Posts

When news of yet another data breach comes out, the reaction can range from panic to “blah.” At the one of end of the spectrum, consumers can be left with documented feelings of stress, fear and even paranoia about further attacks to their identity. At the same time, a very real phenomenon known as “data breach fatigue” occurs when there are so many attacks that consumers stop taking them seriously.

Fortunately, a new tool can help consumers make sense of a data breach; while neither overreaction nor inaction is an appropriate response, this tool can help people who are affected by the breach understand their options and take corrective action.

The Identity Theft Resource Center and Futurion have partnered and launched a tool called Breach Clarity, which takes publicly-available data breach information and breaks down both the threat and that actionable steps for consumers.

Watch Our New Free Webinar: Deciphering the Code of Data Breach Notifications

Unfortunately, far too many consumers do not check up on these kinds of attacks until it is too late. Even then, many victims of data breaches do not follow up on the support that notification letters offer, including things like identity theft protection or credit monitoring.

Breach Clarity lets users type in a general search term for a known breach and see a graphic representation of the threat level based on a number of factors. These include things like understanding whether or not financial information was exposed or if Social Security numbers (or other sensitive PII) were accessed. From there, a one-to-ten risk score is provided so consumers understand just how seriously this could affect them. The Home Depot breach in 2014 only receives a 3 out of 10 because of the nature of the information that was stolen; the 2015 attack on the US government’s Office of Personnel Management was far more serious and received a 10 out of 10 risk score as a result.

Breach Clarity was unveiled at the 2019 KNOW Conference in Las Vegas where it won first place in the third annual Identity Startup Pitch Competition. The criteria for selecting a grand prize winner included factors like the degree to which the entrant meets the customer’s needs and expectations, innovation, originality, and more.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Microsoft announced a data breach that gave hackers limited access to some of its customers’ email accounts. The hackers were able to see email addresses, subject lines of emails, and folders, but not open any emails or their attachments. They also were not able to obtain the customers’ passwords. Essentially, the hackers were able to do the same exact thing as looking over your shoulder in a coffee shop while your email inbox screen was open.

So what’s the big deal?

First, any time an outside agent is able to access a company’s stored data—especially information on its customers—that’s a big deal. In this case, a hacker compromised the login credentials of a customer service agent. The history of data breaches is filled with examples of cybercriminals reaching their intended target by going through this kind of side door, so to speak.

Read next: New Tool Breach Clarity Helps Consumers Make Sense of Data Breaches

Also, compromising someone’s login credentials should be a difficult-to-impossible task if the right security measures are in place. Microsoft has not provided details on how the credentials were compromised, or even whether or not it was a Microsoft employee or a third-party customer service provider. If someone was able to “guess” the username and login using readily-available hacking software, then the password wasn’t strong enough. If the hackers obtained the credentials from a previous data breach, then those credentials are being reused and not being updated routinely. If they got the credentials through a phishing scam, then the employee may not have been adequately trained on security practices and protocols.

Finally, this event is a big deal because it serves as yet-another warning about password security, email strength, and data breach fatigue. If your first response to the announcement from Microsoft was, “Here were go again…yawn,” then you may be experiencing data breach fatigue. If you read the announcement and thought, “Well, thank goodness it was just the email addresses!” you may be feeling numb to certain kinds of cybercrimes.

It’s important that customers take all data breaches and hacking attempts seriously. Microsoft has locked down the credentials on accounts that it believes were affected—in order to block any potential access the hackers may gain—but urges all Microsoft account users to change their passwords. Password strength, including frequently changing your passwords, is one of the most important things consumers can do to protect themselves from cybercrimes.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: Payment App Protection: Keep Scammers Out of Your Accounts

Identity Theft Resource Center and Futurion unveil a new tool Breach Clarity for consumers impacted by data breaches 

LAS VEGAS, Mar 24, 2019 ­­– Today, the Identity Theft Resource Center® (ITRC), a national non-profit organization established to support victims of identity crime, and Futurion announced during the KNOW 2019 conference the launch of a new tool to empower victims of data breaches in decoding what breach notification means to them and how they can minimize the risk of identity theft and fraud. The ITRC, along with the tool’s creator Jim Van Dyke, announced Breach ClarityTM. Breach Clarity is the secret decoder that will allow consumers to decipher data breach risks, prioritize the right minimization actions and access ITRC advisors for additional help. Breach Clarity is a no-cost, online tool for consumers, meant to crack the often muddled and incomplete information that follows breach notification.

Consumers can utilize the tool at www.idtheftcenter.org/BreachClarity and begin decoding the effect of any data breach on their identity safety. Breach Clarity uses a proprietary algorithm to give a data breach a risk score based on unique variables, like amount and type of information exposed. The higher the risk score for a specific breach, the more negative consequences that breach can potentially have for an individual. Breach Clarity also unlocks the top potential harms and recommended action steps for a victim of each breach, eliminating confusion in a time-is-of-the-essence period for victims. Finally, the tool provides resources for consumers like risk minimization plans from ITRC for data breach and next steps toward remediation.

The most frequently asked question ITRC receives when assisting victims of data breach is, “But what does this actually mean to me?” The national non-profit strives to better assist and educate victims in determining if they should be worried and how the breach can affect them. Breach Clarity gives consumers the power to decode the harms of a data breach. After receiving a notification letter or getting information from a credible third-party like media sources, websites that provide security

information and other sources, a victim can enter the name of the breach they were affected by to decode what that breach means to his or her safety.

“Victims deserve answers, not vague language that covers up the true meaning of data breaches,” says president and CEO of ITRC Eva Velasquez. “We are thankful to have partners, like Jim Van Dyke, who are working to change the industry and bring clarity to victims. Breach Clarity is the first step toward empowering data breach victims and changing the scope of the industry.”

The Breach Clarity algorithm runs on the backbone of ITRC’s proprietary database of publicly available and notified breaches. Since data breaches – and fraud methods around them – often change quickly, Breach Clarity is a dynamic, evolving tool that updates as new information becomes available regarding breaches and fraud mechanisms.

“I’m delighted to work with the ITRC because we share a passion for protecting consumers,” says Jim Van Dyke, inventor of Breach Clarity. “In contrast with some who blame victims as being ‘apathetic’ or even ‘dumb’ when it comes to security, Breach Clarity is designed to empower every identity holder with the facts and help they need to minimize the risk of a data compromise leading to identity theft.”

Shortly following the launch of Breach Clarity, ITRC and Van Dyke will jointly offer webinars on how to use the tool and address questions from the public. Sign up for the first webinar about Breach Clarity at idtheft.center/BreachClarity. For financial institutions and employers, a premium version of Breach Clarity will be created to provide advanced capabilities such as an expanded list of risks and action steps for the consumer, integrated results from multiple breaches and methods for integrating to digital finance systems that further empower the consumer after a breach.

Attendees of the KNOW 2019 conference can join Eva Velasquez, president and CEO of ITRC (booth #121), Jim Van Dyke, founder of Futurion and creator of Breach Clarity, and James Ruotolo, director of product management and product marketing for the Fraud and Security Intelligence division at SAS, for a covert event Monday March 25th, 7-9pm. Register here or visit ITRC’s booth (#121) for more information, space is limited as this is a first come, first serve event. Thanks to SAS for their support of ITRC and underwriting the KNOW 2019 networking event.

###

About the Identity Theft Resource Center®

Founded in 1999, the Identity Theft Resource Center® (ITRC) is a nationally recognized non-profit organization established to support victims of identity theft in resolving their cases, and to broaden public education and awareness in the understanding of identity theft, data breaches, cybersecurity, scams/fraud, and privacy issues. Through public and private support, ITRC provides no-cost victim assistance and consumer education through its call center, website, social media channels, live chat feature and ID Theft Help app. For more information, visit: http://www.idtheftcenter.org

About Futurion and Breach ClarityTM

Futurion is a research-based consultancy focused on consumer identity, digital commerce and financial services. Futurion’s CEO Jim Van Dyke formerly founded and led Javelin Strategy & Research and has also held various product management and board positions. Breach Clarity was created based on research of consumer identity crime victims and interviews with experts on the front line of fraud prevention at financial institutions, government agencies, payments networks and more. Breach Clarity’s basic outputs are free to all consumers at www.BreachClarity.com, with an upcoming premium version being designed for consumers who log into their secure personal account at licensing financial institutions and employers.

###

Identity Theft Resource Center
Charity Lacey
VP of Communications
O: 858-634-6390
C: 619-368-4373
clacey@idtheftcenter.org

SAN DIEGO – Jan 28, 2019 – The Identity Theft Resource Center®, a nationally recognized non-profit organization established to support victims of identity crime, and CyberScout®, a full-spectrum identity, privacy and data security services firm, released the 2018 End-of-Year Data Breach Report.

According to the report, the number of U.S. data breaches tracked in 2018 decreased from last year’s all-time high of 1,632 breaches by 23 percent (or 1,244 breaches), but the reported number of consumer records exposed containing sensitive personally identifiable information jumped 126 percent from the 197,612,748 records exposed in 2017 to 446,515,334 records this past year.

“The increased exposure of sensitive consumer data is serious,” said Eva Velasquez, president and CEO of the Identity Theft Resource Center. “Never has there been more information out there putting consumers in harm’s way. ITRC continues to help victims and consumers by providing guidance on the best ways to navigate the dangers of identity theft to which these exposures give rise.”

Another critical finding was the number of non-sensitive records compromised, not included in the above totals, an additional 1.68 billion exposed records. While email-related credentials are not considered sensitive personally identifiable information, a majority of consumers use the same username/email and password combinations across multiple platforms creating serious vulnerability.

“When it comes to cyber hygiene, email continues to be the Achilles Heel for the average consumer,” said CyberScout founder and chair, Adam Levin. “There are many strategies consumers can use to minimize their exposure, but the takeaway from this year’s report is clear: Breaches are the third certainty in life, and constant vigilance is the only solution.”
To download the 2018 End-of-Year Data Breach Report, visit: idtheftcenter.org/2018-end-of-year-data-breach-report/

###

About the Identity Theft Resource Center:

Founded in 1999, the Identity Theft Resource Center® (ITRC) is a nationally recognized non-profit organization established to support victims of identity theft in resolving their cases, and to broaden public education and awareness in the understanding of identity theft, data breaches, cybersecurity, scams/fraud, and privacy issues. Through public and private support, the ITRC provides no-cost victim assistance and consumer education through its call center, website, social media channels, live chat feature and ID Theft Help. For more information, visit: http://www.idtheftcenter.org

About CyberScout:
Since 2003, CyberScout® has set the standard for full-spectrum identity, privacy and data security services, offering proactive protection, employee benefits, education, resolution, identity management and consulting as well as breach preparedness and response programs.

CyberScout products and services are offered globally by 660 client partners to more than 17.5 million households worldwide, and CyberScout is the designated identity theft services provider for more than 750,000 businesses through cyber insurance policies. CyberScout combines extensive experience with high-touch service to help individuals, government, nonprofit and commercial clients minimize risk and maximize recovery.

###

Identity Theft Resource Center
Charity Lacey
VP of Communications
O: 858-634-6390
C: 619-368-4373
clacey@idtheftcenter.org

CyberScout
Lelani Clark
VP of Communications
O: 646-649-5766
C: 347-204-9297
lelani@adamlevin.com

Fortnite is a popular online battle game that has drawn criticism for its combination of violent battle and seemingly child-friendly artwork, as well as for its business model that encourages players to spend real money on fake goods within the game. Worse, though, is the recent announcement that a bug in the game’s code allowed hackers to access players’ accounts and use their stored credit cards.

Pending the ongoing investigation, Epic Games hasn’t revealed how many Fortnite accounts were compromised, so until notification is sent to all affected players, it’s a good idea to check your payment card statements regularly and change your password.

There has been some concern raised about hackers’ ability to also intervene on voice chat sessions between players—which is alarming since this game is used mainly by kids—but the company says that is not true.

The hackers didn’t gain access to the credit card information, so how did they benefit from this? There is a whole world of internet buying and selling that involves virtual goods sold within games. If you’ve seen the recent children’s animated film, Wreck It Ralph 2: Ralph Breaks the Internet, this acquisition of useful items is portrayed. People working within a game acquire items that help players get to another level—like a special tool, a faster car, or better weapons—and sell them for actual money online by transferring them to the buyer’s account within the game. It’s perfectly legal and allowable, but hacking someone’s account and using their credit card to purchase these things is not.

Epic Games claims the bug has now been closed, but again, changing your password is a good idea. At the same time, despite official announcements to the contrary, this is an excellent time to talk to your kids about connecting with other players in online games. Whether or not the hackers could eavesdrop on conversations doesn’t matter; the other people legitimately participating in those conversations might easily be bad actors, as well. Talk to your online game players about safe conversations, never divulging their personal details, and understanding how virtual items cost very real money.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: What Can a Thief Do With Your Driver’s License?

Data Privacy Day is an international effort to empower individuals and business to respect privacy, safeguard data and enable trust.

Many of today’s tech users have never navigated an online world where they weren’t constantly asked to provide personal details about themselves for everything from booking a doctor’s appointment to buying a new shirt. Too many tech users don’t do enough to protect their online privacy and secure their data, while also thinking that it’s “other people” who don’t protect themselves.

This is a trend that Data Privacy Day works to address. The Identity Theft Resource Center is the non-profit partner for this event, hosted on January 28th, 2019, by StaySafeOnline. Powered by the National Cyber Security Alliance, the upcoming event will focus on the changing privacy landscape and what that means for consumers, businesses, policymakers, and more.

The change is so rapid, in fact, that StaySafeOnline is referring to this age as a new era in privacy, and as such, the event will feature a wide variety of instructional sessions led by some of the top names in the field. With events available for both in-person attendees and live stream participants, Data Privacy Day stands to be a source of vital information to kick off the new year with a focus on security.

Of course, there are actionable steps that every tech user can implement right now to help secure their personally identifiable information and protect their privacy:

1. Understand—and put in place—good password hygiene.

2. Establish a family or company policy on how to respond to suspicious messages and what steps to take in the event of a possible privacy incident.

3. Install strong, trustworthy security software that helps block or delete attempted privacy threats.

4. Think twice about oversharing, whether it’s posting too much information on social media, responding to emails asking for identifying details, or handing over your data to third-parties.

5. Seek out the vulnerabilities that may already be a threat, like third-party apps, unsecure privacy settings in your social media accounts, software and operating systems that haven’t been updated regularly, and more.

Can’t be there in person? Watch live from LinkedIn, SF! ITRC CEO, Eva Velasquez will be joining privacy experts on the panel, “The Future of Privacy and Breakthrough Technologies” to discuss advances in technology, such as artificial intelligence to the human body acting as the computer interface, how privacy will take on even greater significance. Panelists will highlight why our actions now will drive tomorrow’s outcomes.

Just released – Download the 2018 End-of-Year Data Breach Report


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: Consumers at Risk: 126% Increase in Exposed Consumer Data, 1.68 Billion Email-Related Credentials

Your Passport and Your Identity

A recently-discovered data breach of the Starwood brands of Marriott International’s hotels has left consumers and security advocates alike scratching their heads. At the heart of this confusion surrounding the theft of data for around 25 million guests is passport security, or more accurately, the need to safeguard both your physical document and its number. So assuming that your passport was affected, what do you do?

As noted in the newest release published on January 4th, 2019, “Marriott now believes that approximately 5.25 million unencrypted passport numbers were included in the information accessed by an unauthorized third party. The information accessed also includes approximately 20.3 million encrypted passport numbers.” According to numerous sources including the US State Department, your passport number on its own is not a highly valuable piece of information for a hacker. However, when combined with some of the other data points that were compromised in this breach, your number could possibly be used to craft a more complete profile for identity theft – or allow for an identity thief to generate a synthetic identity with more validity.

First, if the physical document is lost or stolen, that is absolutely an urgent matter. You should report it to the proper authorities—namely the State Department who issues them—so that there is a record of the missing document. If it is used for identity theft or fraud, you will have already filed it as missing.

Read: What To Do If Your Passport is Lost or Stolen

But in the case of this data breach where only the number was compromised, your recourse is a little different:

1. If only the number and not the actual document is stolen, don’t be too quick to replace it. Since the number by itself does not directly result in identity theft, you may not be given a new passport free of charge. That means you’ll pay for the new document out-of-pocket.

In the case of the Marriott breach, if you can show proof that your passport was the cause of fraud or identity theft, they are offering to replace it. Read the specifics very carefully to understand what your recourse is in this particular case.

2. If the document was set to expire in the near future AND you were planning to replace it, there’s no need to wait if you can demonstrate that it was compromised. However, you may need to provide the notification letter or email from Marriott International to show why you’re requesting a new passport early.

3. When you decide to replace your passport, it will contain a new number (unlike driver’s licenses that retain their issue number, for example), but that doesn’t mean someone couldn’t still use your old number to piece together your identifying information. You will still need to monitor your accounts—especially travel-related accounts—carefully.

Read: What Can a Thief Do With Your Driver’s License?

This breach also serves as a cautionary tale about oversharing: unless you are required to turn over a piece of identifying information, think twice about submitting it. Many consumers take domestic flights and stay in hotels without even owning a passport; just because you have one doesn’t mean you have to provide the number every time it’s an option.

Finally, as if this wasn’t worrisome enough, there’s another potential threat that could be looming: scams associated with passports. With any high-profile event, scammers crawl out from under their rocks to take advantage of the public. Be wary of any email, text, social media post or other communication that plays off of fears surrounding compromised passport numbers.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.


Read: The Real People Behind Identity Theft Statistics

There were more than 184 million ransomware attacks around the world last year, and there’s no sign that this type of cybercrime is slowing down. If anything, the effectiveness and lucrative payouts for hackers could mean even higher numbers of attacks in the coming months.

Are you prepared? Is your workplace?

The first step is to understand how ransomware works. The culprits behind the attack can be some of the most sophisticated hackers in their field, or they may be nothing more than a low-level user who has purchased some malicious software on the Dark Web. A highly-skilled hacker can infiltrate your network, while a less adept cybercriminal relies on getting you to install the malicious software for them through a phishing email or other social engineering.

Once the harmful software is on your network, though, your files and system are locked up tight. The only way to regain access—and restore day-to-day business—is to pay the ransom and hope the criminal decides to give you the necessary decryption key. (In too many cases, the thieves made off with the ransom and refused to unlock the victim’s computers.)

One recent profile of ransomware victims demonstrated a couple of different approaches to dealing with an attack. In one instance, a city government was infiltrated; they decided to pay the ransom and hope for the best. In the other case, city officials decided not to pay the ransom and instead rely on the backups of their important files.

So who was right? It doesn’t matter. Every ransomware attack and every victim are different, so making a sound decision about recovery should be the work of the victim, law enforcement, and security experts.

But here are some things to consider:

  • While businesses are more likely to provide a bigger payout, criminals know that individuals might pay up in order to retrieve their precious photos, videos, stored content, and more.
  • Paying the ransom is absolutely no guarantee that a hacker will decrypt your files or unlock your computer.
  • The best defense against this kind of attack is to routinely back up all of your files and important folders.
  • Ensuring that you, your family members, and your company’s workforce can spot a phishing attempt and avoid installing harmful software will also help protect you.
  • A company-wide policy about never downloading unknown files, never clicking on links in emails, never opening unexpected attachments, and other dangerous behaviors can also secure your network from this kind of attack.

No matter what steps you take, it’s important to stay on top of cyberthreats and scam attempts. Regular company training and a comprehensive company-wide computer use policy can help protect your business network, and monitoring computer use at home can do the same. As always, installing and updating a strong antivirus solution to block these threats is important, too.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: “I’ve Hacked Your Password” Scam

Most consumers probably have some level of knowledge about identity theft and fraud. It might only be a passing familiarity thanks to news headlines about record-setting numbers of data breaches. For others, their deeper knowledge of this kind of crime may come from having already been victimized. As anyone who has had to navigate the aftermath of identity theft crimes can tell you, it carries a lasting—possibly even lifelong—impact.

So how much do you really know about this crime? (You can take this short quiz to find out!)

The Association of Certified Fraud Examiners, ACFE for short, wants to help every consumer be as fraud-aware as possible in order to reduce their risk of becoming a victim. The organization hosts an annual event each November known as Fraud Week, and together with the Identity Theft Resource Center will host a Twitter chat filled with important tips and information for the public.

International Fraud Awareness Week will run from November 11th through 17th, and while some of the information is geared towards preventing this crime within the business sector, there are plenty of resources for everyday consumers. You can sign up to host a local community education event, direct your company or business to informational webinars, and find ideas for posting on social media to raise awareness. One great item to share on your social media channels is this ACFE video on identity theft and fraud, for example.

Of course, joining the Twitter chat on November 15th is another great way to get involved and stay informed. The ITRC and ACFE will co-host the free event online at 3pm ET/12pm PT, and participants only need to log into their Twitter accounts and search for The #fraudweekchat hashtag to participate. Be sure to add the hashtag to all of your questions or comments so other participants and the chat hosts can see them.

Finally, one of the best ways to really understand the impact of fraud is to hear from the victims themselves. The ITRC’s annual Aftermath report compiles information from victim surveys, which were completed by people who reached out to the organization for help during the previous year. This information explores not only the financial impact of this crime, but also the mental, emotional, and even physical effects of being a victim.

To say that it’s up to the victims to prevent identity theft and fraud is wrong; in too many cases, the victim couldn’t have done anything to prevent the crime. However, there are ways consumers can reduce their risk, recover as quickly as possible, and minimize the lasting effects. Knowing how to recover from this kind of crime starts without knowing what preventive measures to put in place, what steps to take in the event of fraud, and what resources are available to help victims. It all starts with awareness, so make plans to be a part of Fraud Week.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: “Vote By Phone” Scam

Most consumers probably have some level of knowledge about identity theft and fraud. It might only be a passing familiarity thanks to news headlines about record-setting numbers of data breaches. For others, their deeper knowledge of this kind of crime may come from having already been victimized. As anyone who has had to navigate the aftermath of identity theft crimes can tell you, it carries a lasting—possibly even lifelong—impact.

So how much do you really know about this crime? (You can take this short quiz to find out!)

The Association of Certified Fraud Examiners, ACFE for short, wants to help every consumer be as fraud-aware as possible in order to reduce their risk of becoming a victim. The organization hosts an annual event each November known as Fraud Week, and together with the Identity Theft Resource Center will host a Twitter chat filled with important tips and information for the public.

International Fraud Awareness Week will run from November 11th through 17th, and while some of the information is geared towards preventing this crime within the business sector, there are plenty of resources for everyday consumers. You can sign up to host a local community education event, direct your company or business to informational webinars, and find ideas for posting on social media to raise awareness. One great item to share on your social media channels is this ACFE video on identity theft and fraud, for example.

Of course, joining the Twitter chat on November 15th is another great way to get involved and stay informed. The ITRC and ACFE will co-host the free event online at 3pm ET/12pm PT, and participants only need to log into their Twitter accounts and search for The #fraudweekchat hashtag to participate. Be sure to add the hashtag to all of your questions or comments so other participants and the chat hosts can see them.

Finally, one of the best ways to really understand the impact of fraud is to hear from the victims themselves. The ITRC’s annual Aftermath report compiles information from victim surveys, which were completed by people who reached out to the organization for help during the previous year. This information explores not only the financial impact of this crime, but also the mental, emotional, and even physical effects of being a victim.

To say that it’s up to the victims to prevent identity theft and fraud is wrong; in too many cases, the victim couldn’t have done anything to prevent the crime. However, there are ways consumers can reduce their risk, recover as quickly as possible, and minimize the lasting effects. Knowing how to recover from this kind of crime starts without knowing what preventive measures to put in place, what steps to take in the event of fraud, and what resources are available to help victims. It all starts with awareness, so make plans to be a part of Fraud Week.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Read next: “Vote By Phone” Scam