If you made a list of phrases that frighten just about anyone these days, “identity theft” is probably pretty close to the top. It’s bad enough to think of someone stealing our hard-earned cash, but to have a total stranger set up credit card accounts or fake tax returns using your personal information as a template? That’s a terrible thing to deal with, and it can be difficult to recover from.

Identity theft is quite simply “the illegal use of someone else’s personal information (as a Social Security Number), especially in order to obtain money or credit,” as Merriam-Webster defines it. That’s pretty clear-cut. Criminals — both on the internet and in the real world — want to steal our money however they can. Often, that theft starts with a stolen credit card number.

The unfortunate fact is that virtually all our credit card numbers are already in circulation in what’s known as the Dark Web — the criminal underworld of the internet. Some have been intercepted from unsecured website transactions or otherwise fraudulently obtained, some acquired as the result of other crimes and a lot more have simply been generated by intelligent crooks who have the formulas to generate usable numbers themselves.

But that’s no reason to go into a panic. The major credit card servicers all provide fraud protection for consumers these days, and it’s become such a numbers game with the sheer volume of payment card information in play that the chances of becoming a victim are not that great. Don’t get me wrong, it very likely will happen; just probably not often. Additionally, your banks and credit unions have people on staff to help you prevent card fraud and recover from it when it happens.

Having your credit or debit card information stolen does not necessarily mean your identity was stolen. True identity theft requires a lot more of your personal information to cause damage. The thief must get his hands on your name, address, date and place of birth, and/or the crown jewel — your Social Security Number. With that information, he can create a whole new fraudulent version of you for his profit, which you end up paying for in stress, all the effort to recover from the theft and perhaps in a lot of unrecoverable cash.

Unfortunately, the threat is here to stay as long as it’s profitable. In a 2015 research study, the Identity Theft Resource Center called identity theft the “#1 consumer complaint in 15 consecutive years.” In many cases, the thief gets his hands on a child’s personal information and builds a fraud profile with that. By the time the child grows up and the crime is discovered, the damage is done and the impact is severe.

That’s the nastiest way for crooks to profit from identity theft. Here’s the scenario: the bad guy collects information on new birth announcements from various sources to get names and birth dates. With a name and a birth date, he can track down the child’s Social Security Number. Then, he can start using all of that information to get credit cards — maybe even online loans — and create a disaster that goes on for years. I won’t publish what sources and methods he uses; just trust that there are inexpensive ways to get the data. The best way to prevent this particular kind of identity theft is to include your children in any credit monitoring you may choose to do, either on your own or through a paid service.

Speaking of credit monitoring, the companies you see advertised on television provide a terrific catalog of services in this area, and some even offer insurance when theft happens, but they can be pricey. Do your research and due diligence if you want to explore this option.

There are also a number of relatively simple things to do and habits to develop to protect yourself from identity theft whether you pay for monitoring or not. The National Credit Union Association, who my organization reports to for these matters, offers some great advice on this, but for starters, this is what I teach my employees:

Get in the habit of reviewing your financial accounts at least once or twice a month for suspicious charges. Look for small “tickler” charges of a few dollars. Thieves use these to make sure the card works before they go to town with it. You will see charges that don’t ring a bell. Most of the time they’ll be legitimate, but the company listed may be the holding company that owns the business you bought from. If something doesn’t look or feel right, call your payment card servicer immediately and make sure they have your cell phone number. You don’t want to have a voicemail from them on this waiting for days at home.

Never carry your Social Security card or number with you, or use it for identification purposes. This is the Holy Grail for identity thieves. While it doesn’t have your birthday on it, it has enough with your legal name and number. They can get the rest.

Use complex passwords on your banking and financial websites, at least eight to ten characters long or longer. Think of a favorite novel or movie, then replace letters with similar characters. For example, “Gone With the Wind” becomes “G0n3_W1th_th3_W1nd.” This greatly increases the time it takes a thief to crack your password.

Never use the same password for every website. If a thief learns one password, he will try it on every other website he thinks you use.

Consider a Credit Freeze

on your credit bureau accounts. You’ll have to lift it to apply for new credit, but it will keep
unauthorized people from applying for credit with your information, and alert you if they do. The three main bureaus charge $10 for this.

Get a credit report at least annually to make sure there are no errors, and review your children’s too.

Above, I mentioned the real-world threat of identity theft. There are mutts on the street who use physical methods to try and get your personal information, and they’re just as tricky. Card skimmers and proximity readers have gotten a lot of attention in recent years, so let’s look at them to start.

Card skimmers are small electronic devices that crooks attach to ATMs and gas pumps to intercept and collect your card information as soon as you insert it for a transaction. Many times, they’re small enough to escape casual notice, and the user never notices them. The bad guys usually attach them in the wee hours of a Sunday morning when most businesses are closed and retrieve them later while we all sleep. Get in the habit of giving the card reader a little tug or jiggle to make sure it’s really part of the device. If there’s any movement at all, notify the owner of the terminal immediately.

Proximity readers are more subtle and controversial. There’s a modern variant of the old pickpocket “bump and grab” technique, but in this case the thief doesn’t physically get your wallet. He has a device in hand that reads and stores the information on the cards in your pocket. In a crowded environment like a subway or elevator, you can see how easy this approach might be.

Personally, I have not seen this technique demonstrated successfully and have not yet figured out how such a device would isolate the data from individual cards when they’re stacked next to each other in my wallet, but it’s absolutely feasible from a technical perspective. There are a lot of companies marketing wallets with shielding to prevent this kind of event, and from what I’ve seen, they don’t cost any more than any well-made wallet. So, by all means, use one if you want to.

Now that we’ve gone over how the bad guys can steal your identity and credit cards, what’s the worst that can happen if it happens to you? Well, frankly, it can put your entire life on hold for a long time while you get it resolved. The Federal Trade Commission estimates that recovering from identity theft takes an average of six months and 200 hours of work, most of which has to be done by the victim, and is mainly all the communications you have to do with creditors, credit bureaus, law enforcement agencies, insurance if need be — pretty much every part of your financial life. You can’t buy a house, a car, maybe anything at all if you have to wait to prove you’re a victim before you can replace everything that was stolen, and your credit score will likely be trashed until the whole process finalized.

Panic now.

If I’m being blunt about this, it’s because identity theft is probably the most damaging kind of cyber crime there is. It can literally change your life, and may feel like it’s been destroyed. But if the worst happens and you suspect your identity has been stolen, contact your banks and credit card companies immediately. They will assist you with locking down all your accounts and guide you on the road to recovery. Take steps now for you and your family to be safe, and, hopefully, you’ll never have to go through any of this.

Featured photo credit: iStock