Grand Theft Identity

Millions of Americans now have a new reason to dread the mailbox. In addition to the tried-and-true collection of Letters You Never Want to See--the tax audit, the high cholesterol reading, the college rejection letter--there is now the missive that reveals you are on the fast track to becoming a victim of identify theft. Someone may have taken possession of your credit-card info, Social Security number, bank account or other personal data that would enable him or her to go on a permanent shopping spree--leaving you to deal with the financial, legal and psychic bills.

Deborah Platt Majoras got the pain letter last week, from DSW Shoe Warehouse. Hers was among more than a million credit-card numbers that the merchant stored in an ill-protected database. So when hackers busted in, they got the information to buy stuff in her name--and 1.4 million other people's names. "It's scary," she says. "Part of it is the uncertainty that comes with it, not knowing whether sometime in the next year my credit-card number will be abused." Now she must take steps to protect herself, including re-examining charges closely, requesting a credit report and contacting the Federal Trade Commission to put her complaint into its extensive ID-theft database. The latter step should be easy for her, since Majoras is the FTC chairman.

Somewhere, Willie Sutton is smiling. Sutton was the sly swindler who, when asked why he robbed banks, was said to reply, "Because that's where the money is." Today the easy money is still in banks--databanks: vast electronic caches in computers, hard disks and backup tapes that store our names, Social Security numbers, credit-card records, financial files and other records. That information can be turned into cash; thieves can quickly sell it to "fraudsters" who will use it to impersonate others. They visit porn sites, buy stereo systems, purchase cars, take out mortgages and generally destroy the credit ratings of innocent victims, who may be unable to get new jobs, buy houses or even get passports until the matter is painstakingly resolved. And since the crime is all done remotely, modern ID thieves suffer little of the risk that Sutton shouldered a half century ago when he robbed banks with a machine gun.

We've become accustomed to the digital grease that smooths transactions, loans and eBay bids, but worries about identity theft quietly shadow us, often leading us to restrict our activities and be extra careful with our credit cards and personal information. In recent weeks, though, there's been something different, a cascade of reports about big break-ins and bungles where the booty is our secrets. Suddenly things seem out of control: instead of losing our identities one by one, we're seeing criminals grabbing them in massive chunks--literally millions at a time. "It only makes sense that criminals would go where information is collected," says Martha Stansell-Gamm, head of the DOJ's computer-crime division. The biggest heist of all may have been the one revealed last week, where an Atlanta-based company called CardSystems was lax in protecting the credit cards from transactions it processed. As a result, a possible 40 million Discover, Visa, MasterCard and American Express numbers (along with the secret code numbers printed on the actual cards, which makes it easier to counterfeit new versions) were exposed to hackers who have already begun the process of turning the digits into cash and prizes.

"Over the last nine years, criminals have gotten a better understanding of the power of information," says Rob Douglas of PrivacyToday, a security consulting firm. "Instead of selling drugs, so much can be made so quickly with identify theft, and the likelihood of getting caught is almost nil." The Department of Justice has reprioritized to fight the plague, but it's a big challenge; Avivah Litan of research firm Gartner Group speculates that fewer than 1 in 700 identity crimes leads to a conviction. This goes a long way toward explaining why it's the fastest-growing crime of this century. Chairman Majoras, now suffering anxiety simply because she bought some shoes, has testified before Congress that crooks rack up $53 billion a year in ID theft. Consumers are stuck with $5 billion directly, but the rest of it is mainly paid by retailers and businesses--which pass it back to us in higher prices.

Losing your credit card can be a huge hassle, but the law limits losses. In more distressing forms of ID theft, someone swipes not just your card but also your entire financial persona. Jamie Llanes, a 28-year-old mother of six in Chetek, Wis., has been living a nightmare since last September, when she was turned down for a loan because of a "substantial address difference" in her file--namely, a house in her name in Rialto, Calif., a state she had never set foot in. She also discovered that her doppelgnger had taken out an $8,700 car loan, and paid it back "to make my credit boost up so they could buy the home." Meanwhile, Llanes can't even get approved for a Victoria's Secret card, and the local police won't help her.