This document discusses the growing threat of identity theft and how employers can help protect employees. It notes that over 90% of passwords are hackable and criminals are increasingly organized in stealing and selling personal data online. Identity theft comes in many forms and can have serious financial and legal consequences for victims. As such, many employers are offering identity protection services as a benefit to help insulate employees from stress and costs associated with identity theft. The document recommends employers match the type of identity protection offered to the specific risks employees face, such as credit monitoring for financial data or healthcare monitoring for medical information. It then describes the features of one identity protection service called MyIDCare that provides comprehensive monitoring, concierge support services, and assistance recovering from

1. Question?
866-726-4271
info@idexpertscorp.com
WHITEPAPER
More than 90% of
user-generated
passwords are
vulnerable to
hacking.
— Deloitte
¹ https://www.buzzfeed.com/josephbernstein/survey-says-people-have-way-too-many-passwords-to-remember?utm_term=.ajY78qg7Z#.jkNYm9KYG
² https://finance.yahoo.com/blogs/the-exchange/password-isn-t-safe-90-vulnerable-hacking-213820350.html
³ http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/
4 http://www.pandasecurity.com/mediacenter/pandalabs/pandalabs-q3/
5 https://blog.barkly.com/cyber-security-statistics-2017
6 https://phishme.com/ransomware-delivered-97-phishing-emails-end-q3-2016-supporting-booming-cybercrime-industry/
7 https://en.wikipedia.org/wiki/Darknet
1
Your Employees at Risk: The New,
Dangerous Realities of Identity Theft
How to put their safety first with a new generation of identity protection benefits
Identity theft might seem like a crime
that hits the “other guy.” Not you. Not
your family. Not your employees. But
we live in a digital, hyper-connected
age where personal information
is generated and disseminated at
lightning speed—all of which is
vulnerable to theft by smart,
tech-savvy criminals.
The list of personal information accessible to
thieves is long: full names, home addresses,
email addresses, Social Security numbers,
financial information, account numbers, date
of birth, passwords, medical records, and
health insurance. An Intel Security survey
found that the average person has 27 discrete
online logins.1
And according to Deloitte, more
than 90 percent of user-generated passwords
are vulnerable to hacking.2
Information that’s Easy for the
Stealing—and Selling
Hackers are becoming increasingly more
organized and adept at stealing and exploiting
personal information for profit. For example,
ransomware has almost become a byword
in the healthcare space—accounting for 72
percent of the sector’s malware attacks in
2016, according to Verizon.3
And according to
a PandaLabs report, 18 million new malware
samples were captured in Q3 2016 alone.4
When it comes to infecting computer systems
with this malware, employees often are
unwittingly complicit. Phishing attacks in
emails lure people to click on questionable
links that contain malware. In one German
study, only 20 percent of people said they
clicked on a link in a simulated phishing
attack over email and Facebook, but 45
percent actually did so.5
A single click can
have disastrous consequences: One study
found that more than 97 percent of phishing
emails contained ransomware in Q3 2016.6
Whether conducted by state-sponsored
hackers, organized criminal groups, or others,
these attacks cause data breaches that leave
sensitive personal information vulnerable to
exposure and theft. Not surprisingly, criminals
have become skilled at monetizing stolen
identities on a massive scale. One of the
reasons for this is the “Dark Web,” the web
content that exists on so-called darknets,7
limited-access sites that overlay the public
Internet and are often used for illegal or
criminal activity. The Dark Web offers cyber-
18 million new
malware samples
were captured in Q3
2016 alone.
— Panda Security

2. 2
Identity fraud
affected over 15.4
million Americans
last year, about 10%
of the workforce.
— Javelin Strategy &
Research 2017 Identity
Fraud Study
criminals global marketplaces in which to
sell stolen personal information. The abilities
to steal and easily sell massive amounts of
personal information have transformed the
economics of information theft.
It’s no surprise, then, that identity theft in all
its forms continues to grow, risking the well-
being of employees, customers, and others.
Recent research highlights the problem (also
see Figure 1):
•• Identity fraud affected 15.4 million
Americans in 2016, up 16 percent
from 2015.8
•• The number of U.S. data breaches recorded
in 2016 set an all-time high of 1,093—a 40
percent increase from 2015.9
•• More than 7.1 billion identities have been
exposed in data breaches in the last
8 years.10
The Frightening Faces
of Identity Theft
Just as the volume of identity theft has
exploded over recent years, so has its
complexity, thanks to the digital age. A single
individual has far more personal information
online than one might think. For example, one
company compiled the Facebook ad-targeting
options to demonstrate the vast scope of
personal information advertisers can use to
target consumers using social media:11
•• Location
•• Demographics, including age, gender,
and ethnicity
•• Work, including employer, job title, and
industry
•• Education
•• Financial, including income level, purchase
behaviors, banking, and investments
•• Home, including type, ownership/rent, and
household composition
•• Family and relationships
•• Hobbies and activities
•• Technology, including type of mobile device,
primary email domain, and operating system
and Internet browsers used
•• Vacation and travel
•• Charitable donations
Thieves can use this publicly posted
information to access profitable data, like
credit card and Social Security numbers,
healthcare information, email addresses, dates
of birth, and much, much more. What may
have once seemed a straightforward crime
has become a lot more complicated; in fact,
nine categories of identity theft have been
identified:12
Financial Identity Theft
This is the most common form of identity
fraud. Criminals use stolen credit cards or card
numbers to purchase goods and services. If
it’s not detected in time, credit card fraud can
consume a victim’s accounts and affect their
credit rating. In addition, thieves can use stolen
bank account numbers, debit card numbers,
or other personal and financial information to
wipe out accounts, take out loans, or get new
credit cards.
Child Identity Theft
Children tend to have little or no financial
history, and thieves assume that no one is
checking a child’s credit report. Criminals can
use a child’s Social Security Number to falsely
claim dependent children or welfare payments
from the government, and to create fake ID
documents that they can use to apply for
loans or even commit crimes. When the child
becomes financially independent, they may
find their credit rating is ruined.
8
Javelin Strategy & Research 2017 Identity Fraud Study
9
http://www.idtheftcenter.org/2016databreaches.html
10
2017 Internet Security Threat Report, https://www.symantec.com/security-center/threat-report.
11
https://www.inc.com/larry-kim/you-wont-believe-all-the-personal-data-facebook-has-collected-on-you.html
12
https://www.myidcare.com/9-types-of-identity-theft

3. 3
Social Security Theft
Social Security numbers are one of
the most valuable pieces of personal
information stolen in data breaches.
With a Social Security number thieves
can access a victim’s taxes and work
history, bank accounts, credit cards,
loans, government benefits such as
Medicare and Medicaid, and sometimes
even medical records. They can use it
to get a loan or a passport, file for a tax
return in the victim’s name, or claim their
retirement benefits.
Driver’s License Identity Theft
Criminals can alter the picture on a
driver’s license and sell it to someone
who fits the description on the license,
or they may use the number to create a
completely fake ID card. If the imposter
is caught for a traffic violation, drunk
driving, or drug-related charge, the crime
goes on the victim’s record. When the
violator doesn’t show up in court, police
will look for the victim. Driver’s licenses
are also shown to cash checks, pass
domestic airport security, get insurance,
and to provide ID for many activities, so
an imposter could commit all kinds of
crimes that would be traced back to a
victim.
Criminal Identity Theft
A thief can commit crimes undercover by
using a victim’s name and identity. When
the police are called or the criminals are
cited or arrested, law enforcement will
be given the name of the identity theft
victim, resulting in a warrant or a criminal
record. This can lead to problems with
employment background checks, or even
result in legal action and possible arrest.
Employment Identity Theft
Employers are now required to see a
Social Security card, passport, or other
personal document to verify citizenship
before hiring someone. Fake or stolen
IDs are sometimes used to get jobs
by illegal residents or those with a
criminal history that would show up in a
background check. Victims learn about
this kind of theft when they receive a W-2
from an unknown employer or a Social
Security statement that doesn’t match
their employment history.
Insurance Identity Theft
Thieves can use stolen identities to
claim other insurance and benefits. For
example, someone using a stolen identity
could have an accident (or multiple
accidents) and make auto insurance
claims. Insurance identity fraud can
result in higher premiums, denial of
insurance, or legal action if the insurance
company discovers the fraud and blames
it on the victim.
Synthetic Identity Theft
Thieves can use information from
several different people to create a new
identity, which they can then use to
commit many types of fraud. The person
whose phone number is used may end
up getting calls from angry creditors,
and the person whose address is used
Sources: Jefferies, Identity Theft Resources Center, DataBreaches.net, IdTheftCenter, informationisbeautiful.net, press news reports and Risk
Based Security (Data Breach QuickView report, February 2014)
Figure 1:
The growing threat of
data breaches puts
hundreds of millions of
Americans at risk for
identity theft.

4. 4
may get collections letters or even summons.
The person whose Social Security number or
driver’s license number is used can face ruined
credit or even criminal charges.
Medical Identity Theft: The Crime that
Can Kill
The fastest-growing and most dangerous
category is medical identity theft. This can
occur when a thief takes or uses a victim’s
health insurance information for personal use.
But the greater danger occurs when hackers
breach healthcare organizations and steal
massive amounts of medical identities. They
wholesale these identities in batches, typically
on the Dark Web, or to sham clinics or medical
device distributors, which in turn bill insurance
companies.
Medical identity theft can be deadly because
it can introduce false information into a
person’s digital medical record. The California
Department of Justice Report noted, “Medical
records become contaminated with erroneous
information such as a false diagnosis or
inaccurate medical history. This in turn
prevents practitioners from effectively treating
their patients and endangers the health of the
victims. Medical identity theft is thus, above
all, a quality-of-care issue.”13
Medical identity theft also consumes medical
benefits and leaves victims facing bills for
medical treatments they didn’t receive.
Recovery from medical identity theft is
complicated because of healthcare privacy
laws. As a result, individuals spend valuable
time and money trying to restore their
identities:
•• While the out-of-pocket costs are
approximately $2,500 per incident, on
average,14
they exceeded $5,000 for 29
percent of victims.15
•• For 41 percent of victims, it consumed
more than 100 hours to remedy the
problem.16
•• More than six months were required to
resolve the problem for 36 percent of
victims—and 50 percent had yet to resolve
it.17
Identity Protection: The Benefit
that Employees Want
As the nine types demonstrate, identity
theft has become a core risk facing virtually
everyone. It’s ubiquitous and continues
to evolve into new and more threatening
forms. When it strikes, identity theft disrupts
employees’ professional and personal lives.
Victims often spend hundreds of hours and
thousands of dollars cleaning up credit or
medical records, clearing their names, or
otherwise re-establishing their identities—
often during their workdays.
To address these risks, many employers and
professional organizations are offering identity
protection services as a paid or voluntary
benefit. In fact, identity protection is part of a
new generation of employee benefits focused
on holistic employee well-being—including
financial wellness. According to Employee
Benefit Adviser, “Identity theft is the fastest
growing crime and consumer complaint in
America, and benefit industry experts say
concerned employees are seeking protection
as an employer perk more than ever. New
regulatory certainty about how identity theft
protection benefits are taxed could increase
the popularity of the benefit as an employer
offering.”18
As a result of the growing risks to employees,
the desire to insulate them from the stress
and down-time associated with recovering
from an incident, and the new tax ruling,
identity protection has become one of the
Medical
identity theft
nearly doubled
in a five-year
period, to
more than
2.3 million
Americans.
Fifth Annual Study on
Medical Identity Theft
“35 percent of
employers offer
identity protection
benefits, a number
projected to grow to
70 percent
— Willis Towers Watson
Survey, March 2016
13
https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/medical_id_theft_recommend.pdf
14
https://newsroom.accenture.com/news/one-in-four-us-consumers-have-had-their-healthcare-data-breached-accenture-survey-reveals.htm
15
http://medidfraud.org/2014-fifth-annual-study-on-medical-identity-theft/
16
Ibid.
17
Ibid.
18
https://www.employeebenefitadviser.com/news/regulatory-clarity-makes-id-protection-a-more-attractive-employee-benefit

5. two most popular voluntary benefits
among employers and employees19
—
an important fact to remember when
seeking to attract and retain the best
employees in a competitive workplace.
Match the Identity
Protection to the Risk
Identity protection is an attractive
benefit, but to truly address the risks to
employees or members, organizations
need to carefully examine the options
available. As the nature of identity theft
has changed, the protection available has
not, leaving individuals more vulnerable
to identity theft than ever. Al Pascual,
director of fraud and security at Javelin,
noted, “The biggest problem with the
mass issuance of identity protection
services is the mismatch of risk and
coverage. For example, we have seen
countless breach victims being offered
solutions that rely heavily on credit
monitoring, even though it may not have
been appropriate or effective based on
the type of data compromised.”20
The solution, of course, is to align the
nature of the monitoring to the type of
data that was stolen: credit monitoring
for financial data, cyber monitoring
for online data, healthcare transaction
monitoring for medical information, and
so on. Then an individual can be alerted
to any suspicious activity and take proper
action to protect themselves.
An example of such a model appeared
in the August 2015 issue of Strategic
Finance. A team of academic
researchers noted that various estimates
suggest that three to five percent of
healthcare spending goes toward fraud,
and that as much as 21 percent of billing
may be fraudulent.21
The researchers
called for an interactive model, in which
insurers create an information loop with
members who receive care, enabling
members to review claims from their
health providers prior to payment.
With the right protection—from
monitoring and alerts to identity
recovery—workers feel that their
employers understand the true risks to
their identity and well-being. Employees
are empowered to take control of
their own identities. And should the
unthinkable happen, they have peace of
mind knowing that the difficult work of
recovering their identity is in the capable
hands of professionals.
MyIDCare™: A New Approach
to Identity Protection
MyIDCare identity protection helps
employees and members keep ahead of
identity theft with innovative monitoring
technologies, concierge-style service,
and protection for victims. It includes:
Complete monitoring of an individual’s
identity. In addition to credit monitoring
for financial information, MyIDCare
includes health claims monitoring
technology known as MIDAS, which
alerts members every time a claim is
made against their identity. It enables
them to review health transactions for
potential identity fraud the same way
they do for credit transactions.
For online information, there’s
CyberScan, a powerful surveillance
engine that proactively searches the
Internet and the Dark Web—from
websites, to blogs, bulletin boards,
Internal Relay Chat (“IRC”) channels,
and beyond. CyberScan seeks out
compromised personal information and
triggers an alert if an individual’s data is
detected.
Concierge-style service, with trained
recovery experts who are assigned
to and who act as a single point of
contact. They provide expert guidance
for employees with questions about
identity theft and protective measures.
In the event of identity theft, the recovery
expert will use limited power of attorney
to act on a victim’s behalf to recover
their identities. This service level helps
minimize the distractions faced by
employees and the productive time
consumed in restoring their identities.
Total protection for identity theft victims.
ID Experts has a 100 percent success
rate in recovering and restoring victims’
identities. In addition, MyIDCare covers
reimbursement of eligible expenses up
to $1 million—including service fees,
expenditures and losses, even stolen
funds.
ID Experts’ recovery advocates
have a 100 percent success rate
in restoring victims’ identities to
pre-theft status.
19
https://www.employeebenefitadviser.com/news/id-protection-student-debt-assistance-heat-up-voluntary-products-race
20
https://www.javelinstrategy.com/press-release/post-breach-complimentary-identity-protection-services-do-they-really-benefit
21
http://sfmagazine.com/post-entry/september-2015-healthcare-fraud-time-for-a-cure/
The biggest problem
with the mass
issuance of identity
protection services is
the mismatch of risk
and coverage.
— Al Pascual, research
director and head of fraud
and security, Javelin
5

6. ID Experts is a leading provider of identity protection and data breach services for companies
and individuals throughout the U.S. We combine consumer-centric software and concierge-
style professional services in serving organizations across government, healthcare, commercial
enterprises, financial institutions, and higher education.
© Copyright 2017 ID Experts IDE-WP1 7.2017
Learn more online
www2.idexpertscorp.
com/knowledge-center
@IDExperts
Data Breach Solutions
Conclusion
Technology has forever changed the face of
identity theft. It’s an increasingly complex
and fast-growing crime affecting millions
of Americans. It’s little wonder, then, that
employees and their families now see identity
protection as a valued benefit. Forward-looking
organizations recognize that identity thieves
are now operating by an entirely new set of
rules, and that solutions from the past decade
do not offer adequate protection for the
coming decade’s problems. A new approach
is required, one which addresses identity theft
in all its dangerous forms. MyIDCare from
ID Experts is the new generation of identity
protection, using innovative technologies,
unmatched service, and a proven track
record to help keep employees safe, happy,
and productive—even in a digital age where
threats to an individual’s identity are growing
exponentially.
Talk to an Expert
(971) 242-4775
info@IDExpertsCorp.com
www2.idexpertscorp.com