Editor’s note: This commentary is by Mary Peterson, who is an attorney with the law firm Rath, Young & Pignatelli in Montpelier. In addition to private practice, she has served as commissioner at the Vermont Department of Taxes, on the Way & Means Committee of the Vermont House of Representatives, and as a local official.
Nearly half of all Americans had their personal information exposed through the breach at the giant credit bureau Equifax. This is just the latest major breach, and drives home that quite possibly your personal information is available for sale on the illegal market. It is potentially overwhelming, but there are practical steps to protect against identity theft.
There are three immediate risks – that thieves will use your credentials to open new loans, credit cards or other accounts; that they will commandeer your current accounts for fraudulent transactions; and that they will seek tax refunds in your name. The fourth risk is that scammers will use the publicity about the breach as a new opportunity to try to obtain your credentials.
To protect against new credit being taken out in your name, you need a good handle on your credit report. Credit reports are compiled by the three big credit bureaus, Equifax, Experian and TransUnion, who sell the information to entities who extend credit. It is important to know that you do not choose these companies, nor can you prevent them from gathering your information. But both federal and state laws do govern the bureaus and give you some rights.
Under federal law, you can request your credit report for free once annually from each company. Go to www.annualcreditreport.com. Under Vermont law you also can freeze your credit, which restricts the bureaus from giving your information to lenders. Practically speaking, no lender will issue credit without a report, so you have assurance that no rogue accounts are piling up charges. There is a small charge for placing a freeze, and you will need to protect the PIN that is your authentication tool to lift the freeze. Go to www.uvm.edu/consumer. When you do need credit, you will need to work with the lender to find out what bureau they use, and temporarily lift the freeze with your PIN. But the small extra cost and time associated with the freeze is balanced by the peace of mind in the interim.
Each of the bureaus offer an alternative to a freeze, generally called a “lock,” which may even be offered for free and with the promise of less hassle. These are not governed by the credit laws, so if you choose to go this route, you will need to carefully read the fine print to understand precisely what protection is being offered. Also, by agreeing to the service, you might be waiving rights in the event of a later dispute with the bureau.
Neither a freeze nor lock will prevent thieves from potentially wreaking havoc on existing accounts accessed through your credentials. To avoid such a hijacking, be sure that you take advantage of any heightened fraud protections offered by your current lenders. Most importantly, establish a regular routine to look at the activity on your credit cards, bank accounts and retirement accounts. Set up online accounts with strong and unique passwords (consider a password manager program). Opt-in for two factor authentications and each time you log in you will provide a unique identifier sent to your phone. Then at least weekly go online to review activity.
Folks may think they can avoid identity theft with paper transactions. In fact, a check displays quite a bit of personal information that will be touched by quite a few hands. And as noted, companies compile information on you that is subject to breach regardless of your actions, and thieves can then simply open the online accounts that you avoided. Your own online accounts give you a real-time window into any such suspicious activity.
There are entire criminal enterprises built around using stolen identities to claim fraudulent tax refunds. If such a refund is claimed in your name you are still entitled to your legitimate refund, however there will be a delay, since the IRS or tax department now will need extra information to establish that you are in fact you. Your best bet to avoid a delay is to file your taxes as soon as you can, to beat any thieves to the punch. If you are a wage earner, your employer is required to provide your W-2 by Feb. 1, so have all your other records assembled at the start of the year to file as soon as it comes.
Also, keep in mind that the amount that is withheld from your paycheck over the course of a year is partly your choice. You may have forgotten the W-4 that you filled out for your employer where you specified a number representing allowances that determines how much is taken from your paycheck to cover your expected taxes. A large refund means that you claimed too few allowances and paid too much tax over the year. You essentially made an interest free loan to the government. Periodically, and whenever your circumstances change, file a new W-4 with HR. An ideal situation is when you enjoy your true income as you earn it with just a modest refund at tax time.
Scammers swoop in to compound the chaos caused by data breaches. Do not give your personal information on a telephone call that you were not expecting and did not initiate. Likewise, beware clicking through to websites from emails. If you absolutely cannot access something on the web through an address that you enter, scrutinize both the email and the site for signs that it is a copycat.
Know your rights if collection is being demanded on fraudulent charges. In most instances you are shielded from responsibility if you acted with reasonable care. If you are a victim, you can go to www.identitytheft.gov for a roadmap on exactly how to address the situation.
These are some small steps that you can take to avoid or lessen the threats of identity theft. In time, technology may offer better security, through biometrics or other advances. In the meantime, do not be overwhelmed into inaction. Follow the advice of Calvin Coolidge, “We cannot do everything at once, but we can do something at once.”