Not long ago, someone posed as me at three bank branches and drained thousands of dollars from my checking account.
Chances are higher now that something similar will happen to you.
This kind of old-fashioned in-person identity theft is on the rise after fraudsters grew more sophisticated during the pandemic, improving their illicit supply chain that makes it easier to pull off these crimes.
The surge is frustrating banks and the government as they try to meet the resurrected threats.
"Yours is not a one-off," Mary Ann Miller, fraud and cybercrime executive adviser at digital identity solution firm Prove Identity, said about my recent run-in with ID theft, which I wrote about earlier this year.
"An actor walking into branches and doing what they did with your account, withdrawing money, is a trend," she said. "It's happening right now."
'The big money grab'
ID theft swelled during the pandemic when the federal government delivered $5 trillion in relief to businesses and households through stimulus checks, enhanced unemployment benefits and food aid, and forgivable loans.
"It was what I call the big money grab," Miller said, and criminals wanted a piece of it. They "skilled up" at creating fake identities and stealing existing ones, Miller said, so they could fraudulently file for these pandemic benefits.
And it worked. They stole $300 billion in pandemic relief, according to one FBI official's account, representing the biggest fraud in history. That success emboldened fraudsters to keep going.
"They've taken those learnings," Miller said, "and they've continued to get better and better at what they do."
'Very sophisticated manufacturers'
To pull off the old-school heist of my bank account, the criminal who posed as me needed my bank account number and a fake form of ID.
These are ripe for the taking on Telegram Web, a cloud-based encrypted instant messaging platform that is a favored forum to sell stolen documents. Miller calls it "the new dark web that's not so dark."
David Maimon, an associate professor of criminal justice and criminology at Georgia State University, gave me a tour of Telegram during our interview. On that day, someone had posted stolen checks dated just a few days before.
These stolen checks can come from home or car robberies. Another fertile ground for these crimes is the US postal system.
Some mail carriers simply steal them from the mail they are supposed to deliver. In other cases, thieves rob the carriers themselves or the iconic blue mailboxes found on public sidewalks. It got so bad that the US Postal Service last year doubled down on efforts to curb these crimes.
I may have been one of these victims. A check went missing after I mailed it years ago, and my family later found out that the mailbox outside our apartment building had repeatedly been hit by thefts.
A stolen check can only tell you so much, though. It doesn't provide a date of birth or Social Security number — crucial personal data needed to create a fake driver's license or passport.
So, the criminals turn to unfaithful employees of banks and credit bureaus to look up that missing information "for a reasonable price of one hundred bucks," Maimon, who is also the head of fraud insights at SentiLink, said.
They can also turn to Telegram and purchase bogus forms of identification.
"Fake IDs are the hottest item you can imagine on Telegram," Miller said. "There are very sophisticated manufacturers."
Phony passports have become an increasing problem, the federal government warned banks earlier this year, because, as "a less familiar form of government-issued identification," they are more likely to evade detection.
But fake driver's licenses offered on Telegram are also "really high quality," Maimon said.
So high quality that in my case, where the criminal withdrew $11,300 from my bank account, "the poor bank teller probably couldn't tell the difference between the legitimate, real driver's license and the fake one," he said.
'You can't forget to do the basics'
The bank tellers in my case missed other fraud flags too.
One was my name. The criminal used my maiden name on the bank withdrawal slip to make the transaction. The problem is that this name hasn't appeared on my accounts since it was changed in 2010.
The imposter also misspelled my first name on two slips — Jana versus Janna. The third showed what appeared to be an attempt to correct the botched spelling of both my first and maiden names.
There's also no way to know what kind of fake ID was presented to the tellers, because none of them recorded the ID form and number on the back of the withdrawal slips, a breach of procedure, a bank branch manager later told me.
"Wow, this wasn't a very sophisticated fraud attack," said Ian Mitchell, founder of the Knoble, a nonprofit network of financial institutions, law enforcement, and other nonprofits fighting fraud.
"It sounds like following the procedures that the bank had in place probably would have solved this one."
That's what the fraudsters look for: the weak link. So, if one bank has strong cybersecurity but poor in-person security, they send in imposters. If it's the reverse, they may hack the financial institution. And to make matters worse, they share this intel among each other.
The problem is that a bank will invest in anti-fraud measures and forget it for five years, Mitchell said. In that time, the fraudsters have evolved beyond those measures, finding new loopholes. Or they exploit old ones that no one addressed.
"You can't forget to do the basics really well. We are constantly against criminals that are trying to find new and old ways to defeat our defenses," Mitchell said.
"It's a nonstop battle."
—
Janna Herron is a Senior Columnist at Yahoo Finance. Follow her on Twitter @JannaHerron.