Identity theft is a phrase that would frighten anyone these days. It’s bad enough to think of someone stealing our hard-earned cash, but to have a total stranger set up credit card accounts or fake tax returns using your personal information as a template? That’s a terrible thing to deal with, and it can be difficult to recover from.

Identity theft, defined by Webster’s: “The illegal use of someone else’s personal information (as a Social Security number) especially in order to obtain money or credit.” That’s pretty clear. Criminals — online and in the real world — want to steal our money however they can get it. This theft often starts with a stolen credit card number.

Before we go much further, there is one thing to address. Virtually all our credit card numbers are already in circulation in what’s known as the Dark Web, the criminal underworld of the Internet. Some have been intercepted from unsecured website transactions or otherwise fraudulently obtained, some acquired as the result of other crimes and a lot more have simply been generated by intelligent crooks who have the formulas to generate usable numbers themselves.

That’s no reason to go into a panic right now. The major credit card servicers all provide fraud protection for consumers these days, and it’s become such a numbers game with the sheer volume of payment card information in play that the chances of becoming a victim are not that great. Don’t get me wrong, it very likely will happen, just probably not often. Additionally, your banks and credit unions have people on staff to help you prevent card fraud and recover from it when it happens.

Having your credit or debit card information stolen does not necessarily mean your identity was stolen. True identity theft requires a lot more of your personal information to cause damage. The thief must get his hands on your name, address, date and place of birth and/or the crown jewel — your social security number. With this information, he or she can create a whole new fraudulent version of you for profit. Ultimately, you end up paying for in stress for all the effort to recover from the theft and perhaps in a lot of unrecoverable cash.

The threat is here to stay as long as it’s profitable. In a 2015 research study, the Identity Theft Resource Center called identity theft the “No. 1 consumer complaint in 15 consecutive years.” In many cases, the thief gets hands on a child’s personal information and builds a fraud profile with that. By the time the child grows up and the crime is discovered, the damage is done and the impact severe.

That’s the nastiest way for crooks to profit from identity theft. Here’s the scenario: the bad guy collects information on new birth announcements from various sources to get names and birth dates. With a name and a birth date, he can track down the child’s social security number then start using all that information to get credit cards, maybe even online loans, and create a disaster that goes on for years. I won’t publish what sources and methods he uses, but there are inexpensive ways to get the data. The best way to prevent this particular kind of identity theft is to include your children in any credit monitoring you may choose to do, either on your own or through a paid service.

Speaking of credit monitoring, the companies you see advertised on television provide a terrific catalog of services in this area, and some even offer insurance when theft happens, but they can be pricey. Do your research and due diligence if you want to look into this option.

There are also a number of relatively simple things to do and habits to develop to protect yourself from identity theft, whether you pay for monitoring or not. The National Credit Union Association, who my organization reports to for these matters, offers some great advice on this.

But for starters, this is what I teach my employees:

— Get in the habit of reviewing your financial accounts at least once or twice a month for suspicious charges. Look for small “tickler” charges of a few dollars. Thieves use these to make sure the card works before they go to town with it. You will see charges that don’t ring a bell; most of the time they’ll be legitimate, but the company listed may be the holding company that owns the business you bought from. If something doesn’t look or feel right, call your payment card servicer immediately, and make sure they have your cell phone number. You don’t want to have a voicemail from them on this waiting for days at home.

— Never carry your social security card or number with you, or use it for identification purposes. This is the Holy Grail for identity thieves. While it doesn’t have your birthday on it, it has enough with your legal name and number that they can get the rest.

— Use complex passwords on your banking and financial websites of at least eight to 10 characters. Think of a favorite novel or movie, then replace letters with similar characters. For example, “Gone With the Wind” becomes “G0n3_W1th_th3_W1nd.” This greatly increases the time it takes a thief to crack your password. Never use the same password for every website. If a thief learns one password, he will try it on every other website he thinks you use.

— Consider a Credit Freeze on your credit bureau accounts. You’ll have to lift it to apply for new credit, but it will keep unauthorized people from applying for credit with your information and will alert you if they do. The three main bureaus charge $10 for this.

— Get a credit report at least annually to make sure there are no errors, and review your children’s, too.

The Holy Grail for cybercrooks is a valid Social Security number. With that, they can create a whole new virtual person.

I mentioned the real-world threat of identity theft. There are mutts on the street who use physical methods to try and get your personal information, and they’re just as tricky. Card skimmers and proximity readers have gotten a lot of attention in recent years, so let’s look at them to start.

Card skimmers are small electronic devices that crooks attach to ATMs and gas pumps to intercept and collect your card information as soon as you insert it for a transaction. They’re usually small enough to escape casual notice, and the user never notices them. The bad guys usually attach them in the wee hours of a Sunday morning, when most businesses are closed, and retrieve them later while we all sleep. Get in the habit of giving the card reader a little tug or jiggle to make sure it’s really part of the device. If there’s any movement at all, notify the owner of the terminal immediately.

Proximity readers are subtler and controversial. There’s a modern variant of the old pickpocket “bump-and-grab” technique, but in this case the thief doesn’t physically get your wallet, he has a device in hand that reads and stores the information on the cards in your pocket. In a crowded environment like a subway or elevator, you can see how easy this approach might be.

Personally I have not seen this technique demonstrated successfully. I have also not figured out how such a device would isolate the data from individual cards when they’re stacked next to each other in my wallet. However, it’s absolutely feasible from a technical perspective. There are a lot of companies marketing wallets with shielding to prevent this kind of event. From what I’ve seen they don’t cost any more than any well-made wallet, so by all means use one if you want to.

Now that we’ve gone over how the bad guys can steal your identity and credit cards, what’s the worst that can happen if it happens to you? Well, frankly, it can put your entire life on hold for a long time while you get it resolved. The Federal Trade Commission estimates that recovering from identity theft takes an average of six months and 200 hours of work, most of which has to be done by the victim. It involves all the communication with creditors, credit bureaus, law enforcement agencies, insurance, if need be. You can’t buy a house, a car, etc., if you have to wait to prove you’re a victim before you can replace everything that was stolen. Also, your credit score will likely be trashed until the whole process is through and done.

Panic now.

Identity theft is probably the most damaging kind of cyber crime. It can literally change your life. But if the worst happens and you suspect your identity has been stolen, contact your banks and credit card companies immediately. They will assist you with locking down all your accounts and guide you on the road to recovery. Take steps now and hopefully you’ll never have to go through any of this.

Featured image: iStock