Criminal Identity Theft: What to Do if It Happens to You
Note: Congress recently enacted the Fair and Accurate Credit Transactions Act of 2003 (FACTA) into law, which will amend the Fair Credit Reporting Act (FCRA). This law has provisions that apply to Identity Theft. For more information about FACTA, see our Fact Sheet 6(a) FACTA, the Fair and Accurate Credit Transactions Act: Consumers Win Some, Lose Some at www.privacyrights.org/fs/fs6a-facta.htm

What is criminal identity theft? Criminal identity theft occurs when an imposter gives another person's name and personal information such as a drivers' license, date of birth, or Social Security number (SSN) to a law enforcement officer during an investigation or upon arrest. Or the imposter may present to law enforcement a counterfeit license containing another person's data.

Frequently, but not always, the imposter fraudulently obtained a driver's license or identification card in the victim's name and provides that identification document to law enforcement. Or the imposter, without showing any photo identification, uses the name of a friend or relative. In many cases, the imposter is cited for a traffic violation or for a misdemeanor violation and is released from the arrest. The imposter signs the citation and promises to appear in court. If the imposter does not appear in court, the magistrate may issue a bench warrant, but the warrant of arrest will be under the victim's name.

The identity theft victim may not know there is a warrant of arrest issued under his/her name. The victim may unexpectedly be detained pursuant to a routine traffic stop and then subsequently arrested and taken to county jail (booked) because of the outstanding bench warrant.

In some cases the imposter will appear in court for the traffic or misdemeanor violation and plead guilty without the victim being aware of this event. In other cases, the imposter is arrested and booked at the county jail for a felony such as a drunk driving or other serious public offense. The imposter provides the victim's name and personal information. This information is then recorded in the countywide data base and is usually transferred to the State's criminal records data base and possibly to the national data bases, the National Crime Information Center (NCIC)

Some identity theft victims, unaware of the earlier criminal activity by the imposter, may learn of the impersonation when the victim is denied employment or terminated from employment. In these cases, the employer conducted a background investigation and had relied upon the criminal history found under the victim's name. Note that the employer is legally obligated to inform the victim of the reason for the rejection of employment. (See Federal Trade Commission information about this requirement at www.ftc.gov/bcp/conline/pubs/buspubs/credempl.htm.)

Unfortunately, as with financial identity theft, the burden of clearing one's name within the criminal justice system is primarily on the victim. The victim must act quickly and assertively to minimize the damage. Yet, the responsibility to correct the erroneous data in the various criminal justice computer systems is with the officials working within the criminal justice system. There are no established procedures for clearing one's wrongful criminal record.

This guide. The purpose of this guide is to provide information on the steps you must take to clear your name. Be aware that the procedures to correct the record within the criminal justice data bases are likely to be somewhat different from state to state, and even from jurisdiction to jurisdiction. This publication gives you an outline of steps to take.

Organizing your case. In dealing with the authorities, it is vital that you keep a detailed log of all conversations, including dates, names, phone numbers, and e-mail addresses. Note the time spent and any expenses incurred, as you may some day be able to request restitution for damages from the courts. Confirm conversations in writing, especially ones that directly deal with clearing criminal records. Send correspondence by certified mail, return receipt requested. Keep copies of all letters and documents sent by mail for your files.

If you must correspond by e-mail, ask the recipient to verify receipt of the letter with the original message attached. However, we must remind you that electronic messages are not secure and should be used sparingly. Never send anything by e-mail that you would not want publicly published.

We recommend using our Fact Sheet 17(b), "Organizing Your Case," to help you track your efforts. Web:  www.idtheftcenter.org/vg106.shtml. Attorney Mari Frank also offers identity theft prevention and survival tools , (800) 725-0807 (www.identitytheft.org).

Criminal records data bases. When an individual is first "booked" or a warrant of arrest is issued, that person's name is likely to be entered into the county data base and the state's criminal records data base. In California, this system is called the Criminal Identification Index (CII).

In the situation of criminal identity theft, the name and other identifying information such as Social Security number that appear in the data bases are that of the victim. The information is also likely to be entered into the Federal Bureau of Investigation's (FBI) National Crime Information Center (NCIC) data base (www.fbi.gov). Victims of criminal identity theft should assume that information is maintained in local, state, and federal criminal history files.

This presents a problem for the victim. The usual method of query by law enforcement into the various criminal justice data bases is by name, date of birth, and/or drivers' license number. Yet, law enforcement relies on the accuracy of such information for their investigations.

Once the victim's name is recorded on a criminal record data base, it will be unlikely that the victim's name will be totally removed from the official record. Should the imposters' true identity be determined, the victim should request a "key name" switch within the various criminal justice data bases. This means that the record will reflect the imposter's true name as the primary name and the victim's name will appear as an alias (aka). Law enforcement insists on this record-keeping system because it reflects more accurately the criminal event. The dilemma for law enforcement - and for the victim -- is when the imposter's identity has not been determined.

The following are general steps you must take to clear your name of the erroneous criminal records attributed to you. Please note that these procedures are likely to vary somewhat from jurisdiction to jurisdiction.

1. What is the first step the victim of criminal identity theft should take? Contact the arresting or citing law enforcement agency -- that is, the police or sheriff's department that originally arrested the person using your identity, or the court agency that issued the warrant for the arrest. Explain that this is a case of misidentification and that someone is using your personal information. Insist that you are the victim.

2a. Working with the arresting law enforcement agency: File an impersonation report. The law enforcement agency should first confirm your identity. This can be done by the police department taking a full set of your fingerprints, your photograph, and copying any photo identification documents such as a driver's license, passport, or U.S. legal presence documents.

Once your identity has been established, the law enforcement agency should retrieve the booking record of the criminal event that you dispute. This will include the booking prints and booking photograph or the citation which may or may not have a thumbprint impression. Request that the law enforcement agency compare the prints and/or photographs to establish your innocence.

Subsequently, the law enforcement agency should recall any warrants and issue a "clearance letter" or certificate of release (if you were arrested/booked) which you will need to keep in your possession at all times. Also, request that the law enforcement agency file with the district attorney's office and/or court of jurisdiction the follow-up investigation establishing your innocence which will entail an amended complaint being issued.

Request that the law enforcement agency change all records from your name to the imposter's true identity (if the true identity of the imposter is known). Some but not all of the levels that must be cleared include city, county, state, and federal data bases.

2b. Working with the court: You will need to determine the specific law(s) in your state that enable you to clear your name in the court records. In California, this is Penal Code Section 851.8, "Determination of Factual Innocence." Ask if something similar to Penal Code Section 851.8 is appropriate in your situation. A judge or magistrate will be required to make this determination.

The declaration should say that you are factually innocent of charges based upon the follow-up impersonation investigation by the law enforcement agency, or declarations, affidavits, or other material and relevant information. This action will change the name on the arrest records and the warrant of arrest to that of the imposter (if the true identity of the imposter is known). Your name will then be known as an alias of the imposter. The court should be requested to provide written verification for you to carry.

The following is a description of the process you are likely to encounter when working with the court to clear your name of the erroneous criminal records that exist in your name. We recommend that you first file an impersonation report with the law enforcement agency of jurisdiction and allow that agency to conduct their follow-up investigation and submit their findings to the court. However, depending upon the law enforcement agency's readiness for investigating this type of crime (criminal identity theft) or the county's prescribed protocols, you may need to proceed to the court to expedite this process.

If you discovered that there is an arrest warrant or criminal conviction, you may visit the courthouse in the jurisdiction where the arrest was made to schedule a hearing. The office that you visit within the courthouse will depend on whether the warrant is for a felony or misdemeanor crime and/or traffic violation.

It is best to call the courthouse before making the trip so you can verify the specific office, the hours they are open to the public, and what documentation you need to bring with you. Also, obtain the warrant number and/or case number ("docket") of the court. Most likely you will be asked to bring photo identification documents such as a driver's license, passport, or U.S. legal presence documents.

Tell the clerk there is a docket and/or warrant in your name and you dispute the criminal event that appears in your name. Depending upon the court of jurisdiction's protocols, the clerk may copy your identification documents(s) and obtain other pertinent information from you. You will likely be instructed to have your fingerprints taken, which might be done at the District Attorney's office, sheriff's office, or at the courthouse itself.

Arrangements will be made to schedule an "identity hearing" with the goal of obtaining a determination of factual innocence. At that hearing a judge will examine the evidence, whether it is proof you obtained on your own or subsequent police reports. If the court determines that you indeed are the wrong person named in the case/warrant, you will be issued a certificate that declares your innocence in this case.

For this and any other "certificates of clearance" that you obtain, make several copies. Carry one with you at all times. File another at home in a secure place. Give others to relatives and/or friends who can be contacted in situations where you might have forgotten yours. If you are a California resident, see also step 8 below.

Remember, this whole process can be complex. It involves the arresting agency, the court, and the administrators of the various criminal justice data base systems including the motor vehicle data bases. In the best-case scenario you might be able to completely separate your name from the imposter. In most cases, your name will remain a known alias of the imposter indefinitely.

3. What if the victim of identity theft lives in one county and the criminal event including the arrest warrant, traffic citation, or criminal conviction originated from another county or state? Go to the police or sheriff department in your own jurisdiction or residency and request they take an impersonation report. Obtain a copy of the report and report number. Ask them to take the report under the appropriate Penal Code Section for either identity theft or false personation. You can visit the Federal Trade Commission web site to determine whether your state has enacted an identity theft statute (www.consumer.gov/idtheft).

In California, the law enforcement agency in the victim's own jurisdiction is now required by law (Penal Code Section 530.6) to take an impersonation report. It may begin an investigation or refer the matter to the law enforcement agency where the suspected crime was committed for an investigation of the facts.

In states other than California that might not have a "local jurisdiction" law such as Penal Code 530.6, request your local law enforcement to take a "courtesy report." Mail the report, your fingerprints, your photograph, and any photo identification documents such as a driver's license, passport, or U.S. legal presence documents to the police department in the jurisdiction where the arrest warrant, traffic citation, or criminal conviction originated. Include any information you may have about the imposter, including but not limited to photograph, physical description, fingerprints, known alias and addresses.

The best method to track and resolve your case is to establish direct communication with the assigned detective or investigator. Ask this person what additional steps you need to go through to obtain a letter of clearance from their agency. Also, consider that you may be requested to sign an affidavit under the penalty of perjury that you did not give any individual permission or authority to use your name, personal identifiers including birth date, driver's license number, and Social Security number. You may also be called to testify in court if the imposter is identified and prosecuted.

You should also ask your local law enforcement agency if it can query your name through various law enforcement data bases (see item number 2a above) to see if there are any outstanding warrants, arrests, traffic violations, or convictions, that you do not yet know about. In some states, this step may be against system policies and/or may be unlawful - California, for example. But in such situations, you can ask law enforcement if they will determine simply if a record exists under the victim's name/identity, even though they may be prohibited from releasing this data to you, the victim.

4. Should the victim contact the Department (Bureau) of Motor Vehicles? Determine if your driver's license has been compromised in your state, or the state where the imposter appears to be committing crimes in your name. Order a certified copy of your drivers' license record for your own review of possible discrepancies. The imposter might have fraudulently obtained a duplicate license under your name and license number but has his/her photograph on the license. Or the imposter may have applied for an original license in a particular state while you live in another state. Ask if your license record can be "flagged" for possible fraud. A directory of DMVs in all 50 states can be found at www.aamva.org, the American Association of Motor Vehicle Administrators.

In California, if you can substantiate that your license number has been used fraudulently, you are entitled to a new license number. Check with your local DMV for their policy and procedures. The California DMV's toll-free fraud assistance phone number is (866) 658-5758. Its e-mail address is dlfraud@dmv.ca.gov. Its website is www.dmv.ca.gov/consumer/fraud.htm.

5. What if law enforcement determines the victim's innocence but doesn't know the true name of the imposter? In the event that the imposter's true name is not yet known, request the "key name," or primary name, be switched from your name to the name "John Doe" with your name noted as an alias.

6. What if the police agency does not believe that an imposter committed the crimes and arrests the victim? The first step is to ask the police to compare the arrest information - physical description, fingerprints, mug shots - to you. This should help prove your innocence. You may have to establish an alibi for the criminal event committed by the imposter. Check your date book: Can employment records establish your innocence? Do you have any receipts that prove where you were at the time of the criminal event. Is there someone who can vouch for your presence elsewhere? If this fails, you should give serious consideration to hiring a criminal defense attorney.

7. What if no fingerprints were taken by the arresting officer when the imposter was arrested? This often happens, especially with traffic violations and some misdemeanors like shoplifting. If the citation(s) does not contain a thumbprint, the law enforcement agency can compare your handwriting or signature to that of the citation. Or a vehicle records check can establish that you were not the registered owner of the vehicle that was associated with the citation. (Caution: Some imposters have registered vehicles using the victim's name.) Or the traffic officer that issued the citation may be asked to look at a photo line-up to establish that you were not the person cited.

8. Are there any agencies that might help the victim? In California, Senate Bill 129, passed into law in 2000, established the nation's first Office of Privacy Protection within the State Department of Consumer Affairs. It serves as the central clearinghouse where California consumers can file complaints and seek advice about identity theft and other privacy related issues.

In 2000, the California Legislature passed another law to assist victims of criminal identity theft, AB 1862. This law establishes an Identity Theft Registry within the California Department of Justice as a companion data base to the Criminal Identification Index (CII), discussed above. Bona fide victims of criminal identity theft can register information about their case with this data base. If they are wrongfully arrested for the crimes of their imposter, they can direct the arresting officer to the data base, accessible by a toll-free telephone number. If the victim applies for a job and knows that a background check will be conducted, he/she can instruct the employer to access the registry in order to learn that the applicant is not the individual committing the crime(s).

Information about these legislative bills can be found at www.leginfo.ca.gov. You can obtain information about California statutes (the Motor Vehicles Code or the Penal Code, for example) at www.leginfo.ca.gov/calaw.html.

The toll-free number for the Calfornia Department of Justice's Identity Theft Registry is (888) 880-0240. The program can also be contacted by e-mail, IEP.CommandCenter@doj.ca.gov. The California Office of Privacy Protection has a guide for registering with the Department of Justice at http://www.privacy.ca.gov/cover/identitytheft.htm called How to Use the California Identity Theft Registry with applicable forms. Additional information about the Identity Theft Registry can be found at the California Attorney General's web site at www.ag.ca.gov/idtheft/general.htm.

If you are aware of agencies and organizations in other states that provide assistance to victims of criminal identity theft, please contact the Privacy Rights Clearinghouse. Our contact information is available here: www.privacyrights.org/about_us.htm .

9. Should the victim hire an attorney? Competent legal counsel can be invaluable in helping you to clear your name. We have talked with several victims who were unable to attract the attention of law enforcement and court personnel until an attorney (a criminal defense attorney) contacted them. We have also spoken with victims who have been able to navigate the criminal justice system without legal help. However, it took them considerable time and they felt vulnerable to being arrested for the crimes committed by the imposter.

10. Should the victim change their Social Security number or driver's license number? Not for most situations. Changing your Social Security number may cause more problems than it solves because you start with fresh records. You no longer have a financial history, work history, or even college records. A clean slate is considered negative by most lenders. These records are all linked by your old Social Security number. (See Fact Sheet 17(L), "Should I Change My Social Security Number," at www.idtheftcenter.org/vg113.shtml)

If your driver's license number was used fraudulently by an imposter in a scheme to issue bogus checks to businesses, the license number may have been recorded and flagged by one of the various check cashing verification companies, for example, Telecheck. This may result in your check cashing privileges being denied. In this case, we recommend requesting a new license number. Be sure to contact the appropriate check verification service to clear the erroneous record.

11. In addition to working with law enforcement and the court system, are there any other steps the victim should take to clear his/her name? Yes. You must contact any information brokers who may have purchased your wrongful criminal records from the courts and/or law enforcement agencies.

Just like consumer reporting agencies compile credit data on consumers for the purpose of selling credit reports, information brokers compile criminal record information on individuals. They sell such information to employment background checkers, private investigators, attorneys, debt collectors, and others. Information brokers purchase such records from courts and law enforcement agencies throughout the country. Your wrongful criminal record is likely to have found its way to one or more of these data bases. The problem is that it may be very difficult to determine which information brokers have obtained the erroneous information and who they may have sold it to.

You should start by asking the court administrator who they sell their data to. Similarly, ask the law enforcement agency who they sell arrest data to, if anyone, and who else might have access to that data. You will want to immediately contact these entities in writing and request that they remove the erroneous information from their records. Also ask them who, if anyone, they have sold the information to, or who else has access to their data base. Do not be surprised if these companies are less than cooperative. If you encounter resistance, you may need to hire an attorney.

The information broker industry is, for all practical purposes, not regulated by federal or state law. There are no legally-mandated standards that they must comply with. Their trade association, the Individual Reference Services Group, has established a voluntary set of privacy principles (see www.irsg.com) in conjunction with the Federal Trade Commission (www.ftc.gov). Unfortunately, these guidelines do not give victims of criminal identity theft meaningful access to the records about them.

12. What additional considerations should I be aware of regarding employment? You may have learned about your wrongful criminal record from an employer who conducted a background check on you, and who has decided not to hire you because of the criminal record that was found. That employer is obligated to give you a copy of the report and tell you the name of the investigative company that compiled the report. This is a requirement of the federal Fair Credit Reporting Act, discussed in the next section.

Once you have learned the name of the company that conducted the background check, you should contact them and ask which information broker data base(s) they used in compiling the report. Then you must contact those companies to remove the erroneous data. Again, this is a situation in which the assistance of a competent attorney is likely to be invaluable.

If you are a victim of criminal identity theft, and if wrongful criminal records are preventing you from obtaining employment, you might want to request a criminal record clearance search through your state Department of Justice criminal records unit. In California, the fee is $25.You would fill out an application and submit fingerprints to the California Department of Justice. Your local police department can assist you in preparing a set of prints that is acceptable to the DOJ.

The DOJ then will conduct a criminal records search based on your fingerprints. If no matches are found, you will receive a letter from the DOJ stating that you have no criminal record based upon a fingerprint search. This could assist you in employment situations where wrongful criminal records are a barrier to finding a job. For more information about the California DOJ's criminal records search, visit their web site, http://ag.ca.gov/fingerprints/security.php. Or call (916) 227-3832. For links to the Attorneys General offices (DOJ) in the 50 states, visit the web site of the National Association of Attorneys General, www.naag.org.

13. Are there any precautions individuals can take to prevent becoming a victim of criminal identity theft? There is no "early detection" system to alert victims of criminal identity theft. However, there are some things that you can do as precautions. Besides ordering your credit history from the three credit bureaus each year, periodically obtain a copy of your driver's license record from your local DMV. Also, order a copy of your Personal Earnings and Benefits Estimate Statement from the Social Security Administration. Information about obtaining these documents can be found in Fact Sheets 17 and 17a at www.privacyrights.org. These fact sheets discuss credit-related identity theft.

Most victims learn of the perils of criminal identity theft by indirect means. These include notice of citation(s) from the courts, collection agency calls, and notice of warrant(s) of arrest. During a routine traffic stop, a police officer might inform the victim that their license was suspended or revoked. Or the victim might be arrested for crimes committed by the imposter.

We know of individuals who have been refused employment because of criminal identity theft. They learned of their wrongful criminal record from information obtained by the employer on the background check. Federal law requires employers to notify job applicants if they have been refused the job because of information on the background check. (For more information about the federal Fair Credit Reporting Act and "consumer investigative reports," see www.ftc.gov/bcp/conline/pubs/buspubs/credempl.htm.)

We have learned of several instances where employers did not comply with this law, and left the criminal identity theft victims in the dark about their wrongful criminal records. If you have repeatedly been rejected for employment, you might want to conduct a background check on yourself. There are two ways to do this. First, you could hire an investigative firm that specializes in employment checks to conduct the search. Many such companies can be found in the Yellow Pages under "Investigators." Be sure to check for proper credentials such as a state-issued private investigator license. Ask if the investigator is a member of a professional or trade association. Costs and investigative methods vary, so do some comparative shopping.

In California you can contact the referral services of two professional associations to obtain names of private investigators who specialize in employment background checks: the California Association of Licensed Investigators, at (800) 350-2254, and the California Institute for Professional Investigators, at (800) 400-2474. If you live in another state, find out if there is a private investigators professional association that makes referrals.

For information about private investigative services in other states, visit the web sites of the National Association of Legal Investigators (www.nalionline.org/sponsors_associations.html) and the National Association of Security and Investigative Regulators (www.nasir.org/licensing.htm).

Or second, you can use one of the online information broker services to conduct your own background check. These include: www.privacyscan.com, www.mybackgroundcheck.com, www.ussearch.com, www.uslocate.com, www.whoishe.com, among others. Be aware, however, that professional employment investigators are skilled in conducting background checks. They may be able to find information that you are not able to uncover on your own.

Some additional action steps:

We hope that the above steps will help guide you in dealing with the struggles of criminal identity theft. Remember that the preceding steps to correct the record within the criminal justice system will be different from state to state, and even from county to county. If you become a victim of criminal identity theft, we recommend that you file a complaint with the Federal Trade Commission so they may more accurately monitor such crimes. This may be done online at www.consumer.gov/idtheft.

Please also share your experience with us. We are compiling information from around the country on the steps victims must take to clear their names from wrongful criminal records. This guide has focused on procedures victims must take in California. We want to expand this guide to include information useful to victims in other states. Contact us at www.privacyrights.org/about_us.htm#contact or itrc@idtheftcenter.org.

You might want to advocate for the improvement of laws regulating employment background checks and the information broker industry. We recommend that the Fair Credit Reporting Act be amended to improve employer disclosure requirements to those whose backgrounds they are investigating. (FCRA, 15 USC sec. 1681, text available at www.ftc.gov) Victims of criminal identity theft should not be left unaware of the reason they are being denied employment. The following are two suggested amendments.

The FCRA should be amended to require that job applicants be given the results of background checks in every instance -- not just when the employer uses the report to make an adverse decision about them. For example, the employer could say that they did not use the results of the background check when making the adverse employment decision, but, rather, that the individual did not have the requisite skills, or that the job pool had other individuals with higher qualifications.

Right now, compliance with the FCRA is only required when the employer hires a third party, such as a private investigative firm, to conduct background checks. For employers who conduct their own investigations, the disclosure requirements of the FCRA do not apply. The laws in many states also contain this loophole. In this day and age of Internet access to public records data and to information brokers, employers can go online and do their own investigations. Several such online information brokers are listed in step 13 above. The FCRA and equivalent state laws should be amended to require that such employers disclose the results of background checks that they perform themselves and provide the source of the information to the job applicants. In California, the Investigative Consumer Reporting Act has been amended to include such requirements (AB 655, 2001 Legislative session, California Civil Code 1786).

For additional information on the problem of criminal identity theft, see the PRC's June 2000 presentation on "The Growing Problem of Wrongful Criminal Records" on its web site at www.privacyrights.org/ar/wcr.htm.

This publication was written by Linda Foley, Director, Identity Theft Resource Center; Beth Givens, Director, Privacy Rights Clearinghouse; and Paul Satkowski, state investigator. The information in this publication is the property of the Identity Theft Resource Center and Privacy Rights Clearinghouse. It is not available for commercial or promotional purposes without permission. Copyright 2001. All rights reserved. Any requests to reproduce this material, other than by individual victims for their own use, should be directed to the authors. Their mailing information is at the beginning of this guide. We thank Paul Johnsen (San Diego County District Attorney's office), Bronti Kelly (victim advocate), and Mari Frank, Esq. for their insights and advice.