Posts

Your Passport and Your Identity

A recently-discovered data breach of the Starwood brands of Marriott International’s hotels has left consumers and security advocates alike scratching their heads. At the heart of this confusion surrounding the theft of data for around 25 million guests is passport security, or more accurately, the need to safeguard both your physical document and its number. So assuming that your passport was affected, what do you do?

As noted in the newest release published on January 4th, 2019, “Marriott now believes that approximately 5.25 million unencrypted passport numbers were included in the information accessed by an unauthorized third party. The information accessed also includes approximately 20.3 million encrypted passport numbers.” According to numerous sources including the US State Department, your passport number on its own is not a highly valuable piece of information for a hacker. However, when combined with some of the other data points that were compromised in this breach, your number could possibly be used to craft a more complete profile for identity theft – or allow for an identity thief to generate a synthetic identity with more validity.

First, if the physical document is lost or stolen, that is absolutely an urgent matter. You should report it to the proper authorities—namely the State Department who issues them—so that there is a record of the missing document. If it is used for identity theft or fraud, you will have already filed it as missing.

Read: What To Do If Your Passport is Lost or Stolen

But in the case of this data breach where only the number was compromised, your recourse is a little different:

1. If only the number and not the actual document is stolen, don’t be too quick to replace it. Since the number by itself does not directly result in identity theft, you may not be given a new passport free of charge. That means you’ll pay for the new document out-of-pocket.

In the case of the Marriott breach, if you can show proof that your passport was the cause of fraud or identity theft, they are offering to replace it. Read the specifics very carefully to understand what your recourse is in this particular case.

2. If the document was set to expire in the near future AND you were planning to replace it, there’s no need to wait if you can demonstrate that it was compromised. However, you may need to provide the notification letter or email from Marriott International to show why you’re requesting a new passport early.

3. When you decide to replace your passport, it will contain a new number (unlike driver’s licenses that retain their issue number, for example), but that doesn’t mean someone couldn’t still use your old number to piece together your identifying information. You will still need to monitor your accounts—especially travel-related accounts—carefully.

Read: What Can a Thief Do With Your Driver’s License?

This breach also serves as a cautionary tale about oversharing: unless you are required to turn over a piece of identifying information, think twice about submitting it. Many consumers take domestic flights and stay in hotels without even owning a passport; just because you have one doesn’t mean you have to provide the number every time it’s an option.

Finally, as if this wasn’t worrisome enough, there’s another potential threat that could be looming: scams associated with passports. With any high-profile event, scammers crawl out from under their rocks to take advantage of the public. Be wary of any email, text, social media post or other communication that plays off of fears surrounding compromised passport numbers.

Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.


Read: The Real People Behind Identity Theft Statistics

There is something truly terrifying about the thought of losing your passport. It brings to mind being mugged in a third world country and unable to get home. More often, the situation is nothing as exotic, but it can be very stressful nonetheless. A lost or stolen passport is a very serious situation, even when you don’t need it to re-enter the United States. The reality is that a lost or stolen passport, or the loss of your passport number through a data breach, can mean more than the pain and expense of getting a new document. It can also lead to serious cases of identity theft. So if you find yourself with a lost or stolen passport document, or stolen passport number, you want to be sure that you handle the situation appropriately and quickly.

Here are the steps you want to take if your passport document is lost or your passport document or number is stolen:

1.Call the State Department’s office with any questions at 1-877-487-2778 (TTY 1-888-874-7793).  They have representatives that can help you fro

m 8 am to 10 pm Eastern Time, Monday-Friday and 10 a.m. to 3 p.m. Eastern Time on Saturdays.

2. You can report a lost or stolen passport via mail, phone, or online. In all instances, you will need to fill out Form DS-64: Statement Regarding Lost or Stolen Passport.  This is incredibly important to do as soon as possible after the discovery of theft or loss in order to avoid the use of your passport for illegal activities including, but not limited to, criminal identity theft.

3. Once your passport has been reported lost or stolen it is invalid and cannot be used again. You will need to apply for a new passport in person by filling out Form DS-11: Application for a U.S. Passport. A specialist will take a report over the phone and your passport will immediately be deactivated.

4. If your passport was stolen, file a police report. A crime has taken place and should be reported to the police. Also, you never know when you may need proof that the document was stolen. In most places, you can file a police report for a non-emergency online. If the passport went missing from a home burglary or a stolen purse, make sure to specify that the passport is among the things missing.

5. If your passport number was stolen in a data breach, but you still have your passport in your possession, there is no way to flag your passport to alert authorities.  Passports numbers can be used in conjunction with other pieces of personally identifiable information (PII) to commit criminal identity theft.  Contact the National Passport Information Center at 1-877-487-2778 or NPIC@state.gov for more information about the steps that can be taken if you are concerned your passport number may be used by someone other than you.

Losing a passport or having one stolen can be scary. However, if you follow the above steps you will be back to your jet-setting ways in no time… or 2-4 weeks. More importantly, you have taken steps to protect yourself against the chance of identity theft.

Anyone who believes their identity has been stolen or their personal data has been compromised is invited to connect with the ITRC through our toll-free call center at (888) 400-5530 or on-the-go with the new IDTheftHelp app for iOS and Android.