Identity Theft Poses Extra Troubles for Children

Appeared in the New York Times on April 17, 2015

By RON LIEBER

The note that arrived in the mail, dated March 25 and addressed to my grade-school-age daughter, said what we had expected and feared: Like tens of millions of other Americans, including untold numbers of children, she may have fallen victim to thieves who gained access to Social Security numbers and other personal data from the health insurance giant Anthem.

In three single-spaced pages, it noted that anyone who had dealt with the company and many Blue Cross and Blue Shield insurance plans over the last decade could be vulnerable. The letter pointed us to anthemfacts.com for more information, which it described as “our source of truth.”

Here’s what the note did not fully address, however: What are the odds that someone will steal a child’s identity? Why would a thief do that, and what exactly can parents do to keep it from happening?

I know better than to overreact to this sort of thing. Thieves have to get the data, choose to use it (instead of chickening out), pick yours to use in nefarious ways and then do so successfully before any damage to a child’s credit record can occur. Still, a 2011 joint industry-academic examination of 40,000 children caught up in a data breach found that someone else appeared to be using 10.2 percent of their Social Security numbers. Most of those instances happened before the breach in question.

Freezing a Child’s Credit

Nineteen states require credit reporting agencies to allow a parent or guardian to freeze their child’s credit file, which helps prevent identity theft.

So crime like this does happen, and here’s why: Children’s credit reports are clean. That’s attractive to people who want to begin their financial lives anew for any number of reasons. Plus, minors don’t check their credit reports or review monthly bills the way grown-ups do, which means thieves may not get caught for years or even decades.

One way that people can protect themselves from many kinds of identity theft is to put a freeze on their credit reports with Equifax, Experian and TransUnion, the three agencies that make a lot of money tracking our financial histories and selling that information to companies we want to do business with.

A credit freeze is more stringent than the more popular fraud alerts that many consumers have used in the past. Putting your reports on ice means that any new creditor trying to open an account in your name won’t have access to your credit report unless you go into the system and thaw it. Without seeing your credit report, companies that you are not already patronizing generally won’t open a new account in your name, so the freeze usually has the effect of thwarting thieves.

The problem with the freeze, however, is that you need to have a credit report in the first place before you can put it in cold storage. Because most children don’t, it’s usually been nearly impossible to freeze a child’s credit file.

In the last few years, though, that’s been changing. According to Heather Morton, a program principal with the National Conference of State Legislatures, 19 states now require the credit agencies to help parents and guardians create a new credit report for a minor child for the express purpose of immediately freezing it. Those states are Arizona, Delaware, Florida, Georgia, Illinois, Indiana, Iowa, Louisiana, Maryland, Michigan, Montana, Nebraska, New York, Oregon, South Carolina, Texas, Utah, Virginia and Wisconsin.

Last month, Representative Jim Langevin, Democrat of Rhode Island, introduced legislation that would force the credit bureaus to let all of us do this. Equifax claims that it already lets any parent set up a freeze for a child in the other 31 states. Experian and TransUnion do not, though TransUnion, on its website, has a form that parents can complete so the company can check to see if there are any existing credit files under a child’s Social Security number.

The bureaus aren’t big fans of freezes, because they’re an administrative annoyance and they throw a giant roadblock in their business of peddling our information. Equifax, on its website, introduces freezes as something a consumer does after being victimized, as if we’d all want to wait until the burglar has left the premises to hire a security guard. TransUnion deserves credit for at least mentioning that children may be able to get one. All of them, however, worry about creating vulnerabilities where there were none by creating a credit file that did not previously exist.

Still, if you try to set one up for your child, you’re in for a battle. The agencies want reams of information, including copies of your child’s birth certificate and Social Security number plus certain bills that prove where you live. Equifax and TransUnion ask you to put all of this private information in an envelope and drop it into a mailbox. Even worse, two Equifax customer service representatives I spoke to this week insisted that I should put “minor child” at the top of the address. It might as well say, “Steal this envelope!”

I’m doing it anyway (though without saying, “Steal Me”), if only to annoy the agencies that so clearly do not want me to do this.

Freezes won’t stop every kind of theft, alas. Thieves sometimes use children’s Social Security numbers and other data to file fake tax returns and get illegitimate refunds, gain access to health care and work legally even if they are not citizens. In each of those instances, there may never be a credit check that reveals the freeze.

So what are the ways to keep private data private that are within our control? Don’t carry around Social Security cards. Keep them under lock and key at home. Keep your child’s date of birth off social media. Talk to your offspring about where to click and not to click on websites and in incoming email. Question school officials and doctors who want children’s Social Security numbers for forms, as it may not truly be necessary.

Also, keep your voice down at the pharmacy and physician’s office.

Robert P. Chappell Jr., author of “Child Identity Theft: What Every Parent Needs To Know,” sometimes jots down names, insurance information and other bits and pieces as he listens in those places and then approaches people afterward to gently correct their data hygiene. So far, nobody has punched him in the nose. “Most of them are very nice and have no idea about the harm that can come from it,” said Mr. Chappell, who works in law enforcement by day. “Usually, I’m in civilian clothes.”

One problem with the various legislative efforts to fix the problem is that they won’t do much about the many situations where it’s the children’s own parents who commit the identity fraud. Mothers and fathers may do this out of desperation, having already wrecked their own credit or experienced some acute financial calamity. Foster children are frequent identity theft victims, too. Whatever the reason for the crime, these parents aren’t about to freeze their children’s files.

So what could stop them? One possibility exists only in theory, and it’s called the 17-10 registry. The idea here is that when children are born, their Social Security numbers automatically go into a “do not break the glass until two months before age 18” database. Parents could be prohibited from opting out of the database for their children, and credit reporting agencies (and employers and the Internal Revenue Service) would hopefully crosscheck it before letting anyone use any Social Security number. TransUnion is experimenting with its own database that families in Utah can put their children in.

My daughter seems unscathed so far, and we are signing up for the free monitoring service that Anthem is making available for two years. But Adam Levin, the founder or co-founder of two credit- and identity-related businesses and the author of a book scheduled for release in November called “Swiped: What Identity Thieves Do and How to Stop Them,” questioned why the free service ought to halt then, even if Anthem is paying for a longer period than other breached organizations have in the past.

“Social Security numbers are like money in the bank, and thieves don’t need to use them at any specific moment in history,” he said. “You’re going to have to look over your shoulder for the rest of your life.”

Then again, you’re probably already doing that. The companies we pay and the governmental agencies that keep track of us have proved with startling consistency that they are not up to the task of keeping our data safe. Then, they compound that by dragging their feet when tools emerge that allow us to flip a switch and try to contain the damage.

Until that changes, you’re more or less on your own. But you already knew that, right?