People are understandably concerned about their online privacy in light of recent data breaches, but their children should also exercise caution.
Capital One COF, -1.04% last month became the latest company to announce a massive hack, revealing that more than 100 million U.S. customers’ personal information — including “tokenized or encrypted” Social Security Numbers and linked bank-account numbers — had been stolen. The news came just days after an announcement that the credit-monitoring company Equifax EFX, -1.04%, whose 2017 hack exposed around 147 million people’s personal information, had agreed to a $700 million settlement.
But adults aren’t the only ones vulnerable to such attacks: The educational software company Pearson PSO, -0.70%, for example, suffered a recent cyberattack impacting about 13,000 school and university accounts.
Compromised information was limited to first and last names and, in some cases, email addresses and dates of birth, according to a company statement. “While we have no evidence that this information has been misused, we have notified the affected customers as a precaution,” the statement read. “We apologize to those affected and are offering complimentary credit monitoring services as a precautionary measure.”
But kids are increasingly lucrative to hackers, experts say. With the advent of smart toys, voice assistants, and tablets for children, they’re a hot market for fraudsters. More than 1 million children in the U.S. — or nearly 1.5% of minors — fell prey to some type of identity fraud in 2017, according to a 2018 report by Javelin Strategy & Research, incurring $2.6 billion in total losses and $540 million in families’ out-of-pocket expenses. Two in three child identity fraud victims were younger than eight, Javelin found.
The blank slate presented by a minor with no credit history can prove incredibly lucrative to an identity thief, said Eva Velasquez, the president and CEO of the nonprofit Identity Theft Resource Center. While commandeering a kid’s identity can take time to pay off, Javelin says, bad actors can “establish and slowly develop networks of accounts over time, mimicking legitimate accounts, before tapping them.”
Velasquez said hackers find the online identities of children particularly appealing. “When those credentials are in use and have their own history, it actually limits the thief in their ability to monetize them and also in the length of time for which they can do it,” she said. “A child’s identity credentials are this clean canvas with no painting on it, and it allows them to paint the picture that they want to paint.”
What’s more, the child victim typically won’t find out their identity has been targeted until the first time they apply for a first credit card, job or apartment, said Neal O’Farrell, the executive director of the nonprofit Identity Theft Council. “They could have decades of debt that they didn’t know about,” he told MarketWatch. “It’s plenty of time to commit your crime and disappear before the victim ever knows about it.”
Fraudsters can get their hands on kids’ Social Security Numbers and other sensitive information through good old-fashioned burglary or data breaches of schools or health-care providers, O’Farrell said. Mail theft is another possibility, Velasquez added, with tax documents and even some college transcripts ripe for misuse.
“Think about the number of places you might be required to give a kid’s Social Security number — the dentist, the podiatrist,” O’Farrell said. “You can just run down through the list of the places that would request a child’s Social Security number and store it very, very insecurely.”
Perpetrators of this exploitation aren’t limited to fraud rings and hackers, Velasquez said. In fact, 60% of child identity-fraud victims actually know the perpetrator personally, compared to just 7% of adult victims, according to Javelin’s report — a method of fraud made easier by the perpetrator’s often “legitimate access to the victim’s personal information.”
Don’t miss: My mother stole my identity and racked up $500,000 in debt
Such fraud might stem from a family member’s greed, Velasquez said, but it could very well be a parent or guardian’s misguided attempt to make ends meet. “They don’t realize they’re actually creating a huge mess for later on,” she said. “There’s some nuance here, and you do have to understand intent.”
Here’s how to protect your kid’s identity, according to experts:
Freeze your child’s credit report. As of 2018, parents can freeze their kids’ credit reports for free with the credit bureaus Equifax, TransUnion TRU, -1.89% and Experian EXPN, -0.55%, effectively barring fraudsters from opening accounts in their name. “Yes, the credit bureaus are clunky. … You’ll go crazy dealing with the credit bureaus,” said Ed Mierzwinski, the senior director for the U.S. Public Interest Research Group’s federal consumer program. “But do it.”
But know that a credit freeze isn’t a cure-all for the dangers of identity theft, O’Farrell said. It will not, for example, stop someone from using your child’s Social Security Number while filing a tax return, getting arrested or working illegally, he said.
Start privacy discussions early and often. “Living and breathing privacy from the earliest time possible … seems to be the most effective way,” O’Farrell said. These conversations have become a part of modern parenting responsibilities, added Velasquez, in the same vein as teaching kids about traffic safety or money management. “We have to add into that canon: ‘Your identity credentials [are] how people are going to know you’re you, so you need to treat those like money,’” she said.
Be judicious about giving out your child’s Social Security Number. Push back whenever institutions like your kid’s school ask for their Social, Velasquez said: Ask what will happen if you don’t fork it over, she said, and see if it’s possible to provide some alternate form of identification. With that said, some federally funded school programs like the school-lunch program will require a Social Security Number to access their services, she said.
If administrators insist you provide your child’s Social Security Number before moving forward, then ask questions about how the information will be protected and with whom it will be shared, Velasquez said.
Use common sense when giving out that information, Mierzwinski added. Beware of social-engineering tactics that can manipulate you into handing over sensitive information, he said, like an impostor claiming to be calling from your child’s school to have you “confirm” something with their Social Security Number. “You should call back, and call back at the number you look up from the school,” he said.
Lock down physical documents. If you have hard copies of personal documents like Social Security cards, birth certificates, passports or tax returns lying around your house, store them in a safe place that only other trusted people know about. This is especially important if your house sees significant foot traffic from roommates, care givers or other guests, Velasquez said.
“Think about those documents the same as you would cash,” she said. “If you have a lot of people in and out of your home, would you just leave $100 sitting on your table?”
Know the warning signs of child identity fraud. Consider it a red flag if you start receiving communication that’s “not normal for a child of that age,” like credit-card bills, calls from a collection agency, jury summonses, job offers or driver’s-license renewals, Velasquez said.
Monitor your financial and online security. Use strong authentication for any open financial accounts your kids have, and set up new-transaction alerts to help you detect and resolve any unauthorized access to those accounts as early as possible, said Kyle Marchini, a senior analyst in Javelin’s fraud and security practice. Sign yourself and your kids up for a service like Firefox Monitor to be alerted of account breaches, he added.
Be smart on social media. “Kids and parents themselves can over-share and self-compromise these identity credentials,” Velasquez said. Your child should steer clear of posting documents like a brand-new driver’s license or work permit for a first job, and so should you. “I’m not going to kill the fun and say don’t share momentous moments … [but] you just don’t need to have the document in your hand to prove it,” she said.
Withhold your child’s Social Security number from them until they need it. “You want to safeguard that information until it’s necessary for them to have it and understand it,” Velasquez said. But that doesn’t mean you can’t talk about the importance of that credential, she added: “Yes, you have one — and I’m taking care of it until you’re old enough to take care of it yourself.”
Be a role model on privacy. “Part of it is just repetition — they model after our behavior,” Velasquez said. “If we don’t care, and they see us not paying attention to these things or treating them with the gravity they deserve, they’re going to model that.”