She was the perfect target. Elizabeth Knowles had an unblemished credit history and no permanent address. Her personal identity, not that it mattered, was that of a talented woman with an exciting musical career and a handsome fiance.
Her financial identity was that of a frequent traveler who used credit, debit and ATM cards all over the country. Last year her financial identity was stolen and used to run up more than $100,000 in fraudulent debt, one of 700,000 such cases of identity theft, the nation’s fastest-growing white-collar crime. Whoever did this to her–and she thinks she knows who it is–will almost certainly get away with it.
In April 2000, Knowles drove her blue Honda CR-V to her grandmother’s house in Lexington, Ky. She had finished a two-year tour playing Irish fiddle for the hit show “Riverdance” and was in the process of moving to Chicago. Every month or so for the last two years, she had stopped by her grandmother’s stone-and-wood house, the most permanent address she had, to check her mail and visit.
“I was kind of living nowhere. My boyfriend and I were gypsies,” said Knowles, who looks more Irish than she is.
In the stacks of mail her grandmother kept in laundry baskets, Knowles found an accumulation of bills and letters. Among them was a credit card statement from Sears announcing that Elizabeth Knowles owed $2,860 for purchases at a store in Las Vegas. The statement bespoke the kind of shopping spree one might commit with a pocketful of gambling winnings. Apparently, on March 12, 2000, she had binged her way through the store’s shoe department, denied her vagabond homelessness by filling her cart with towels and bathroom rugs, and rewarded herself with a diamond bracelet. The scenario made no sense. Knowles didn’t have a Sears credit card. Her only trip to Las Vegas had taken place four years earlier. She doesn’t even like diamonds.
At first, she wondered if the charges could have been made by a former boyfriend using one of their old joint accounts. Talking with him convinced her that this was not the case. Then she remembered having had a Sears charge account about 10 years earlier, when she graduated from college. “Anyone with a pulse could establish credit at Sears, at least that was the rumor,” she said.
So too, it appeared, could someone without a pulse. A fictitious Elizabeth Knowles, conjured from the real Elizabeth Knowles’ name, Social Security number and grandmother’s address, had apparently obtained “instant credit” from Sears and charged up a storm.
Knowles considered the bill a freak incident. Strong and steady by nature, she reported the mix-up by calling the 800 number to report credit fraud listed on the back of the statement and put the matter out of her mind. Three months later, the second wave of bogus billings reached her grandmother’s house. This time, Knowles was inundated with bills and overdue notices for phantom accounts totaling thousands of dollars. By the time it was over, the fictitious Elizabeth Knowles had charged more than $100,000 in a total of 14 fraudulent accounts.
The ease with which her financial identity was stolen was distressing enough; perhaps even worse was the difficulty of reclaiming it. Knowles’ experience is a case study in the bureaucratic hurdles and official indifference that confront a victim of identity theft. She would spend hundreds of dollars for certified mail, phone calls and faxes, and hundreds of hours in the quest to restore her good name. She remembers vividly the runaround she got from the people who controlled her credit history and the automated phone systems that shut her out.
“It became my part-time job,” she said. “If I had a normal job, I wouldn’t have been able to take care of this. It’s been more than a year now, and it’s still not over.”
In the Chicago area and nationally, complaints of identity theft have skyrocketed during the last year. Betsy Broder, who oversees identity-theft complaint reporting and public information for the Federal Trade Commission, attributes the phenomenon to increased public awareness of the FTC’s hot line (877-438-4338) as much as to more frequent incidents of the crime. Comparing April-June in 2000 with the same three months in 2001, she said, national reports of identity theft more than tripled, jumping from 4,499 to 17,111. In the Chicago area, complaints increased at nearly the same rate, from 90 to 267, during that period.
Just to find out what was happening to her, Knowles had to contact all three national credit-reporting agencies–Experian, Equifax and TransUnion–to get copies of her credit history. Each company has a different set of subscribers that both report and receive information on Americans’ credit habits. A subscriber may be a chain department store that issues its own credit cards or a small insurance company that employs two people.
Nine fraudulent accounts appeared on the first round of reports, each opened in the name of Elizabeth Knowles. The reports showed a list of former addresses, some in Kentucky and New York City, where Knowles had lived before joining “Riverdance,” and others in California and Nevada, where she had only visited.
The three credit-reporting agencies told Knowles to contact the stores and lenders that had approved the fraudulent credit. The accounts included two at Wells Fargo Financial totaling $5,100, another with Pier 1 for $950, two at Montgomery Ward totaling $2,500, one at American Express for $4,482 and one for $3,600 at Heilig-Meyers for the purchase of a sofa.
Knowles wrote a letter to each company on the list, summarizing the accounts and charges and explaining that that they were fraudulent. The companies, in turn, told her to submit a police report, but the Chicago Police Department did not, at that time, issue reports about identity-theft transactions that occurred outside its jurisdiction.
So Knowles went back to the companies, waited hours on the phone, and spent more hours filling out the forms and writing the affidavits they requested as proof of her identity. Each company seemed to want something different, such as a driver’s license and a utility bill, or maybe a Social Security card and a passport. Some wanted a document showing her signature written five times and notarized, plus an affidavit explaining where Knowles was on the night of March 12.
“Heilig-Meyers was the worst,” Knowles said. “They demanded a police report, my birth certificate, a letter saying I didn’t make the purchases, two forms of picture ID. I might as well have given them a blood sample. It took me a week and a half, spending an hour a day on the phone, before I finally talked to a human being. After a week of calling, I swear I got a janitor on the phone, because he didn’t have a clue what he was talking about.” Representatives of Heilig-Meyers, which has since closed all of its stores, could not be reached for comment.
Two eye-popping car loans sprang from an updated version of one credit report: $31,000 for a Dodge Durango purchased in Las Vegas and $35,000 for a Ford Explorer in California. She called First Entertainment Credit Union, the company that had lent money for the Durango, and waited on hold to speak with an agent.
“I finally got a woman on the phone and told her I hadn’t been to Vegas in recent years and had not bought the Durango. She said, `You mean you don’t have the car?’ And I said, `Yeah. I’ve just spent the last three hours trying to get you on the phone to tell you I love my Durango.’ I was horrified by her reaction. I didn’t own that car, I’ve never seen the car.” In fact, Knowles has never seen any piece of paper relating to the car or the loan except for the few lines of text on her credit reports. This would prove to be one of her most annoying and persistent fraudulent debts.
Knowles began to make some headway after she talked to Mike Denney, a former investigator of consumer affairs in Montgomery County, Md., and a friend of her fiance, Kieran O’Hare. Denney understood the legal responsibilities of the consumer, the credit grantors and the credit reporting agencies. He outlined a strategy and drafted letters that helped Knowles assert her rights. The credit reporting agencies were asked to place a “fraud alert” on Knowles’ accounts, which generated notices to companies to confirm her identity before granting credit in her name.
“At that point, everyone started to take my case a little more seriously,” Knowles said. Denney advised her that the credit reporting agencies are required by law to keep their records as accurate as possible and to investigate allegations of fraud. They usually must remove a disputed item from a file within 30 days after it is reported unless they can verify its accuracy.
They cannot, however, erase a debt. That is up to the creditor, who reviews its records of the disputed transaction and provides the credit reporting agencies with evidence of the debt.
“It’s like a tennis match,” said Eric Friedman, a lawyer who works with Denney. “The creditor might come back with a signed credit card application, and then it’s up to the consumer to prove that it’s not her signature. It goes back to the credit-reporting agency to determine whether the application’s signature is valid. Maybe the consumer can prove that she was out of the country the day it was signed. That’s why these things can take forever.”
The credit-reporting agencies determine whether disputed debts are legitimate, then issue a written report of the investigation and a revised credit report. If the agency cannot resolve the dispute, it must allow the consumer to explain her position, on the credit report, in 100 words or less.
By following Denney’s advice, Knowles was able to clear up several of the accounts. Denney insisted that creditors tell the reporting agencies the fraudulent claims were “filed by mistake” or “filed in error.” An item that is simply declared “satisfied,” he said, may not be taken off the report.
“He was the driving force in my case,” Knowles said, “and he has never taken a penny. If I had had to hire a lawyer, financially I couldn’t have done it.”
She was also able, with the help of an employee of Ford Motor Credit Co., to discover who stole her identity. The thief had, apparently, used Knowles’ Social Security number and her own driver’s license to buy the Explorer. Ford’s records included a photocopy of a driver’s license in the name of a woman who identified herself on the credit application as an exotic dancer living in Sacramento, Calif. A crime-watch bulletin linked the name to a woman in San Francisco who made a business of buying and selling Social Security numbers.
Knowles believes her identifiers were taken while “Riverdance” played Las Vegas in the fall of 1998. Someone reportedly broke into the show’s business office and stole information from employment records. Knowles, who did not play that part of the show and was not in Las Vegas at the time, later heard that another fiddle player also had identity-theft problems. But Knowles will probably never know for certain how her identity was stolen. Unless the woman in San Francisco is prosecuted, the story is unlikely to be told. After Ford Motor Credit recovered the car, says Knowles, it had no interest in prosecuting the suspect.
For the company to expend its resources on an identity-theft case, according to Ford Motor Credit spokesman Dan Jarvis, the case must involve a big loss, diligent police investigators, a committed prosecutor and a victim who is willing to devote the time needed to be an effective witness. He would not say whether Ford Motor Credit, which he said writes 5 million auto contracts a year, seeks prosecution of cases like Knowles’.
Even if it did, no government agency seems eager to investigate and prosecute such cases. Although both federal and state laws make identity theft a crime, enforcement is a problem in part because violations often occur in several jurisdictions. Knowles’ case is typical. A resident of Chicago, her identity apparently was stolen in Nevada, and purchases were made in her name in California, Nevada and Arizona.
“It’s not that everybody wants a piece of the pie,” said John Ford, chief privacy officer for Equifax. “It’s that nobody wants it.”
Michael Quaranta, a lobbyist with Experian, agrees. “We have seen scant evidence of anyone being indicted, prosecuted, convicted or going to jail for this crime,” he said. “We’ve got 25 or so state laws, we’ve got a federal law that’s been in place since 1998 on identity theft and fraud, and we don’t find much evidence of enforcement.”
Jackie Thursby, a prosecutor with the Cook County state’s attorney’s office, says her division prosecutes 200 to 300 identity-theft cases a year in the Chicago area. She says a 1999 Illinois law covering identity theft would not apply to Knowles, because neither the theft of her identity nor the fraudulent purchases occurred in Illinois. The federal law could be used, but its enforcement provisions are vague, merely instructing the Federal Trade Commission to refer complaints to “appropriate law enforcement agencies” and other “entities,” such as the credit-reporting agencies. The federal law also stops short of designating any governmental unit as the lead investigator or prosecutor for a case of identity theft.
“Someone’s got to pick who’s going to be the lead dog,” said Quaranta.
The FTC, Thursby says, usually refers its cases to the Secret Service. Tom Kasza, assistant agent in charge of the Chicago Secret Service office, said his investigators focus on organized-crime rings, such as the one that stole some 2,000 identities from a LifeSource blood bank this summer, 20 of which had been used to make fraudulent charges in excess of $2 million.
Where does this leave a lone victim like Liz Knowles?
“Nobody cares,” she says. “You, as a person, are left in the middle. The companies are protected by their insurers. I’m not. The credit card companies have entire departments devoted to fraud complaints. They expect it. The person who did this to me is walking around with a diamond bracelet on. She’s gotten away with it. She doesn’t have to worry about a bill, because the bills are coming to me, and she doesn’t have to worry about her credit report, because it’s on my credit report.”
Knowles’ biggest worry for the future is that she and O’Hare may not be able to buy a house after they are married.
“I’m afraid I won’t be able to get a mortgage because my credit report is shattered, because this person went out and pretended to be me.”
Things may be changing. As the number of identity thefts increases and consumers become more aware of their vulnerability to the crime, government agencies are beginning to intensify their anti-fraud efforts. Chicago recently followed the lead of several states, including California and Georgia, and formed a task force to coordinate law enforcement efforts across multiple jurisdictions. The group, which started meeting informally last December, includes representatives from the Chicago Police Department, the Cook County prosecutor’s office, the Illinois Secretary of State Police, which investigates crimes relating to vehicles and driver’s licenses, the Federal Bureau of Investigation, the Secret Service and U.S. Postal Service inspectors.
One significant change already has been made in the Chicago Police Department’s policy on crime reports. According to Lt. Jerry Swarbrick, a member of the task force, police will now write a report for any victim of identity theft who lives in Chicago, regardless of where the crime took place.
A primary strategy of the Illinois task force and other government agencies is to educate individuals about how to protect themselves from identity theft. People are advised to withhold their Social Security numbers when they do business, shred their financial mail, regularly check their credit reports and use passwords to access information electronically. But those efforts, while helpful, do not address the main source of the problem.
Both Kasza and Mike Carroll, a U.S. postal inspector in Chicago, say most identity thefts are inside jobs by employees with access to private information and would not be stopped by any measures consumers might take on their own. Organized-crime rings often rely on employees at utility companies or hospitals that require their customers to provide Social Security numbers.
The business practices of lenders and reporting agencies also should be a focus of investigators, says Theresa Amato, founder and board president of the Citizen Advocacy Center in Elmhurst and manager of Ralph Nader’s presidential campaign.
“The task force should look at the ways businesses and credit-reporting agencies are collecting and selling our private information, then sending out pre-approved offers to increase our indebtedness,” says Amato, who also expresses concern that no identity-theft victim or consumer advocate has been named to the task force. “It’s important for regulators to step in and stop believing corporations will police themselves.”
All three credit reporting agencies acknowledge that they sell personal information. Under the Fair Credit Reporting Act, they are allowed to collect and sell detailed information about what we buy and how we pay for it, so long as the information is used for “permissible purposes” that satisfy legitimate business needs, such as credit checks and pre-employment screenings.
Until a few weeks ago, they also could sell, for direct marketing purposes, all the identifying information on a credit report except the details about transactions. This information included name, address, previous address, date of birth, last reported employment and Social Security number, and was displayed in the so-called “credit header.” Sale of the credit header was banned by a federal law that took effect July 1, but it doesn’t matter. Credit reporting agencies continue to sell virtually the same identifying information; they just get it from different sources. And they still sell it for direct marketing purposes and pre-approved credit offers.
“We just have to be more creative to find [the information],” says Don Girard, a spokesman for Experian. “You’d be amazed how much is available from public records, like material contained in courthouses and on self-reported warranty cards consumers send in. We have literally thousands of sources of information. Names, addresses and Social Security numbers are available many, many places.”
As soon as Knowles started to clean up her credit report, she was inundated with pre-approved credit offers, which represent a substantial revenue stream for credit reporting agencies. “I started getting offers for credit cards with huge limits, up to $100,000. They go after you. My credit report makes me look like I’m a good customer who had some problems but who buys a lot. They like that.”
There are other ironies in the credit-reporting business: The three reporting agencies actively encourage consumers to clean up their credit reports, which means consumers are doing for free what the agencies are legally required to do keep accurate databases. Meanwhile, the agencies pick up the consumers’ private information from other sources and sell it. To compound the irony, the agencies charge the very consumers who are doing their legwork for them by reporting mistakes in credit files. In most instances, a credit report costs at least $8, and that’s just from one agency. A compiler will charge $30 to combine the three reports.
In three seconds, the time it takes to breathe in and out, Experian can compile a credit report on any of the 205 million consumers in its database, according to Girard, and send the report to a subscriber–a creditor or lender. The report summarizes an individual’s payment history as reported by subscribers, criminal and civil litigation history from federal and state court records, tidbits voluntarily disclosed on surveys and warranty cards, a list of previous addresses, and the identity of those who have requested information from the file.
Like the rest of us, Knowles has no choice as to which agencies receive information about her; credit reporting is a one-way street. Subscribers who collect the information choose the agencies that will receive it, and, as Girard explains, the agencies now collect information on their own and consumers have no means of directing or stopping the flow.
The result is that consumer choice plays no role in competition between the credit reporting agencies. Consumers cannot, for example, choose one agency over another because it follows more stringent security measures.
The reporting agencies concede that the sheer volume of business makes it virtually impossible to ensure that their records are accurate and that restricted information is not used for unlawful purposes. As stated on Experian’s Web site, “A consumer credit report is a factual record of an individual’s credit payment history as reported by their creditors [emphasis added].”
Each agency receives regular reports of financial information from about 70,000 subscribers in the United States. James Kegley, assistant vice president for customer service and sales support for Equifax, explained that while each of these subscribers is subjected to a background check and an on-site visit before receiving a subscriber number, Equifax must rely on random audits and computer scans to detect deviations from the “permissible purposes” and “legitimate business needs” for which subscribers may lawfully use the information. Clark Walter, a TransUnion spokesman, and Girard of Experian confirmed that similar procedures are followed at those agencies. No one can check all the data, or even most of it.
This troubles Eric Friedman, the lawyer who worked with Mike Denney on Knowles’ case.
“I think it’s strange that we have created a system that records alleged debts. The credit bureaus record what are nothing more than assertions. If someone who subscribes to a bureau says, ‘I’m a lawyer, or a doctor or a business, and you owe me $1,000,’ it goes on your report.”
Mistakes in the database powerfully affect the growing number of people, like Knowles, whose credit histories have been distorted by fraud. So, what can they do to protect themselves?
Not much, according to John Ford of Equifax. A proponent of industry self-regulation, Ford believes that most consumers accept what they consider to be a reasonable amount of risk in order to participate in the American credit system, which he calls “the envy of the world.”
According to Maxine Sweet, vice president of public affairs for Experian, there is only one way to fully protect oneself from inaccurate reporting.
“Don’t use credit,” she says.
Looking back on the last year, Knowles feels a combination of frustration, anger and unsatisfied vengeance.
“I would love to find whoever did this,” she said. “I would love to see this person behind bars. They have lived a very good life on my credit report, and I would like to know that they didn’t just get away with it.”
She also feels that she has learned worthwhile lessons about keeping her financial house in order and protecting her privacy. But overall, it has been a deeply disturbing experience.
“It’s a very strange violation. I don’t feel robbed, because I never really owned the things. I’m much angrier than I’d be if someone came into my house and stole my wallet. It’s more personal than that. If they took my wallet, they’d spend the money, use the cards. I have to replace what’s in the wallet. But this person has taken a sense of me. Not my personality, but I am constantly being asked to prove that I am who I am.
“There’s this whole other identity based on my life, and it’s affecting my life. I’d rather they’d break into my house and take something of mine than take–me.”
