Identity Theft
Identity theft is one of the fastest growing crimes in the country. There is no way you can prevent being a victim of a crime. However, there are steps you can take to reduce your chances of being a victim of identity theft.
Identity theft is a Class C felony in Oregon. See ORS 165.800. Typically, an identity thief steals a victim's social security number or other personal information and uses that information to obtain a credit card in the victim's name or to commit some other crime.
Many victims spend countless hours trying to convince creditors, credit agencies, government agencies and others that these transactions are fraudulent and should be purged from their files.
What can you do?
- Get your credit report. Oftentimes, people find out they are a victim of identity theft by checking their credit report. You are entitled to one free credit report a year from each credit reporting agency (CRA). In order to receive your free credit reports, you must contact the "centralized source" that is established by the CRAs. You may contact the centralized source by:
- An Internet website https://www.annualcreditreport.com/cra/index.jsp
- A toll-free telephone number (1-877-322-8228); or
- Postal mail:
Annual Credit Report Request Service
P.O. Box 105281
Atlanta, GA 30348-5281
- Opt-out. You may opt-out of receiving pre-screened offers of credit and insurance (ie. unsolicited offers from companies with which you have not done prior business) by calling 1-888-5-OPTOUT (1-888-567-8688) or visiting https://www.optoutprescreen.com/.
- Freeze your credit. As of October 1, 2007, you may place a security freeze on your credit report. You must contact each CRA directly to place the freeze. It will cost up to $10 to place, lift ("thaw") or remove each freeze. Additionally, if you lose the password provided to you by a CRA to access your report, you may be charged up to $10 to replace the password. If you are a victim of identity theft or reported the theft of personal information to law enforcement, you will not be charged for placing a freeze.
- The CRA has up to five (5) business days to place the freeze. It will send you a written confirmation of the freeze within ten (10) business days after placing the freeze and provide you with a password that will allow you to "thaw" the freeze for a period of time or remove the freeze. It will also give you the procedures for how to thaw or remove the freeze.
- If your report is frozen, you will receive written confirmation within 30 days if your name, date of birth, Social Security number or address is changed.
- It can take up to three (3) business days to "thaw" or remove a freeze. Remember to plan ahead if you are going to apply for new credit, such as a credit card, a car loan or a mortgage.
- There are certain people who can still access your report while it is "frozen," for example, your current credit card company, someone collecting a judgment against you, a government agencies, insurance companies for underwriting purposes, and a future landlord.
- Place a fraud alert. A fraud alert is a statement in your credit file that notifies anyone requesting a copy of your credit report that you may be either a victim of identity theft or an active duty military consumer. There are three different types of fraud alerts: an initial alert, an extended alert and an active duty alert. After a fraud alert has been placed on your file, anyone requesting your file will be informed that you do not authorize any new extensions of credit, except for open-end credit plans, issuance of an additional card on an existing credit account, or an increase in credit limit on an existing credit account.
- An initial alert. If you think that you are - or about to become - a victim of identity theft, you may contact a CRA and ask that a fraud alert be placed in your file. You must provide that CRA appropriate proof of your identity. Once you have provided the CRA with the necessary information, the CRA must include a fraud alert in your file for 90 days, unless you request a shorter period of time, and contact the other two CRAs and instruct them to add a fraud alert on your files that they maintain. You are also entitled to a free copy of your file.
- An extended alert. If you submit an "identity theft report" (which can be the Identity Theft Affidavit) to a CRA and provide appropriate proof of your identity, you can get a seven (7) year fraud alert placed on your file. As part of the alert, you provide a phone number that anyone providing credit should call before extending credit to verify that you were the person requesting the extension of credit. Once you have submitted an identity theft report to a CRA, the CRA must: include a fraud alert in your file for seven (7) years, unless you request a shorter period of time; not provide your name to any third party that offers credit or insurance that you did not request be contacted by, for a period of five (5) years; and contact the other two CRAs and instruct them to add a fraud alert on your files that they maintain.
- An active duty alert. If you are on active military duty (or are a reservist on active duty), you may contact a CRA and get an active duty alert placed on your file. You must provide that CRA appropriate proof of your identity. Once an active duty alert is placed on your file, a CRA must: include the active duty alert in your file for one (1) year, unless you request a shorter period of time; not provide your name to any third party that offers credit or insurance that you did not request be contacted by, for a period of two (2) years; and contact the other two CRAs and instruct them to add a fraud alert on your files that they maintain.
For more information about how identity theft typically occurs and what steps to take to avoid becoming an identity theft victim, see http://www.ftc.gov/bcp/edu/microsites/idtheft/. This website also provides comprehensive information about what to do if you think you are a victim of identity theft.
Victims can send the Oregon Department of Justice a copy of a completed Identity Theft Affidavit (pdf). It is important to also file a complaint with the FTC. Law enforcement officials who are members of Consumer Sentinel can access this central database to enhance investigations and prosecutions of identity theft.
State and federal law also provide you with certain protections. For example, under federal law, any receipt that electronically prints a credit card or debit card number must not contain more than the last five (5) digits of the card number or list the expiration date of the card. Other new state protections include:
- As of October 1, 2007, if a business or state agency is subject to a breach of security of computerized data containing certain pieces of personal information (such as an unredacted Social Security number or a bank account number with a PIN), you will receive notice of the breach. While notice should be given "in the most expeditious time possible and without unreasonable delay," there are permitted exceptions, such as delays for criminal law enforcement and an investigation by the person subject to the breach of security. The notice may be provided in writing, by email, by telephone, or, if a large number of Oregonians are affected, by contacting the media and posting information on the business' or agency's website.
- As of October 1, 2007, your Social Security number will not be publicly posted or displayed. It will not be printed on a card required for you to access products or services and will not be sent on any document through the mail unless it is part of a transaction requested by you. There are certain exceptions to this law.
- As of January 1, 2008, businesses and state agencies must take reasonable safeguards to keep your personal information secure. This includes implementing information security programs and insuring that personal information is adequately disposed of when it is no longer needed for business purposes.
The Oregon Department of Consumer and Business Services enforces the Oregon Consumer Theft Protection Act.
