Preventing and Detecting Identity Theft

Introduction
Identity theft is one of the fastest-growing categories of fraud worldwide, and it sits squarely within the ACFE Certified Fraud Examiner (CFE) exam's Financial Transactions and Fraud Schemes section, under the broader topic of consumer fraud. This guide covers why the topic matters, what identity theft is, how prevention and detection mechanisms actually work, and how to approach exam questions on the subject with confidence.

Why This Topic Is Important
Identity theft affects millions of individuals and organizations every year, producing billions in direct losses and even greater indirect costs: damaged credit histories, denied loans, wrongful arrests, medical record corruption, and hundreds of hours spent by victims restoring their identities. For a fraud examiner, the topic is important for three reasons:
1. Professional relevance: Fraud examiners are routinely asked to help organizations design controls, investigate breaches, and assist victims.
2. Regulatory exposure: Businesses that hold personal data face legal obligations (such as the US Red Flags Rule, the FACTA Disposal Rule, the GLBA Safeguards Rule, and various breach-notification and privacy laws worldwide). Failure to prevent or detect identity theft can create liability for the organization, not just losses for the victim.
3. Exam weight: The CFE exam tests identity theft as a distinct subtopic. Candidates are expected to know the methods thieves use, the specific prevention steps for individuals and businesses, the red flags that signal compromise, and the correct response once theft is discovered.

What Identity Theft Is
Identity theft occurs when someone wrongfully obtains and uses another person's personal identifying information (PII) such as a name, Social Security or national ID number, date of birth, account numbers, passwords, or biometric data, typically for financial gain or to commit other crimes. The ACFE generally distinguishes between:
- True-name identity theft: the thief uses the victim's real information to open new accounts, obtain credit, file tax returns, receive medical care, or obtain government benefits.
- Account takeover: the thief gains access to an existing account and makes unauthorized transactions or changes the mailing address so the victim does not receive statements.
- Synthetic identity theft: the thief combines real and fabricated data (for example, a real national ID number with a fictitious name) to create a new identity. This is particularly hard to detect because no single real victim notices immediately.
- Business (corporate) identity theft: fraudsters impersonate a company to obtain credit, divert payments, or file fraudulent corporate records.
- Medical identity theft, child identity theft, and criminal identity theft: variations where the thief seeks healthcare, exploits a minor's clean credit history, or gives the victim's identity to police upon arrest.

How Thieves Obtain Information
Understanding acquisition methods is essential because prevention controls map directly onto them. Common methods include:
- Dumpster diving for discarded statements, pre-approved credit offers, and medical records.
- Mail theft and fraudulent change-of-address requests.
- Phishing, smishing, and vishing (fraudulent emails, texts, and phone calls).
- Pretexting and other social engineering to trick employees or customer-service staff into releasing data.
- Skimming card data at ATMs, fuel pumps, and point-of-sale terminals.
- Shoulder surfing and theft of wallets, laptops, and mobile devices.
- Data breaches and insider theft at employers, retailers, healthcare providers, and government agencies.
- Malware, spyware, and keyloggers installed on victims' devices.
- Purchasing stolen data on underground markets.

How Prevention Works: Individuals
The Fraud Examiners Manual emphasizes that most individual-level prevention is about limiting exposure of PII and monitoring for misuse. Key steps include:
- Protect documents: shred (preferably cross-cut) all documents containing PII before disposal; store sensitive records in a locked location.
- Guard identifying numbers: do not carry a Social Security card or national ID in a wallet; refuse to give numbers unless truly necessary; ask why the number is needed and how it will be protected.
- Secure mail: use a locking mailbox, deposit outgoing mail at a post office, and have mail held when away.
- Opt out of pre-screened credit offers and unsolicited marketing to reduce the volume of exploitable mail.
- Practice strong digital hygiene: unique, complex passwords or passphrases; multi-factor authentication; current antivirus and software patches; avoiding public Wi-Fi for financial transactions; never clicking links in unsolicited messages; verifying requests by calling a known number.
- Monitor financial activity: review bank and card statements promptly, reconcile receipts, and watch for small test charges.
- Review credit reports regularly: in the United States, consumers are entitled to a free report from each of the three major credit bureaus (Equifax, Experian, TransUnion) at least annually through the official central source; staggering the requests allows monitoring throughout the year.
- Use fraud alerts and credit freezes: an initial fraud alert (one year, renewable) tells creditors to take extra steps to verify identity before extending credit; an extended fraud alert (seven years) is available to confirmed victims who provide an identity theft report; an active duty alert protects deployed military personnel. A credit (security) freeze restricts access to the credit file entirely so new accounts cannot be opened; in the US, placing and lifting freezes is free under federal law. The exam frequently tests the difference: an alert warns creditors, while a freeze blocks access.
- Secure devices: use screen locks, encryption, and remote-wipe capability; wipe hard drives before disposal.

How Prevention Works: Organizations
Organizations are custodians of enormous volumes of PII and are attractive targets. Prevention relies on a layered control environment:
- Data minimization: collect only what is needed, retain it only as long as necessary, and avoid using national ID numbers as customer or employee identifiers.
- Access controls: role-based access, least privilege, logging and monitoring of access to sensitive records, and prompt removal of access for departing employees.
- Physical and technical safeguards: encryption of data at rest and in transit, firewalls, intrusion detection, secure disposal of paper and electronic media, and clean-desk policies.
- Employee screening and training: background checks for staff with data access, and ongoing training on social engineering, phishing, and proper handling of customer information.
- Vendor management: contractual safeguards and due diligence for third parties who process data.
- Written information security and incident response plans.
- Legal compliance: In the United States, the Fair and Accurate Credit Transactions Act (FACTA) amended the Fair Credit Reporting Act (FCRA) to add several identity-theft provisions, including the Disposal Rule (reasonable measures to destroy consumer information), truncation of card numbers and removal of expiration dates on electronically printed receipts, and the Red Flags Rule. The Red Flags Rule requires financial institutions and creditors holding covered accounts to maintain a written Identity Theft Prevention Program with four elements: (1) identify relevant red flags, (2) detect those red flags, (3) respond appropriately to prevent and mitigate identity theft, and (4) periodically update the program. The program must be approved by the board or senior management, overseen by designated staff, include staff training, and address service-provider oversight. The Gramm-Leach-Bliley Act Safeguards Rule separately requires financial institutions to develop a written information security program. Many other jurisdictions impose comparable duties through data protection and breach-notification legislation.

How Detection Works
Detection operates at two levels: the individual noticing misuse, and the organization recognizing red flags in account activity.

Warning signs for individuals:
- Unfamiliar accounts, inquiries, or addresses on a credit report.
- Bills or statements that stop arriving (possible address change by the thief).
- Bills, collection calls, or denials of credit for debts the person never incurred.
- Tax authority notices that a return was already filed or that income was reported from an unknown employer.
- Medical bills or insurance explanation-of-benefits statements for services never received, or a health plan reporting benefit limits reached.
- Notification of a data breach involving the person's information.
- Unexpected password-reset emails, account lockouts, or two-factor codes.
- Small, unexplained charges that test whether an account is live.

Red flag categories recognized under the Red Flags Rule (useful as an organizing framework for exam questions):
1. Alerts, notifications, or warnings from a consumer reporting agency (fraud alerts, credit freezes, address discrepancies, unusual credit activity).
2. Suspicious documents (altered or forged identification, photographs or physical descriptions inconsistent with the applicant, information inconsistent with other documentation on file).
3. Suspicious personal identifying information (addresses or phone numbers associated with known fraud, ID numbers that do not match date of birth or that are not yet issued, addresses that are mail drops or prisons, the same information used by multiple applicants, inability to answer challenge questions).
4. Unusual use of, or suspicious activity related to, a covered account (shortly after a change-of-address request a request for new cards or additional users; new accounts used in ways associated with fraud such as paying only the minimum and quickly reaching the limit; dormant accounts suddenly active; mail returned as undeliverable while transactions continue).
5. Notice from customers, victims, law enforcement, or others that an account has been opened or used fraudulently.

Organizational detection tools include identity verification at account opening (document checks, knowledge-based authentication, database cross-checks), out-of-pattern transaction monitoring, address-change verification letters sent to the old address, velocity checks on applications, device fingerprinting, and monitoring of employee access logs for unusual queries.

Responding Once Identity Theft Is Detected
Exam questions often extend from detection into response, so know the standard victim steps (US framework, though the logic applies broadly):
1. Place a fraud alert or credit freeze with the credit bureaus; contacting one bureau for a fraud alert triggers notification to the others.
2. Obtain and review credit reports and dispute fraudulent entries.
3. Report the theft to the national consumer protection authority (in the US, the FTC via IdentityTheft.gov, which generates an Identity Theft Report and recovery plan).
4. File a police report; combined with the FTC affidavit this constitutes an identity theft report that allows extended alerts and blocking of fraudulent information under the FCRA.
5. Contact affected creditors and financial institutions to close or freeze compromised accounts, change passwords and PINs, and request fraud-department documentation.
6. Notify other relevant agencies as appropriate (tax authority, Social Security or national ID administration, passport office, motor vehicle department, health insurer).
7. Keep a detailed log of every contact, and retain copies of all correspondence.

For organizations, response means activating the incident response plan, containing the breach, preserving evidence, notifying affected individuals and regulators as legally required, offering remediation (such as credit monitoring), and updating controls to close the gap exploited.

Exam Tips: Answering Questions on Preventing and Detecting Identity Theft
1. Know definitions precisely. Be able to distinguish true-name theft from account takeover, and synthetic identity theft from traditional theft. Questions often describe a scenario and ask which type it represents.
2. Master the fraud alert versus credit freeze distinction. Alerts warn creditors to verify identity (initial: one year; extended: seven years, requires an identity theft report); freezes block access to the credit file and are free to place and lift. If a question asks for the measure that most completely prevents new accounts from being opened, the answer is the credit freeze.
3. Memorize the four elements of a Red Flags Rule program: identify, detect, respond, update. Also remember that it applies to financial institutions and creditors with covered accounts, must be written, and requires board or senior management approval and staff training.
4. Be able to classify red flags. If a scenario describes a request for a new card immediately after an address change, that is unusual account activity. A photo on an ID that does not match the applicant is a suspicious document. A notice from a consumer that she never opened the account is notice from a victim.
5. Link methods to controls. Dumpster diving is countered by shredding; mail theft by locked boxes and opting out of pre-screened offers; phishing by not clicking links and verifying independently; skimming by inspecting terminals and using chip or contactless payment; data breaches by encryption, access controls, and minimization.
6. Watch for absolute language. Statements such as a person should never give out a national ID number are usually false; the correct principle is to disclose it only when genuinely required and after asking how it will be protected. Similarly, checking a credit report once is not sufficient; regular monitoring is the recommended practice.
7. Remember which law does what. FACTA amended the FCRA to add the Red Flags Rule, the Disposal Rule, receipt truncation, free annual credit reports, and fraud alerts. GLBA covers financial privacy and the Safeguards Rule. The Identity Theft and Assumption Deterrence Act made identity theft a federal crime in the US and designated the FTC as the central complaint agency. The Identity Theft Penalty Enhancement Act created aggravated identity theft with mandatory additional sentences.
8. Think like the Fraud Examiners Manual. The exam rewards the conservative, control-oriented answer: limit data collection, shred documents, monitor accounts, verify before trusting, and document everything. When two answers both seem reasonable, choose the one that reduces exposure of PII rather than the one that merely reacts after the fact.
9. Expect scenario-based questions. Read the full fact pattern, identify whether the question is asking about prevention, detection, or response, and eliminate answers that belong to a different phase. For example, filing a police report is a response step, not a prevention step.
10. Do not overlook organizational duties. Many candidates study only individual precautions. Be prepared for questions about employee training, vendor oversight, secure disposal, data retention, and incident response obligations.
11. Manage your time. Identity theft questions are usually knowledge-based rather than calculation-based, so answer them efficiently and flag any you are unsure of for review.

Quick Review Summary
- Identity theft is the wrongful acquisition and use of another's PII for gain; it includes true-name theft, account takeover, synthetic, business, medical, child, and criminal variants.
- Thieves obtain data through dumpster diving, mail theft, phishing and social engineering, skimming, device theft, malware, and breaches.
- Individual prevention: shred, guard identifiers, secure mail, opt out, strong passwords and MFA, monitor statements, review credit reports, use alerts and freezes.
- Organizational prevention: data minimization, access controls, encryption, secure disposal, training, vendor oversight, written security and Red Flags programs.
- Detection: watch for unfamiliar accounts, missing bills, collection calls, tax and medical anomalies, and the five Red Flags Rule categories.
- Response: alert or freeze credit, report to the FTC and police, dispute entries, close accounts, notify agencies, document everything.

With a firm grasp of these concepts and the exam strategies above, candidates should be well equipped to handle any CFE exam question on preventing and detecting identity theft.