Identity protection and shredding

Factual Questions
1

For a long time I’ve been in the habit of shredding pretty much anything with my name and address on it, including address labels from Amazon and envelopes for birthday cards. Am I going too far? Maybe once upon a time it was useful, but it’s so easy to obtain basic information about people that protecting my address seems…useless. After all it’s on every return label I affix to a piece of snailmail.

For that matter, do I need to be aggressive about shredding things like credit card offers? Is any criminal in 2014 still going through trash (or recycling) for things like this or is all identity theft digital?

Clearly there’s an element of IMHO in where one draws the line but I’m hoping there are some facts Dopers can provide to help me out.

2

I really don’t shred anything unless it has some kind of account number on it. I mean, a credit card offer? What good is that? If I can apply for a Discover card via the the ‘pre-approved’ BS you got in the mail, I can apply online in your name as well.

Also, an Amazon shipping label, that’s going too far. Your name and address are online, if someone wants them, they can get it there. Also, people are probably just going to grab something out of your mailbox, not your garbage anyways so unless you grab the stuff from the mailman right away and not after work when it’s been in there for two hours, it’s probably pointless.

Now, credit card statements with your full account number, that’s a different ball game. In fact, I switched every billing statement I could to online just to avoid the hassle of having to shred all that stuff. I really don’t understand why they put it on there. IMO, there should be a different number on there that can be used to talk to customer support but that has nothing to do with your actual card number that way when I’m done with my statement I can just toss it out. I think that probably would have done away with a lot of fraud during the 90’s.

3

At home we shred anything and everything that has our name on it. It doesn’t matter if some account number is there or not. Yes, we even shred Amazon labels. Too much? Well, I’ve been hit four times with potential identity theft (two through my employer, one from my bank, and one through the recent Home Depot breach) so yeah, maybe too much since all the breaches were not caused by me. Then again, just one instance of successful identity theft can take up to ten years of your life to correct. In the mean time, you can lose your job, your house, insurance, etc., thanks to bogus accounts and fake activities in your name.

The latest game is being SWATted by the police. A few hours of agony, misunderstanding and guns pointed at your head. A “successful” SWAT using identity theft will probably get you jailed for a bit, a few thousand in bills and years to correct.

At work we recently upgraded all of our shredders. We used to use shredders that shredded paper into long thin strips. Apparently that doesn’t make current federal security requirements. So now all of shredders turn paper in tiny squares (chad), making it impossible to resurrect documents.

Still think I’m paranoid? I often get polite requests from selected coworkers to help decipher documents and address information. Seems I have a knack for deep Internet searches. (I purposely did not say web.) You would be surprised how a name and a simple number, even an Amazon address label, can reveal within five minutes and knowing how to deep search. What I do is legal. Imagine someone who does it for other not so legal reasons.

If we’re both being chased by a bear, I only need to run faster than you. I’ve caught people going through the neighbor’s recycle bins at 5am. No telling who went through them overnight. Some are just looking for aluminum and glass, but some go for documents.

You see it’s not always about identity theft. So many people leave just enough clues (outside of names and account numbers) it doesn’t take rocket science to build portfolios of an entire neighborhood. Not hard to determine who has expensive toys than can be fenced. Add in a few other details, will you be robbed when away at work, or the two weeks you’re gone on vacation? Yeah, that’s what insurance is all about. So tell me, if the folks you know who have their house robbed, do they every feel secure in their home anymore?

The law says I have to carry registration and proof of insurance in my vehicle at all times. But the law doesn’t require them to be original documents. My insurance company supplies me with with my insurance cards, with just my name and policy number. No address. My photocopied vehicle registration has my name on it; the address is blank. That’s because of the shopping mall and movie scam. Someone sees you go to the movies. They know you will be gone at least two hours. That’s long enough to smash the car window, check the registration for an address, then hi-tail it to where you live. Barring any kids, the dog or an alarm system, they have two free hours to ransack your place.

But, you know, if all they grab is your laptop/tablet, and maybe a few papers adjacent, there should be enough unencrypted account numbers and passwords, by the time your report the laptop theft, your accounts were robbed much earlier.

Just shred everything with your name on it. Seems to me an ounce of prevention really is worth the effort.

4

And be sure to wipe clean all your home computer disk drives every morning when you leave for work.

5

I actually burn my house down each day and hire ninjas to guard the ashes while I’m away. Rebuilding is hard after a long day’s work, but no one has broken into it yet.

I mean, all someone has to do is watch me back out of my driveway at 7:45 and they know I’m gone for the day. It only takes a few minutes to rob the place.

I still can’t see the point of shredding things just because they have your address on them when all the bad guy has to do is look at your house to get your address. If they want your name it’s on the city assessor’s website (and probably whitepages . com if you didn’t take it down).

6

You seem highly motivated. So consider this. A profile complete with social security number can be purchased in bulk for less than a quarter a pop. A single profile isn’t worth squat and a you can’t protect yourself against your main vulnerability which involves being a part of a larger database. Admittedly, I do shred stuff that has my social sec on it anyway.

You also said, “It’s not always about identity theft.” True. I’m just saying it helps to order and categorize the various risks and not think of them en masse. At best that leads to paranoia, at worst to false security. Or maybe I have that reversed.

Nice trick with the registration and proof of insurance. I suspect though that most crims operate at several levels below that of Moriarty.

Incidentally, I do my online banking in Linux and am a regular reader of Krebs on Security. I do not use a debit card because it has less de facto protection. I am applying for an IRS PIN. So we are in a sense kindred spirits. That said, I’ve somehow managed to become a victim of identity theft twice. It is a hassle, though it’s more manageable now thanks to certain federal legislation.

7

Are there credit card companies that still print the full account number on the bill? All mine only say “account ending in xxxx” on the bill.

But I think people have become pointlessly paranoid about such things.

Shred anything with your name and address on it – you mean like the million phone books that are delivered to every house in the city, which include this info?

Or your bank account number – the one that’s on the bottom of every check you write to anybody. (A friend who manages a local bank told me about a customer who called her about a problem with their account, at their bank, that they wanted her to fix – but they refused to give her the account number! And then seemed upset that she could look it up from their name.)

I think this paranoia is being encouraged, because it distracts people from the real problems with the lax security & data breaches by the big companies in our financial system.

8
  • I’m not in any phone book.
  • I don’t need to write checks anymore. My bank does direct money transfers for my bills. I have to approve everyone manually.
  • I’ve seen identity theft with my own eyes. As I said, I only have to be ahead of you and the bear.

I knew I would meet with the standard Doper ridicule with my post and appreciate the kindred spirits comment.

I’m a fed. In one of those “other duties as assigned” quirks my ability to search the deep Internet brought me in contact with my agency privacy officer. He gets paid to be paranoid about your identity, and much of what I posted came from him. The best advice that really is available to every one is Krebs on Security, as you posted. If you spend the time to read through his posts there are lots of nuggets of what is really going on.
[ul]
[li]Lots of low-level punks out scamming for easy pickings. Shredding and basic common sense works best with these types.[/li][li]Social Security Numbers are so passe now. The media harps on them because it’s easy to report, a sideways slam at the government, and it has a scaremongering effect (good for their hyped ratings).[/li][/ul]
The real topic is big money, millions of dollars to fuel gangs, drugs, guns, terrorism. If your identity is caught up in these big scams, it’s essentially meaningless because it’s only part of a massive fraud. If you are vigilant, by the time your own name is vulnerable, the big money already has their cash and it’s the secondary/tertiary script kitties trying to recoup their tiny investments in the scam by going after individual identities.

9

But people don’t just throw checks in the garbage, they hand them to people who, in turn, give them to the bank.

This reminds me of my shredder at work. It has a slot to shred credit cards. I have my own way of destroying credit cards, but this is a cross cut shredder so I stuck my credit card in the special slot just the way it was oriented in the picture (vertically). Just like this.. For some reason, I decided to open the bin to see how it looked after getting shredded. Turns out that top part doesn’t cross cut, it just straight cuts and when you put a credit card in there vertically it leaves (somewhat due to luck) the entire number, in tact, on one strip. :smack: All they need to do is rotate that picture so the card is the other way and all the numbers would get chopped up and separated.

10

I’m not so worried about the break-in tricks, Duckster, I have a dog with a healthy bark who looks intimidating if you don’t know her. I doubt any smash and grab guy would try it–easier pickings elsewhere.

You sound like you’ve gone farther than I’m going to, but I appreciate your cataloguing all the things one can do. But so far my takeaway is that shredding everything with my address and name is a waste of time.

I’ll keep on shredding stuff like credit card applications and anything financial though.

11

I have no snark for those that shred. I, however, shred only client medical records 7 years after I close the file.

None of my personal mail, including credit card statements, goes to a shredder. I’ve had my check book stolen out of my kitchen drawer (by friends of a house sitter), but never any problem from lazy mail disposal habits.

If someone wants to go through my recycle bin every other Thursday night, more power to them.