The phony company convinced three third-party processing firms it was a legitimate business that offered consumers a discount prescription card, according to the FTC complaint. The company created a Web site where it promised the card would be accepted by most major pharmacies, including those at Wal-Mart Stores and Target. It gave processors business references and a balance sheet. But, the FTC complaint added, "the processors did not initially ask for more information. Indeed, they did not even insist on complete application information." (processors involved, InterBill and Universal Processing Inc., Payment Resources Inc.)
Phishing: Don't Take the Bait: The latest ploy of ID thieves is to send consumers official-looking e-mail messages that appear to come from companies you've done business with. The e-mail messages request passwords and other personal data. The practice -- called "phishing" -- can dupe even savvy consumers. When in doubt, verify by phone or through the company's Web site that the e-mail is real.
• Buy a Shredder: This is one of the easiest ways to guard against "Dumpster diving," says Naomi Lefkovitz, an attorney for the FTC's identity theft program. Identity thieves prowl public dumps and big trash bins looking for sensitive documents like credit card statements. Many of those papers contain all the information a thief needs to hijack your identity.
• Get Your Credit Report: It's always a good time to get copies of your credit report from the three major credit bureaus -- Equifax, Experian and TransUnion. It won't protect you from theft, but it will let you spot suspicious activity taking place in your name. They normally charge around $10 for a copy, and consumers are encouraged obtain reports from all three bureaus; some deals offer reports from all three bureaus for a single price.
• Protect Your Social Security Number: The Social Security number has become a de facto customer ID, but most of the time you don't have to give it away. SSNs are like spun gold to identity thieves. The FTC's Lefkovitz advises consumers to ask companies that request an SSN why they need it. Retail stores, utility companies and insurers are among the sorts of companies that probably don't need your Social Security number -- even if they ask for it. The law doesn't prevent them from asking, but many will back down if you insist on keeping your number private.
• Make Sure Your SSN Isn't on Your Driver's License: State motor vehicle departments are required to collect Social Security numbers before they dole out driver's licenses or ID cards, but states are not required to display the number on license cards. In most states you can ask to be issued a unique driver's license number. A new Virginia law bans the practice of using Social Security numbers on licenses or ID cards. Maryland licenses don't use SSNs, and District resident are issued a random driver's license number unless they request otherwise.
• Keep Your Mother's Maiden Name Between You and Her: When a company asks for your mother's maiden name, what they really want is a password that only you know. Since your mother's maiden name is easily discovered, consider a different password.
• Talk to Your Boss: Some of the biggest sources of personal data are companies that fail to destroy sensitive documents or leave their computer systems unprotected. Ask your boss or human resources contact how they protect your information. Some states have laws requiring safe disposal of employee documents.
Practice Safe Computing: It's vitally important to inoculate your home computer against attacks and spying, especially if you trade music or other digital files online. Buy anti-virus software and keep it updated with the latest virus definitions. Also consider firewall software. See "A Cybersecurity Primer: Links and Resources for Computer Users" and The Washington Post's recent special report on safe computing.
If You Are Victimized
• Contact the fraud departments of the three big credit bureaus. They can place a fraud alert on your account and request that creditors call you before they open new accounts in your name. Ask for credit reports so you can track the abuse.
• Close or suspend your compromised accounts. Contact your credit card company and bank to report your ATM or credit card stolen. Have your bank stop payment on stolen checks and contact their check verification companies.
• File a police report detailing the fraud. Provide authorities with as much documentation as possible, and be persistent. Some credit bureaus will only block fraudulent accounts on your card if you have filed a report.
• Complain to the FTC, which maintains a database of ID theft cases for federal investigators.
New Tools for Fighting ID Theft
President Bush signed legislation on Dec. 4, 2003, giving consumers new ways to protect their identities. The new law:
• Gives every consumer the right to request a free credit report every year.
• Makes it easier for consumers to report identity theft with one phone call. Credit card companies and credit bureaus are required to participate in a national ID theft alert system.