An identity thief stole $5,000 from me. I spent two years tracking down how. - The Boston Globe (2024)

And not near me, either. I live in Greater Boston, and the money was withdrawn 200 miles away, at a Bank of America branch in Saratoga Springs, New York. Apparently, a teller had handed over a stack of bills to someone impersonating me. In experts’ lingo, I’d entered the “identity crime ecosystem,” a mix of theft and fraud.

No one wants to be in that ecosystem.

The theft and misuse of personal data devastates victims’ finances and peace of mind, causing extreme stress and anxiety. In 2023, people reported losing over $10 billion to fraud, according to the Federal Trade Commission, which takes in reports from consumers about problems they experience in the marketplace and stores them in an online database available only to law enforcement. And people filed more reports about identity theft — accounting for 19.2 percent — than any other type of complaint. Identity fraud and related scams profoundly disrupted the lives of nearly 40 million Americans in 2023, according to Javelin Strategy & Research, an advisory services firm in the fraud and security sector.

Now I was one of them.

Two years ago, I was only dimly aware of this world of identity theft and fraud — it was abstract, part of a murky continuum of financial crimes aided by technology I’d only heard about. I lumped it together with data breaches, scam calls, credit card fraud, health care fraud, romance fraud, phishing, pyramid schemes, Zelle trickery, and more. It was hard to keep track of it all, and mostly I didn’t pay it much attention.

But on the advice of my adult kids, I had tightened up my security. Using my own paper shredder, or a service that shreds as I watch, I destroy my financial documents. I use strong passwords and two-factor authentication, and avoid opening suspicious attachments and answering phone calls from unfamiliar numbers. I don’t overshare on social media. I reduced the number of checks I write to avert check-washing schemes(when people intercept checks, use chemicals to erase the ink, then rewrite them). Now I take checks directly to the post office instead of dropping them in a mailbox where thieves can fish them out.

The closest I’d come to a brush with fraud was when a friend took me to dinner at a Chinese restaurant, and our conspicuously anxious waiter disappeared for 20 minutes with my friend’s credit card. The next day, he saw a $2,700 charge for airline tickets to China.

The credit card company gave my friend his money back, and we laughed it off.

I’m not laughing now. I’m still experiencing the aftershocks two years after the initial shock of being defrauded. It’s been mentally exhausting, and every time I’m notified of yet another data breach at a company that has my Social Security number — a “cybersecurity incident,” as a recent letter from a financial institution blandly termed it — my stomach drops. I’ve gone from being a trusting person to a very suspicious one, always on high alert.

For the past two years, I’ve worked to determine exactly who and what lay behind this crime, using resources available to me both as a victim and a reporter. To hear experts describe the situation, it can feel almost hopeless. “Here and there, there are arrests, and law enforcement will brag about it,” says David Maimon, director of the Evidence-Based Cybersecurity Research Group at Georgia State University. “But any arrest is a drop in the ocean.”

Yet that hasn’t stopped me on what’s come to feel sometimes like an obsession. I’ve met with law enforcement officials, studied court records, and interviewed criminologists, prosecutors, government officials, and counter-fraud experts. I’ve driven three times to upstate New York, sat through court hearings, and met with investigators — I’ve probably spent more than $1,000 to chase the $5,000 I lost. It’s the only way I could combat the helplessness I’ve felt by being violated so flagrantly.

I’LL PROBABLY NEVER KNOW for sure, but it may have happened at the wedding. As preparations for the reception were underway, I let down my guard, and someone may have noticed. Before the guests arrived, I’d left my purse on a chair inside and joined my family on the lawn for photos. A vague voice in my head warned me this was a bad idea. Another voice, the one that prevailed, was reassuring: “It’s your daughter’s wedding!” that voice said. “Nothing bad can happen today!”

I had a hazy recollection of something amiss in my wallet during that hectic week: my usually meticulously-placed debit card had migrated to a different spot in my wallet. Had I just been distracted?

Now I was worried the debit card number might’ve found its way to Saratoga Springs. How would I get my money back? What else did they take? What personal information did they have? Would they steal from me again?

And who the heck were “they”?

A financial adviser I know urged me to move fast to limit the damage. Fraud experts call this the “cleanup” — I came to think of it as a circle of hell. With guidance, I scrambled to protect my financial life, a miserable task that ate up more than a week. (Consider: The Federal Trade Commission’s booklet “What To Do If Your Identity Is Stolen” is 62 pages long.)

Among other efforts, I shut down my bank account and opened a new one, canceled cards, ordered new checks, changed my login credentials, and notified all the places I could think of where my account was digitally connected. I put a freeze on my credit through the three credit reporting bureaus so no one could open credit cards or accounts in my name.

I filed a report with my city’s police department, which is where I learned there were other ways my debit card could have been compromised, such as at an ATM or gas pump via a concealed “skimmer” that may have gathered my account information and relayed it to a thief.

And I fought hard for weeks with the bank to get reimbursed. The “How to Report Fraud” page of the Bank of America website emphasizes that “it’s important to call us immediately.” But when I called to report the theft shortly after discovering it, the bank’s lack of urgency was palpable.

That summer, I called back repeatedly for updates. Inevitably, I’d be placed on hold for as long as an hour — only to have someone robotically deliver the same piece of information: The bank was still investigating; it could take 60 to 90 days.

What are you investigating — me? I wanted to scream. I realize that $5,000 may not be a lot of money to a bank, and that I’m lucky enough that I wouldn’t be financially decimated even if I never got it back. While reporting this story, I talked to a friend whose elderly cousins lost more than $250,000 to identity fraud. But I’d also started to see that there are steep and lasting psychological costs behind the dollar figures. It’s about the money but not only that — it’s about something more visceral. And about so many other anonymous victims besides me.

As weeks passed, I grew increasingly worried and irate. By August 20, I’d had more than enough. That day, I packed a bag and set out on the 3½-hour drive to Saratoga Springs, fuming all the way along the Massachusetts Turnpike.

ONCE IN TOWN, I went into the police station to file a report, then walked the few blocks to the crowded branch of Bank of America. A manager approached me. “How can I help you?” she asked cheerily. I erupted with a force that surprised even myself. “You want me to tell you IN FRONT OF ALL THESE PEOPLE that somebody stole my money at this bank?” I said, not quietly.

She escorted me to her office where I spilled out the whole story. “How did this happen?” I asked. She studied her computer screen for a few minutes, then reported what she was deducing: Someone had actually come into the bank and spoken to a teller, presented a driver’s license, and then correctly answered some authentication questions to validate the account.

It sounded fishy. Even if this person had my debit card number, didn’t they need my pin number? And wasn’t a $5,000 withdrawal suspicious? In my 18 years as a customer with the bank, I’d never withdrawn that much cash. Also, I’m over 65 — technically an “elder” — and I knew from my previous reporting on elder exploitation that this should’ve sent up red flags. In 2016, the Consumer Financial Protection Bureau issued a report about protecting elders; among the warning signs that could signal a consumer is at risk were “uncharacteristic debit transactions.”

The manager called the bank’s fraud department herself, but fared no better than I had — same long wait, same bad music, same cheerless recording intoning “all of our representatives are helping other customers.” Finally, she told me she also needed to help other customers, and handed me the phone so I would stay on hold. Half an hour later a voice came back on the line, and I waved down the manager. It turned out the bank was still investigating, except now they said 60 to 90 business days.

“This is ridiculous,” the manager said, bristling. She made another call, this one to a vice president in Albany. He promised to “escalate” it immediately.

Three days later — two and a half months after the theft — the stolen $5,000 was back in my account. I was relieved, and enraged. Why had it taken so long? What if I hadn’t driven almost 400 miles round trip to Saratoga Springs and caused a scene at the bank?

And now I had something new to worry about: Fraudsters apparently had a driver’s license with my name on it. And this was very, very bad, as I would come to find out.

“Forget the fake IDs adolescents used to get into bars,” says Georgia State’s David Maimon, who is also head of fraud insights at SentiLink, a company that works with institutions across the United States to support and solve their fraud and risk issues. “Nowadays fraudsters are using sophisticated software and capable printers to create virtually impossible-to-detect fake IDs.” They’re able to create synthetic identities, combining legitimate personal information, such as a name and date of birth, with a nine-digit number that either looks like a Social Security number or is a real, stolen one. That ID can then be used to open financial accounts, apply for a bank or car loan, or for some other dodgy purpose that could devastate their victims’ financial lives.

And there’s a complex supply chain underpinning it all — ”a whole industry on the dark web,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a nonprofit that helps victims undo the damage wrought by identity crime.

It starts with the suppliers, Maimon told me — ”the people who steal IDs, bring them into the market, and manufacture them. There’s the producers who take the ID and fake driver’s licenses and build the facade to make it look like they own the identity — trying to create credit reports for the synthetic identities, for example, or printing fake utility bills.”

Then there are the distributors who sell them in the dark corners of the web or the street or through text messaging apps, and finally the customers who use them and come from all walks of life. “We’re seeing females and males and people with families and a lot of adolescents, because social media plays a very important role in introducing them to this world,” says Maimon, whose team does surveillance of criminals’ activities and interactions on the dark web. “In this ecosystem, folks disclose everything they do.”

THE SARATOGA SPRINGS POLICE got on the case quickly. It turned out the bank had a video with surveillance images of the transaction, and a judicial subpoena had been issued. A few weeks later, police secured the video as evidence.

My status as a “victim/reporter” came with some limitations, I was told by Saratoga County Assistant District Attorney Joseph Frandino. I was entitled to certain information about the crime, but not everything I wanted to know, since someday I could be called on to offer testimony.

I wasn’t allowed to see the video, for example, but police Investigator Vanessa Rose agreed to describe it to me. An older woman with dark hair, leaning on a cane, approaches the bank teller. She wears a face mask — COVID was still raging in June 2022 — but it’s pulled down beneath her chin. She chats with the teller and presents two items: a photo ID of some sort and another type of card (Rose didn’t tell me specifics). The teller hands over $5,000 cash. From my account.

Months later, when I speak with the police department’s public information officer, he suggests the woman in the bank wasn’t the brains behind the operation. She may have been a low-ranking “mule” working for someone else, Lieutenant Paul Veitch tells me — perhaps a US or international crime ring overseen by a mastermind he likened to Lex Luthor, the notorious archvillain in the Superman comics and movies.

In June 2023 — a full year after my money disappeared — I get a call from Investigator Rose. The security video had been shared with New York’s Capital Region Crime Analysis Center, where analysts have access to facial recognition technology, and was run through a database of booking photos. A possible match resulted. A suspect named Deborah was identified with an address in the Bronx. (I’m using her first name only, out of concern for potential retaliation.)

Then, on July 7, a Friday afternoon, Rose calls with surprising news. Deborah’s been arrested and her arraignment at Saratoga Springs City Court will be that night or the next morning. She was already in custody elsewhere in New York. Once again, I hit the road — I felt like I had to.

Evidently, Deborah was being sought by law enforcement in at least three New York counties. On April 18, 2023, according to a police report, she’d gone into a Citizens Bank branch in New Rochelle in Westchester County, presented an ID with another woman’s name, and walked away with $3,500. A bank employee had become suspicious and called the account owner to confirm she’d made the withdrawal herself. She hadn’t.

Two days later, an evidently emboldened Deborah went back to the same bank and tried to withdraw $4,000; this time, though, an employee recognized her and police were called. Deborah was arrested, but she didn’t show up in court that May to be arraigned, and a bench warrant was issued for her arrest.

On July 5 — just two days before she was arrested by Saratoga Springs police in my case — Deborah was sentenced to five years’ probation in Orange County, New York, for a 2019 offense. Court documents show she’d gone to a TD Bank in Port Jervis with a fake driver’s license and a fake TD Bank card. She tried to use them to get a new debit card, but it didn’t work. She was arrested.

There was more: She was also facing charges in Dutchess County, from a double-header on August 12, 2022. One set of charges stems from an allegation that she fraudulently withdrew over $3,000 from a bank in the town of East Fishkill, according to a spokesperson in the Dutchess County district attorney’s office. Less than an hour later in nearby Fishkill, she allegedly tried to cash a bank check at a KeyBank branch, presenting a fake Pennsylvania driver’s license. Court records show it didn’t scan properly, and police were called.

Deborah was arraigned on the East Fishkill charges, which are still pending, but never appeared in court for her attempted grand larceny charge in the Fishkill case, apparently because she was in the hospital for injuries stemming from an accident when she was trying to flee police, according to court records. There’s been an arrest warrant for her in that case since last August.

ON THE MORNING OF Saturday, July 8 — the date of Deborah’s arraignment in my case — the 152-year-old Saratoga Springs City Court felt imposing: It was an off-hours arraignment and Deborah was the only defendant. The room echoed with every squeak in the wood floor.

A police officer brought Deborah into the third-floor courtroom in a wheelchair. She’d been transported by police from the Westchester County jail to Saratoga Springs, according to Investigator Rose, and she was looking frail and haggard. In stocking feet, her gray hair in a tangle, she wore a white T-shirt and dark pants. Her hands were clenched in her lap. She looked much older than a woman born in 1956, her birth year according to a court document.

On this day, Deborah was being charged with two separate felonies: grand larceny in the third degree for stealing property over $3,000, and identity theft for assuming my identity and withdrawing $5,000 from my account.

The judge told Deborah that the victim was in the courtroom and warned her that he’d issued an order of protection to stay away from me. Another hearing was scheduled for August 17.

The public defender spoke up. Deborah, he said, had no means to go home — no money, no family, no friends to come get her. I exchanged horrified looks with the police officer. The judge left the courtroom for a few minutes, saying something about making a call to find transportation.

As Deborah was wheeled out past me, she spoke without making eye contact. “I’m so sorry,” she told me in a whisper. “I’m so sorry. I’m so sorry.”

BEFORE I SAW DEBORAH, I’d expected to feel angry, even outraged. Now, all I could feel was sad. There was a good chance she was only doing the grunt work for someone else, maybe even a domestic or foreign-organized crime syndicate, and then suffering all the consequences. It crossed my mind that maybe she, too, had somehow been victimized.

Deborah’s criminal record dates back more than 30 years across New York state and in New Jersey, but suggests a life of struggle more than malevolence. Drug offenses in 1989 and 1995. A prostitution charge in 2002. Trespassing in 2010. Forgery in 2019. Then all the bank activity.

It was Lex Luthor I really wanted to hate. I’d so hoped she’d expose him.

I drove back to the Saratoga Springs courthouse on August 17, 2023, for the next hearing. This time, Deborah didn’t show up. Nor did she appear for a November court date. I emailed Joseph Frandino, the Saratoga County assistant district attorney, to ask what had happened.

Bail reform happened, he replied. “Unfortunately (and we could spend the rest of the week talking about my issues with this),” he wrote to me, “due to NY State’s Bail Reform statutes, Deborah . . . was released from custody following her guilty plea in Orange County Court.”

The bail reform law, which took effect in New York in 2020, eliminated the requirement for defendants to put up cash bail for most misdemeanors and nonviolent felony charges. It was meant to limit incarceration of defendants in New York who couldn’t afford to get out on bail while their cases play out, according to the New York Civil Liberties Union. The nonprofit’s website says reform has been essential to “upholding due process, advancing racial justice, and protecting public health” during the pandemic.

“It is also working,” the website says. “People released under New York’s bail reform law are returning to court at high rates.” Too bad Deborah wasn’t one of them.

Her disappearance “is the most predictable outcome in the world,” Frandino says. She never came back to court, and now there were warrants for her arrest out of two separate courts. “In short, until she is picked up on the warrant, her case will remain pending,” he says.

In other words, she’s on the lam. “I can’t guarantee what will happen,” Lieutenant Veitch tells me. “But I would err on the side that this will happen again, and this person will commit this crime or similar crimes.”

NIKOS PASSAS, A CRIMINOLOGY PROFESSOR at Northeastern University, employs a catchy phrase to describe corporate practices that are within the letter of the law yet have adverse social consequences: “lawful but awful.”

Wasn’t this scenario stemming from New York’s bail reform lawful but awful, too? A suspect with a long criminal history is out on probation with warrants for her arrest. There are strong suspicions she’ll commit a crime like this again. But none of this is consequential enough for the courts to stop her. It seemed the law was on Deborah’s side.

Passas summed up the paradox: “Just because a state entity engages in an action they are entitled to, because it’s legal, doesn’t mean it’s the best public policy,” he said. “Legality is not the only criterion for good governance. We have to be aware of the consequences.”

One of the painful lessons I learned as a victim of identity fraud is how very awful those consequences are. It’s infuriating when you’re robbed of a lot of money and the bank takes its sweet time reimbursing you. “The general consumer cannot just drop that money without some huge effect on their finances,” says Suzanne Sando, senior fraud and security analyst for Javelin, the advisory services firm.

It’s agonizing to lay awake at night, picturing nightmarish scenarios in which all your money disappears and your credit is ruined. (They’re selling my info on the dark web! They’re using my debit card to open bank accounts! Taking out loans under my name! Laundering drug money!)

It’s horrifying to discover, as I have recently, that someone has set up a tech company that might not even be real, listing my home as its principal address. And to get notices, as I have, that someone is trying to hack into your social media accounts, with no way to tell if the notices are real or scams. Nowadays my heart starts to pound whenever I log into my bank accounts.

It’s disheartening to lose your sense of trust and security, to feel vulnerable, to live with dread. The Identity Theft Resource Center conducts an annual survey of identity crime victims. According to the 2023 report, 16 percent of identity crime victims who have contacted them say they’ve considered suicide as a result of having their identities stolen — double the number since 2020. Their comments are chilling:

“I have zero funds to even meet a friend for coffee or a drink. Therefore, I remain totally isolated and mentally not good. . . . I buy minimal food, so I go without good nutrition.”

“I lost all my data, photos, videos, documents. All access to existing accounts. New accounts show up every month.”

“Between time and calls, I was on the phone for more than 80 hours, and it is still not resolved.”

And here’s another lesson I learned: When someone steals your identity, don’t look to the feds to provide a seamless way to get help — there’s no singular group or agency driving the US anti-fraud strategy. The FTC’s identity theft guide, “Taking Charge,” lists a dozen federal government websites where you can report the crime or request advice. It’s overwhelming just thinking about navigating all of that. Several sites refer you to IdentityTheft.gov, ostensibly the FTC’s “one-stop resource to help you report and recover from identity theft.”

I started to report it, but stopped in utter disbelief when they asked for my bank account number, and the bank’s routing number. What were they thinking? How many fraud victims would volunteer that?

I’ve had no more luck at the state level. In February, I filed a consumer complaint with the Massachusetts attorney general’s office to report that someone used my home address to start a limited liability company. I haven’t heard a word back.

FOILED BY A LEGAL TECHNICALITY, unaided by government, I felt abandoned, left to dig out of this by myself. I wasn’t happy with my bank either, though Bank of America spokesman Bill Halldin assured me the bank does have safeguards in place to prevent fraudulent transactions, and that they’re always being updated. “There was identification presented and authentication questions answered,” he says, suggesting the bank followed its regular procedures.

“You’re pitting a teller against a national crime syndicate with massive resources behind them,” says Paul Benda, executive vice president for risk, fraud, and cybersecurity at the American Bankers Association. “They’re very well-funded, well-resourced criminal gangs doing this at an industrial scale.”

I was left to wonder: Why is fraud deterrence such a mess in this country? Does it have to be this way?

Not always, not everywhere. Fraud has also been a scourge in the United Kingdom, accounting for around 40 percent of all crime in England and Wales. As part of an ambitious fraud strategy announced last May, the UK poured the equivalent of $125 million into improving its law enforcement and intelligence response. It includes the launch of a National Fraud Squad with about 400 investigators.

In February, the UK launched a proactive national anti-fraud campaign — ”Stop! Think Fraud” — that could become a model for other countries. It provides victims with advice and guidance in a single, uncomplicated website. The campaign has just completed a wave of activity expected to be seen by 95 percent of adults in the UK, including TV and radio advertising, social media ads, and billboards.

Had I been robbed in England or Wales, I could have made a single call to Action Fraud, the national fraud and cybercrime reporting service. Action Fraud would have reviewed the report and tasked a police force to investigate it. Investigators would have put me in touch with another resource, the National Economic Crime Victim Care Unit (described, very Britishly, as “a bespoke service to victims of economic crime”), which supports victims and advises them on how not to fall victim again, given that their data is already out there.

I reached out to the Home Office — the lead department for policing in England and Wales — and asked if I could speak to someone involved in developing the policy. Astonishingly, I got a call back from the UK minister of state for security himself, Tom Tugendhat, whose position is somewhat analogous to the secretary of homeland security in the United States.

“We look at fraud as a whole-of-society challenge,” Tugendhat told me. “There are over 40 police forces in the UK, and some are better at dealing with fraud than others. So rather than organizing each of them separately, we decided to develop a [coordinated] approach. We are, sadly, part of a global fraud infrastructure, where in some places people are literally captured and used as unwilling operators for fraudsters. Fraud is a cruel crime that wrecks lives around the world.”

As a member of Parliament, he says, he’s had constituents come to him with “appalling” fraud stories. “Some are scammed out of large sums, other times small sums, but it’s not the amount — it’s the effect that counts,” he said. “Sadly, it leads to very, very serious mental harm and potentially even suicide.”

In March, the UK hosted the first-ever Global Fraud Summit, with over 200 leaders from government and law enforcement, as well as experts from banking and industry from 11 countries, including the United States. Officials who attended agreed on a global framework to tackle fraud and dismantle criminal networks.

Paul Benda, of the American Bankers Association, was one of the attendees. “There are many good efforts to fight fraud in the US,” he says, and the summit was a “great first step” toward more progress. “But there is no government-led coordinated strategy and no single agency in charge of developing a strategy or aligning resources. The US has to have someone herding all the cats.”

David Maimon suggests what’s needed is a “fraud czar” to oversee the broad issue of fraud and coordinate initiatives from law enforcement, government, financial institutions, and other stakeholders, “and then connect the dots. And find ways to disrupt the ecosystem.”

Clearly this will take time, as would the federal legislation proposed in April to address one strand of the fraud ecosystem. The Fraud Prevention and Recovery Act would crack down on pandemic fraud across government programs and help those victims recover.

But time is not on our side. In the time it’s taken me to write this story, I’ve received two more notices in the mail that my personal information may have been affected by major data breaches. Then a third such letter arrived, this one addressed to my husband, who died 10 years ago. We’re not spared the long arm of identity fraud even when we’re gone.

As I close in on two years of investigating my own case — following the tracks of investigators and officials — I’ve learned that an arrest in an identity fraud case does not necessarily bring closure or a sense of relief. I’ve experienced more frustration and more fear — a measure of the complexity of this ecosystem, and the speed with which it mutates, along with this country’s inadequate and uncoordinated approach to tackling it.

Kelli Ann Burriesci, deputy undersecretary for the US Department of Homeland Security’s office of strategy, policy, and plans, also attended the global summit in March. “I heard someone say there that this crime is working at the speed of money,” she told me. “And we are working at the speed of law.”

For me and millions of other victims of identity fraud, that isn’t fast enough. I’m guessing it suits Deborah and Lex Luthor just fine.

Linda Matchan is a former Globe reporter and frequent contributor to the Globe Magazine. Globe researcher Jeremiah Manion contributed research assistance to this story. Send comments to magazine@globe.com.

Linda Matchan can be reached at linda.matchan@globe.com