NEW HOPE, Minn. — Identity theft is the nightmare we all fear. For Marni Ribnick it is all too real.
Records obtained by KARE 11 show that thieves not only set up dozens of fraudulent accounts in her name, they also used her stolen information to fool the credit monitoring companies that were supposed to protect her.
“I don’t want anybody to have to go through the aggravation that I went through,” she told KARE 11’s Lou Raguse.
It all started two years ago when Marni got word that more than 20 new charge accounts had been opened in her name.
“And none of them were mine,” she said.
Millions at risk
Marni was one of the victims when cybercriminals broke into Equifax, the large credit reporting company.
On Sept. 7, 2017, Equifax announced that a data breach had exposed the personal financial information of more than 140 million people.
Hackers had stolen detailed information including names, addresses, birth dates, Social Security numbers and driver’s license numbers.
Mark Lanterman, the Chief Technology Officer of Computer Forensic Services in the Twin Cities, says much of that stolen information is still for sale on what’s known as the "Dark Web" – a secret side of the internet.
Armed with someone’s stolen Equifax file Lanterman says, “I can know pretty much everything financial about you.”
Marni followed expert advice
To protect yourself from identity theft, experts almost always recommend two things. They say you should set up a freeze with the credit bureaus to block new accounts. And they suggest signing up for a credit monitoring service to alert you about any new and suspicious activity.
Marni says that’s exactly what she did after she learned fraudulent accounts were being opened in her name.
“I put freezes on all three credit bureaus,” she said.
For added protection, she says she signed up with a well-known service – LifeLock – paying a monthly fee to have them monitor her credit.
But what happened next is a frightening warning about the dangers of identity theft – even when you follow that expert advice.
“It was horrible,” Marni said.
“Is this case proof that you can do everything right and still get scammed?” KARE 11 asked. “Yeah,” she replied.
Tricking credit protection services
When she requested a credit freeze at the major credit bureaus, Marni thought she had blocked any new accounts from being opened in her name.
It wasn’t long, though, before she got more bad news.
“Within the next week or so, accounts started opening up again,” she said. “And that’s when I realized somebody had lifted the freezes.”
How did it happen?
Marni says she discovered the thieves – armed with that detailed personal financial information about her – were able to overcome normal security checks and trick at least one of the credit bureaus into canceling the freeze.
They did it, in part, by sending in a fake Social Security card.
“It’s my name. It was my Social Security number - and it’s a forged signature,” Marni said as she held a copy of the phony card. Police helped her get a copy after she reported the crime.
“So, they tricked the credit bureau?” KARE 11 asked.
“Yes,” Marni said. “I was stunned. I had the biggest knot in my stomach because I thought I did everything right.”
But Marni was about to discover the fake Social Security card wasn’t the only way the thieves were able to trick another company that was supposed to be protecting to her.
Phone tapes reveal scammer’s tricks
After setting up her credit freeze, Marni says she followed the other recommendation from experts.
To trigger alerts about any additional suspicious activity in her name, Marni says she signed up for a professional credit monitoring service offered by LifeLock.
On its website, the company says it offers the “most comprehensive identity theft protection” to protect “your finances and your future.”
But Marni says the scammers were able to fool LifeLock, too.
Working with the police department investigating her case, Marni was able to obtain copies of LifeLock’s own recordings of telephone calls about her account.
They reveal how a thief was able to impersonate Marni – and trick LifeLock into canceling the service that was meant to protect her.
“Thank you for calling LifeLock,” one of the phone tapes begins. “I’m trying to access, I guess, my account over the phone,” the caller says.
“It’s somebody pretending to be me,” Marni explained as she played the call for KARE 11.
“Can you verify your verbal passcode for me?” the LifeLock representative asks.
Even though the scammer didn’t know the special password, Marni says the caller was apparently able to use her stolen Equifax information to answer the back-up security questions meant to protect the account.
“That did give me access to your account,” the LifeLock representative says on the call. “So, let’s update that verbal password.”
“They are letting her change the verbal password to something else,” Marni explained.
In effect, thieves had hijacked Marni’s account.
Buying time to open new accounts
And if you’re thinking it can’t get worse, the recording shows the scammers use that new password to cancel Marni’s entire LifeLock service.
“I’m going to cancel the membership,” the scammer tells LifeLock.
That’s not all. Before the call ends, the imposter asks to change the email address Marni had on file.
“Can you update my email address?” the thief asks in the recorded phone call.
“Of course!” the cheerful LifeLock representative answers.
“She updated my email address – to a fraudulent email address – so I wouldn’t get notified,” Marni explained.
Since Marni didn’t even know her LifeLock account was being canceled, she couldn’t quickly object. In effect, the thieves bought themselves more time to open new accounts without Marni getting alerts.
“This was unique. And this was pretty extreme,” Officer Gena Abramovich of the New Hope Police Department told KARE 11. He helped Marni get copies of the telephone tapes.
“I listened to them with Marni and they were obviously not her,” he said. “And it was kind of a shock.”
In a statement to KARE 11, a LifeLock spokesperson said the company doesn’t discuss specific cases involving its customers. So, it offered no explanation for what happened in Marni’s case.
Instead, the company said it has “stringent procedures in place to address and prevent unauthorized access to member accounts.”
In addition to reporting the details of her identity theft case to her local police department, Marni says she also filed reports:
- with the FBI - since internet crimes were involved,
- with U. S. Postal Inspectors - since credit cards in her name were sent through the mail,
- and with the Chicago Police Department - since that’s where some of the fraudulent credit cards were sent.
The New Hope, Minnesota Police Department investigated as much as a local department could. Records show they even gave police in Chicago the address the thieves had used there.
But Marni says she was told her case wasn’t considered a priority.
“You know there’s murders and all sort of different things going on, so this stuff gets put on the back burner,” she said. “They just didn’t have the manpower in Chicago to do it.”
As it stands now, it doesn’t look like there will be any arrests.
“So, we rely on our partners,” New Hope Officer Abramovich said. “We rely on our partners on the state level, the federal level, because these crimes are complex.”
“What’s your reaction, knowing that the thieves are probably going to go scot-free?” asked KARE 11’s Lou Raguse.
“It’s really frustrating,” Marni said. “It’s everywhere you look. It’s so prevalent everywhere that I think that they probably don’t even know which direction to start.”
Repairing the damage
Marni says she’s already spent nearly 60 hours – just on phone calls – canceling phony accounts. That doesn’t count the extra time she spent collecting the documents and other information needed to verify her fraud claims.
Under an agreement Equifax signed with the government, the company pledged to compensate victims for at least part of the time people spent cleaning up the massive identity mess.
Although she hasn’t had to pay for the fraudulent charges, Marni’s identity theft nightmare may not be over.
“All I need is a first name, last name and state,” said computer expert Mark Lanterman as he showed KARE 11 what’s for sale on the Dark Web.
We discovered stolen Social Security numbers being advertised – including Marni’s.
How much would a thief have to pay?
“The Social Security number costs six dollars.” Lanterman says. “A bargain at twice the price.”
What can you do?
Although Marni’s case shows the system isn’t perfect, experts still recommend putting a freeze on new accounts with the major credit bureaus – and setting up a credit monitoring service.
Even if there isn’t always an arrest, police say reporting cases of identity theft can help them build cases against organized rings of thieves.
“This case might be one of many nationwide,” Officer Abramovich said about Marni’s identity theft report. “Down the road, there’s a chance this case might connect with another case in another jurisdiction.”
The federal government has set up a website to help fight identity theft: www.IdentityTheft.gov.
It has detailed information about how to protect yourself and a step-by-step list of things to do if you think you’ve been a victim of identity theft. It also includes a link to report the crime and sample letters to help you dispute false charges – and prevent new ones.
Our investigation started with a tip. If you have a suggestion, or want to blow the whistle on government fraud, waste, or corruption, email us at: firstname.lastname@example.org.