The latest form of identity theft doesn't depend on stealing your Social Security number. Now thieves are targeting your kid's number long before the little one even has a bank account.
Hundreds of online businesses are using computers to find dormant Social Security numbers - usually those assigned to children who don't use them - then selling those numbers under another name to help people establish phony credit and run up huge debts they will never pay off.
Authorities say the scheme could pose a new threat to the nation's credit system. Because the numbers exist in a legal gray area, federal investigators have not figured out a way to prosecute the people involved.
"If people are obtaining enough credit by fraud, we're back to another financial collapse," said Linda Marshall, an assistant U.S. attorney in Kansas City. "We tend to talk about it as the next wave."
The sellers get around the law by not referring to Social Security numbers. Instead, just as someone might pay for an escort service instead of a prostitute, they refer to CPNs - for credit profile, credit protection or credit privacy numbers.
Julia Jensen, an FBI agent in Kansas City, discovered the scheme while investigating a mortgage-fraud case. She has given presentations to lenders across the Kansas City area to show them how easy it is to create a false credit score using these numbers.
"The back door is wide open," she said. "We're trying to get lenders to understand the risks."
It's not clear how widespread the fraud is, mostly because the scheme is difficult to detect and practiced by fly-by-night businesses.
But the deception is emerging as millions of Americans watch their credit scores sink to new lows. Figures from April show that 25.5 percent of consumers - nearly 43.4 million people - now have a credit score of 599 or below, marking them as poor risks for lenders. They will have trouble getting credit cards, auto loans or mortgages under the tighter lending standards banks now use.
The scheme works like this:
Online companies use computers and publicly available information to find random Social Security numbers. The numbers are run through public databases to determine whether anyone is using them to obtain credit. If not, they are offered for sale for a few hundred to several thousand dollars.
Because the numbers often come from young children who have no money of their own, they carry no spending history and offer a chance to open a new, unblemished line of credit. People who buy the numbers can then quickly build their credit rating in a process called "piggybacking," which involves linking to someone else's credit file.
Many of the business selling the numbers promise to raise customers' credit scores to 700 or 800 within six months.
If they default on their payments, and the credit is withdrawn, the same people can simply buy another number and start the process again, causing a steep spiral of debt that could conceivably go on for years before creditors discover the fraud.
Jensen compared the businesses that sell the numbers to drug dealers.
"There's good stuff and bad stuff," she said. "Bad stuff is a dead person's Social Security number. High-quality is buying a number the service has checked to make sure no one else is using it."
Credit bureaus can quickly identify applications that use numbers taken from dead people by consulting the Social Security Administration's death index.
Social Security numbers follow a logical pattern that includes a person's age and where he or she lived when the number was issued. Because the system is somewhat predictable, sellers can make educated guesses and find unused numbers using trial and error.
A "clean" CPN is a number that has been validated as an active Social Security number and is not on file with the credit bureaus. The most likely source of such numbers are children and longtime prison inmates, experts said.
Robert Damosi, an analyst with Javelin Strategy & Research, said the crime can come back to hurt children when they get older and seek credit for the first time, only to discover their Social Security number has been used by someone else.
"Those are the numbers criminals want. They can use them several years without being detected," Damosi said. "There are not enough services that look at protecting the Social Security numbers or credit history of minors."
Since the mortgage meltdown of 2008, banks have tightened lending policies, but many credit decisions are still based solely on credit scores provided by FICO Inc. and the three major credit unions: Experian, TransUnion and Equifax.
Federal investigators say many businesses do not realize that a growing number of those credit scores are based on fraudulent information.
"Lenders don't understand that when they pay money to go through a service, they may be receiving false information," Jensen said. "They think when they order the information from credit bureaus, it must be true."
Without special scrutiny, credit profiles created with the scheme are not immediately distinguishable from other newly created, legitimate files.
Investigators say the businesses clearly know they are selling Social Security numbers, but it's difficult to prove. The sellers use complex disclaimers that disavow illegal activity and warn customers against using their numbers in place of Social Security numbers.
The businesses also instruct customers to provide false information when using the number to apply for credit. Customers are told to use their real name and date of birth, but to avoid listing any addresses or phone numbers they've used in the past. They're also told to avoid any other information that connects the new, clean credit profile with the old, damaged one.
Craig Watts, a spokesman for credit reporting agency FICO Inc., said FICO has tools available for businesses to protect themselves from this type of fraud, but they are not cheap. And many lenders are slow to adopt FICO's new formulas, which are updated every few years.
Some companies that sell the numbers have lavish, high-tech websites. Others run no-frills ads on sites like Craigslist.
Jim Buckmaster, president and CEO of the San Francisco-based Craigslist, recently told the AP in an e-mail that there were "fewer than 200" classifieds on his site that used the word "CPN."
Within an hour of that e-mail exchange, dozens of the ads in cities such as Las Vegas, Los Angeles and New York had been pulled from the site. Many were reposted the next day.
An AP reporter called several of the sites, but got only recordings asking callers to leave a message with contact information.
Experts say the fraud will be difficult to stop because it's so easily concealed and targets such vulnerable people. Other than checking with the credit bureaus to see if there is a credit file associated with your child's Social Security number, spokesmen at FICO, the Social Security Administration and the FTC said there are no specific tools for safeguarding the number.
"This is an invisible crime, with invisible victims who don't have enough support out there to help them," said Linda Foley of the ID Theft Resource Center in San Diego.
Identity Theft: Your Child at Risk
As if parents don't already have enough to worry about, we now need to protect our children against identity theft.
It turns out children are the perfect victims since the crime can go undetected for quite some time since parents don't typically keep an eye out for it, according to Intersections, a company that sells identity theft prevention services. Indeed, 5% of all ID theft complaints in 2008 were for kids under the age of one.
While a child's identity can be stolen at any time of year, the back-to-school season offers many rich opportunities for thieves to practice their trade. Why? As classes begin, parents are asked to fill out forms that request the sort of personal information fraudsters are looking for, including one's full name, birthday, address and social security number.
What can a dutiful parent do to guard against ID theft? Here are some tips for protecting your offspring:
1. Never Reveal Your Child's Social Security Number
Many schools ask for a social security number, especially when you enroll your child in kindergarten. This information, however, is rarely required. But if you do have to provide it, make sure the principal keeps all student files in a safe place.
2. Hide Your Child's Name
Anyone with a kid knows you need to label everything you send to school. But that doesn't mean you have to write your child's name in a spot that can be easily seen by strangers.
Be particularly careful with backpacks. They often come with identification tags that children love to fill out. Explain to your little one that she's better off excluding the family's address and keeping her name on the inside of the bag.
3. Teach Computer Safety
Kids often make it easy for criminals. Twenty seven percent of 9 to 17-year-olds maintain a public and personal blog, web page or other online space, according to Intersections. And one in five children report doing things on the Internet that their parents wouldn't approve of. Since we can't monitor our sons and daughters at all times, you need to explain that revealing any information can put them at risk for identity theft.
4. Monitor all Junk Mail
If you notice your child getting credit card solicitations and other junk mail, there's a good chance someone got a hold of his personal information. Now you need to check if his identity has been compromised. You can do this by calling the credit fraud department at all three credit bureaus (Experian, Equifax and TransUnion) and asking a representative to look into the matter, says Joyce Carcaise, a spokeswoman with Intersections. If there's been a breach, the bureaus can tell you what to do.
5. Don't Check AnnualCreditReport.com
Ironically, the last thing you want to do is pull a credit report on your child. While they are a great tool for adults who are worried about their identity, requesting one for your kid could make him more vulnerable since it will trigger the creation of a credit file, warns Carcaise. And once that exists, it's actually easier for a criminal to open an account under your son or daughter's name, she says.