SEATTLE (KOMO) - It can start with a lost or stolen piece of junk mail.
Just a name and address, that’s all Brett Johnson needs to steal someone's complete identity in five minutes.
We’ve always heard from victims of identity theft, but now a former thief is out to educate the public on just how easy is it to profit on identity theft. He proved it by stealing my identity right in front of me.
“This is not just a crime, it’s an industry,” said Johnson, who was once on the Secret Service's "Most Wanted" list.
He’s admitted to identity theft, IRS tax fraud, social engineering attacks, breaches and hacking operations.
“I was not a good person,” said Johnson. “If there was some way to steal money from someone, that’s what I did."
He estimates he stole $4 million in his 20-year life of crime and spent six years in prison for his crimes, which included one escape attempt.
“I hurt a lot of people. Most people I don’t know, and at the time, I didn’t care," said Johnson.
HOW THIEVES STEAL YOUR IDENTITY:
He showed just how easy it has become to steal someone’s identity.
With just a piece of junk mail that had my abbreviated name and address, we went to an undisclosed website that could be accessed by anybody to buy my Social Security number.
He said the website started with a U.S. government hack years ago of nearly 170 million social security numbers, and crooks have continued to contribute Social Security numbers to the database as a way to pay it forward.
We found my name combined with the address on the junk mail and bought the Social Security number and birth date for $2.90 in bitcoin.
Johnson said federal agents routinely shut the site down, but “they (website operators) load up the database again, get a new URL and go."
THE BACKGROUND CHECK:
Next came a background check on me. There are many services that operate legally and are available to anyone such as Spokeo and Intelius, but Johnson said BeenVerified.com has become the choice for identity thieves.
“Most criminals tend to use BeenVerified because for $17 you can pull sometimes an unlimited number of background checks on any number of people,” said Johnson.
Typically he would use a stolen credit card number. He said he can buy those for just a few dollars on any number of sites that offer 10 tens of thousands of verifiable cards at any time.
“They will refund the money if it’s not valid, it’s all about customer service,” said Johnson.
We used real money to pay for the background check but Johnson would not typically get just one.
“I would pull a background check on you, but not just you, every single associate that's listed in your background check, I’ll pull background checks on them."
That way he could get mother’s maiden name, family connections and other info needed to clear security questions needed to get a credit report, which is the next step.
THE CREDIT CHECK:
There are a variety of free credit report websites, and we used Credit Karma.
With the Social Security number, birth date, all my addresses that showed up in a background check, family members, work info and more, he had all he needs to get a credit report on me.
And he could end up doing the same for my family members who appeared on my background check.
“Once I have this, I can open up credit cards, loans and use the credit history to start building up a 'synthetic identity.'"
It took just five minutes and opened the door to many other potential thefts.
HOW TO PROTECT YOURSELF:
To protect yourself, Johnson suggests registering with a good credit monitoring service and use a password manager.
But above all, this is is top suggestion:
“Freeze the credit of every single person in the house including the kids, one in four kids will be a victim of identity theft."
Johnson said it won’t stop identity theft, but will prevent new credit cards and loans from being opened in your name.
“If there’s a freeze, the thief won’t waste their time and move on to someone else,” said Johnson.
So much info from just a name and address off a piece of junk mail.