity theft annually.

Experts say the crime is underreported because children don't use credit 
and the problem may not come to light immediately. If it's not corrected, 
it can keep your son or daughter from getting a job, financial aid or car 
loan.

As with most identity theft, getting a child's Social Security number is 
the key to stealing their identity. So protect that number.

There are several signs your child's identity may have been stolen, 
including inappropriate mail for their age like the offers my son received. 
That also could include notices from the Internal Revenue Service about 
unpaid taxes, bills, or credit card applications.

"If you get something suspicious, don't ignore it," said Schoenrock, a 
Lehigh University graduate.

I didn't.

I called my insurance company, Highmark, to ask why it thought my son was 
my father's age.

I had to talk to four people but eventually got the answer. Highmark had 
his birth date entered incorrectly, which triggered the Medicare mailing. A 
representative fixed it, and another representative removed him from the 
mailing list.

AARP said it also would pull my son's name from the system. A rep told me 
AARP uses third-party mailing lists and that's likely how it got his 
information. I'm assuming there's a connection with Highmark. But I also 
wonder what other lists my son is on and what other kind of mail he'll be 
getting.

She also mentioned that she could relate to my experience, as she had 
received a solicitation from AARP when she was 14.

My concern about child identity theft was a false alarm, but you can't be 
too careful.

In addition to suspicious mail and phone calls, watch for problems when 
opening financial accounts or applying for government benefits or financial 
aid for your kids. If someone already has opened an account or is 
collecting benefits with their Social Security number, you may be denied.

If you discover someone has stolen your child's identity, deal with it 
promptly.

Schifferle said it can be easier to repair a child's false credit history 
than an adult's because all it should take is proof that your child is not 
of legal age to sign a contract with a creditor. Schoenrock suggests also 
calling police, as having a police report will help the process.

If you want to know if someone has used your child's identity to obtain 
credit, the best way is to check if your child has a credit history with 
the major credit bureaus, Experian Equifax and TransUnion.

They don't knowingly keep files on minor children. So you can't request a 
credit report through http://www.annualcreditreport.com, the government 
site that provides free reports. You must contact the bureaus and ask them 
to check if your child has a file. You may have to do that in writing and 
will have to provide personal information about your child and about 
yourself to prove your relationship.

Schifferle said it's not necessary for parents to check often unless there 
is evidence of a problem. She suggests checking when children are around 
age 16.

The best way to protect your child is to not give people access to their 
information, especially their Social Security number. That means asking why 
their pediatrician, school, after-school program or other organization 
wants it. Remember, the purpose of Social Security numbers is for tax 
purposes. They weren't intended to be used as a unique identifier in other 
situations, though that's often what happens.

"The doctor does not need to know that," Schoenrock said. "They are not 
reporting income. They are not reporting wages. They have no need for that."

Teach your children to keep their information private. As they get older 
and join social media, who knows what they may be prompted to disclose. 
Teach them to set up passwords on their computers and devices and to change 
them regularly.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

# OWASP http://www.appsecusa.org
# Builders, Breakers and Defenders
# Time Square, NYC 20-21 Nov
o()xxxx[{::::::::::::::::::::::::::::::::::::::::>

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security offers security intelligence, risk management services and customized security solutions. The 
YourCISO portal gives decision makers access to tools for evaluating their security posture and prioritizing risk 
mitigation strategies. Cyber Risk Analytics offers actionable threat information and breach analysis.