Introduction

It will never happen to me. That’s what we all say, and it’s usually true. Until it isn’t. How could this happen? I was so careful! I never shared my personal info with anybody. Sadly, your identity protection is no longer in your hands these days. Unless you live on a self-sustaining farm and avoid all interactions with society (in which case how are you on the Internet to read this blog?), your information has been shared with thousands of interested parties. I can’t confirm, but my particular case likely happened as a result of the data breach announced by Discover Card at the start of this year. I’m sharing my story not so that you can avoid it, as this is impossible, but so that you will be prepared if/when it happens to you, and hopefully to share some of the wisdom I gained.

My Experience

It’s the middle of the summer. I get home from a typical day at work, exhausted and ready to study for my looming certification. An odd piece of junk mail strikes my eye. Paypal Credit. Tired of the relentless advertising campaign, I’ve been sending them straight to the recycle bin. This envelope earns a second glance, however, because it reads, “Statement Enclosed”. Huh, odd. I don’t have a credit account with them. I open it up and see what appears to be a regular monthly statement. There’s a single charge from the previous month, $600 at Home Depot. Alarm bells are ringing in my head. What’s going on?

I immediately call the phone number on the statement. Once I finally reach a human representative, I can hear many voices in the background, and the representative has a strong Indian accent. I say this not as xenophobia, but to demonstrate that it sounds exactly like the fake Microsoft Support scam calls we all get. She is very friendly to me, but I become suspicious when she asks for my Social Security number. I consider two possibilities: (1) my identity was stolen and used to create this account, or (2) this is actually an elaborate scam to steal my identity. I raise this concern with her, and she immediately clams up and tells me I’m foolish because I’m the one who called her, and that she can’t help me without my SSN. I thank her and hang up the phone.

I don’t trust the phone number on the paper, so I search for PayPal Credit online. They’ve made it as hard as possible to find a human contact, directing you instead to their FAQ or their “chatbot” (glorified FAQ search). In my search, I keep getting redirected to “SoftBank”. This seems even fishier to me, and I start to wonder whether PayPal Credit is even real, although it eventually turns out this is the actual entity backing PayPal’s predatory credit product. I call the SoftBank number, which sends me to the same menu as the original one I called. I don’t trust this representative with my SSN either, so I hang up and start over. This time I find a number for PayPal itself (not Credit). I explain the situation, and they put me on hold as they redirect me to… the exact same call center. Realizing that this must be legitimate, I finally provide my SSN. She closes the account for me, assures me that I won’t be charged for anything, and recommends that I contact each of the three credit bureaus to dispute my credit report. I’m two hours in to the ordeal, and the journey has just begun.

I start at www.AnnualCreditReport.com. I fail one of the validations (every New Yorker has lived in so many apartments, how can we be expected to remember every zip code and street address?), so I can’t view my Equifax report, but I do pull up the reports from TransUnion and Experian.

[For anybody who’s keeping score, Equifax is the credit bureau that allowed a 2017 data breach to expose the private information of 147 million people. Want to vote with your wallet and take your business elsewhere? Too bad, you’re their customer whether you like it or not.]

Anyway, I look through the Experian report to figure out what I need to dispute. Obviously, the PayPal Credit account needs to go, but I also notice the Kansas address. What a find! I have the exact address of the person who stole my identity, right down to the apartment number. A quick Google search reveals this person’s name, age, family members, phone number, and current and former marital situation. I briefly consider calling them up, but I realize this isn’t the thief. This single mother is likely struggling to provide for her child. She bought my security number from the actual hacker out of desperation, not malice or greed. I’m a victim of that hacker and of the bloated credit industry. I do contact law enforcement, but I’ll leave everything to them.

After a bit of searching, I find a number to call Experian. It takes multiple tries, but I finally manage to outsmart the phone menu into connecting me to a human being. For all I can tell, this representative is sitting in the same room as the three from PayPal Credit! She has the same accent, and I can hear the same background chatter. I explain what happened, but she stubbornly follows the script. I’m certain she literally had a flowchart in front of her, because she didn’t respond to anything I said. At one point, I grow so frustrated at her repeatedly asking what date I opened the account that I start shouting. “What’s wrong with you?!?” She doesn’t even react, just repeats the question. After we handle the incorrect items, I also request fraud alerts to be set up for one year (seven-year alerts are only available by mail, not phone).I feel ashamed for shouting at her so I apologize to her at the end of the call. She takes this graciously and says, “Don’t worry, it happens all the time”, which makes me feel even worse.

On to TransUnion. After a similar struggle to locate a phone number and navigate the phone menu, I’m not surprised at all that the man I’m speaking to has the same Indian accent and seems to be in the same room as the previous four people. If the Experian lady was following a flow chart, this guy is using a flow line. At this point, I’ve come to appreciate the nihilistic absurdity of my situation, so instead of growing frustrated I laugh to myself and politely comply with his procedure. Finally, I finish disputing the account and address with TransUnion, thank him, and hang up. The fraud alerts apply to all three agencies, so at least I don’t have to do that part again. I still have to contact Equifax. I wait on hold for an hour, then give up and decide to call them tomorrow. At this point, it’s past my bedtime, and I’ve been dealing with the issue from the moment I got home (with a short break for dinner). I also haven’t touched my study books at all.

I call Equifax from work the next morning. Surprisingly, I’m patched through in minutes. I guess there’s lower call volume during the day. Keep in mind that I was never able to access my Equifax credit report, and I’m now locked out of it for the next year because the system thinks I already saw it. After a lot of back and forth, I guess at the format and contents and request that the representative remove the incorrect items. However, I make an off-hand remark that the account isn’t mine because my identity was stolen. At this point, he says, “If this was fraud, I need to redirect you to the Fraud Department.” Utterly exhausted, I don’t want to explain to yet another person what happened, and I know that they’ll give me the same generic recommendations as the first two credit bureaus. I backtrack and say, “No fraud, this is my account, but I want it removed from my credit report.” You’d expect him to question this sudden change of heart, but he simply complies and we wrap up.

Conclusion

Did I learn anything from my experience? I was very disappointed to learn that all these large critical companies have outsourced customer care to people who are unlikely to understand the situations they’re presented with. Perhaps it’s necessary in order to provide modern services at scale, at least until automation is good enough to handle any edge case that I might ask about while calling for help. I was disappointed in Discover, Equifax, and all the other companies who handle sensitive customer information in a careless fashion. I was disappointed in myself, that difficult circumstances were able to bring out the worst in me. I don’t blame the hacker (don’t hate the player, hate the game) who was taking advantage of faulty security in a system that should have security as its number one priority. I especially don’t blame the desperate single mother who sought to buy supplies to repair her apartment. I ultimately did not even file the police report after speaking with my local police officer, although that could be attributed equally to laziness towards filling out the forms. Overall, the situation was unpleasant to handle, but it did not upset me at a personal level. Nobody involved was trying to directly harm or inconvenience me, even though that’s what ultimately resulted. I laugh at the absurdity of having to make passwords with an uppercase, lowercase, number, and symbol when these same companies turn around and save those passwords in a form that can be stolen. If this happens to me again, I’ll know who I need to call and how I need to interact with them, and I hope you are more prepared as well.