Privacy & Identity Theft

###

As part of National Consumer Protection Week, Attorney General Kamala D. Harris is alerting Californians to the threat of tax-related identity theft and issuing tips on how consumers can protect themselves during the tax filing process.

Tax-related identity theft commonly occurs when thieves send phishing emails that appear to be from the Internal Revenue Service (IRS) or the Franchise Tax Board (FTB), asking for personal information or including links to official-looking web sites.  Thieves may also use stolen personal information to file tax returns in someone else’s name in order to obtain a refund.

Tax Season Safety Tips

• Beware of unsolicited phone calls, emails or texts from anyone claiming to be from the IRS or the California Franchise Tax Board. If in doubt, contact the agency using the contact information in the Resources section below.  
• Never open an email or a text message that says it is from the IRS or the Franchise Tax Board; they are always fraudulent. State and federal tax agencies never initiate contact with taxpayers by email, text message or social media to request personal or financial information or to send notice regarding audits or refunds.
• If you think you have a tax identity theft problem or receive a letter from the IRS or the FTB stating that someone has already filed using your information, contact the agency. See the contact information in the Resources section below.
• When preparing your tax return for electronic filing, be sure to use a unique strong password on your online filing accounts. A strong password is eight or more characters, including letters, numbers and symbols. Use a unique password for each of your tax filing accounts.
• Think beyond the password. For greater security, you can get an Identity Protection PIN (IP PIN) for your e-filing account with the IRS. A new PIN is provided each year by the IRS. See the Resources section for more information.
• Check on the availability of two-step authentication to protect your tax filing accounts (and other online accounts containing sensitive information, such as your email and social media accounts). Two-step authentication offers stronger protection than just a password and username. The process (also called login approval or multi-factor authentication) adds a second factor, such as a one-time use code that is sent to you by email, phone or text. You enter that code, along with your username and password, to get access to your account. For more on two-step authentication, see the Resources section below.

Resources

Internal Revenue Service

Identity theft:  www.irs.gov/Individuals/Identity-Protection, www.irs.gov/Individuals/Indications-your-identity-may-have-been-stolen-and-how-to-report-it-to-us. 1-800-908-4490

Tax scams: www.irs.gov/uac/Tax-Scams-Consumer-Alerts 

Identity Protection PIN: www.irs.gov/Individuals/Get-An-Identity-Protection-PIN

California Franchise Tax Board

Identity theft: www.ftb.ca.gov/individuals/id_theft.shtml  

ID Theft Resolution Coordinator Web information: 916-845-3669

California Attorney General

Identity Theft Protection and First Aid: www.oag.ca.gov/idtheft  

Two-Step Authentication 

www.stopthinkconnect.org/campaigns/details/?id=460

SAN FRANCISCO – Attorney General Kamala D. Harris today issued a consumer alert in response to the reported Anthem Inc. data breach, which has impacted up to 80 million people.

The Attorney General’s Breach Help: Tips for Consumers has simple instructions for consumers who have been affected by a breach and includes what to do in response to a Social Security number breach. Breach Help is also available in Spanish.

Steps for Responding to Social Security Number Breach: 

1. PLACE A FRAUD ALERT.

Contact the three major credit bureaus and place a 90 day “fraud alert.” This helps protect you against the possibility of an identity thief opening new credit accounts in your name. When a merchant checks the credit history of someone applying for credit, the merchant gets an “alert” that there may be fraud on the account.

Experian       1-888-397-3742

Equifax         1-800-525-6285

TransUnion  1-800-680-7289

You will reach an automated telephone system. You will also be sent instructions on how to get a free copy of your report from each of the credit bureaus. Order the reports.  

2. REVIEW YOUR CREDIT REPORTS.

Look through each one carefully. Look for accounts you do not recognize, especially accounts opened since December 2014, when the Anthem breach occurred. Follow the instructions in the report for disputing any questionable information.

3. CONSIDER A SECURITY FREEZE.

Placing a security freeze on your credit files offers longer term protection. For information on how to do this, see “How to Freeze Your Credit Files” at www.oag.ca.gov/privacy/info-sheets.

4. BE WARY OF PHISHING ATTEMPTS.

If you get an email or call from someone claiming to be from Anthem and asking for your personal information, do not provide it. Scammers often take advantage of breaches by offering to help and actually seeking to steal your information. Check with Anthem through the phone number you usually use or one from the phone book, if you want to confirm that such a contact is legitimate.

More consumer information from the Attorney General:

Breach Help: Tips for Consumers

www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/cis-17-breach-help.pdf

En Español:  Ayuda en caso de robo de datos confidenciales

www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/sp-cis-17-breach-help.pdf?

How to Order Your Free Credit Reports

www.oag.ca.gov/sites/all/files/agweb/pdfs/idtheft/cis_11_free_annual_doj...

En Español:  Cómo encargar sus informes de crédito gratuitos

www.oag.ca.gov/sites/all/files/agweb/pdfs/idtheft/cis11spanish.pdf?

How to "Freeze" Your Credit Files

www.oag.ca.gov/sites/all/files/agweb/pdfs/idtheft/cis_10_credit_freeze_d...? 

Identity Theft Victim Checklist

http://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/CIS_3_victim_checkl...?

En Español: Lo que deben hacer las víctimas de robo de identidad

www.oag.ca.gov/sites/all/files/agweb/pdfs/idtheft/sp_cis_3_vtm_checklist...?

Top 10 Tips for Identity Theft Protection

www.oag.ca.gov/sites/all/files/agweb/pdfs/idtheft/cis_1_top_10tips_doj.pdf?

En Español:  Los 10 consejos para protegerse contra el robo de identidad www.oag.ca.gov/sites/all/files/agweb/pdfs/idtheft/cis_1_top_10tips_doj_s...?

UPDATE: The breach may pose a risk of medical identity theft, which is the use of someone’s identity to obtain medical services or products or for financial gain. Affected individuals should closely watch the Explanation of Benefits statements they receive from their health insurer. If the statement includes a service or product you did not receive, contact the insurer and ask for details. For more information, see First Aid for Medical identity Theft: Tips for Consumers, https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/cis_16_med_id_theft.pdf

Anthem has stated that it is not calling members regarding the incident and is not asking for credit card information or social security numbers over the phone. Anthem will contact current and former members via mail delivered by the U.S. Postal Service with specific information on how to enroll in credit monitoring. Affected members will receive free credit monitoring and ID protection services.  For Anthem’s updates on the incident, go to www.anthemfacts.com/faqor call (877) 263-7995

SAN FRANCISCO – California Attorney General Kamala D. Harris today issued a consumer alert on location services used by mobile applications (apps).

With a tap on your smartphone or tablet, you can get a list of nearby restaurants, directions to a friend’s home or a local weather forecast.  Location services on your device make a variety of convenient apps work. Location services take your geographic information from satellites (GPS), WiFi and cell-tower networks. What you may not realize is that some apps can access your location all the time, even when you’re not using them. Your location might be “always on.”  

Broadcasting your location can sometimes expose you and your family to risk of theft or physical harm. For instance, you may be unknowingly revealing your location if your phone is “geo-tagging” your photos. When you take a photo, the location where it was taken may be inserted into the image file, along with the date/time stamp. If you post the photo online, you are revealing your location at a point in time. Sharing a “selfie” without disabling geo-tagging can be dangerous,  especially for victims of stalking or domestic abuse.

How mobile location services work may be technical, but you do not have to be an engineer to have more control. By adjusting the settings on your mobile device, you can control location services to  protect your  privacy on today’s “always on” frontier.

Android Phones and Devices

• Go to Settings, then Location and uncheck the boxes. When an app asks for access to your location, you can chose to grant it or not.
• To disable geo-tagging of photos, open the camera and then click on the gear icon and set location to “No.” You may have to click the gear icon on several screen layers.
• You can also choose how accurate you want your location reporting to be, whether it is determined based on GPS plus WiFi and cellular networks or just one or the other. The higher degree of accuracy uses more of your battery, so protecting your privacy will protect your battery life too. 

iPhones and iPads (iOS 6 and later)

• Go to Settings, then Privacy, then Location Services. You can turn it off. Or you can choose which functions and apps to give access to your location.
• To disable geo-tagging of photos, deny location access to the camera, in Location Services.
• You may get notifications from apps asking to use your location in the background. For privacy, select “Don’t Allow.”

For more mobile privacy tips, including how to control location information on other mobile platforms, see the California Department of Justice’s information sheets Getting Smart About Smartphones: Tips for Consumers and Getting Smart About Smartphones: Tips for Parents. For tips on safe social networking, see Staying Private in Public: How to Limit Your Exposure on Social Network Sites. All are available online at www.oag.ca.gov/privacy/info-sheets. 

LOS ANGELES – Attorney General Kamala D. Harris today released the second annual report detailing the 167 data breaches reported to the Attorney General’s office in 2013 that impacted18.5 million Californians by putting their personal information at risk. The report is accompanied by recommendations from the Attorney General for consumers, businesses and lawmakers on how to protect against data breaches and prevent them in the future.

“Data breaches pose a serious threat to the privacy, finances and personal security of California consumers,” Attorney General Harris said. “The fight against these kind of cybercrimes requires the use of innovative strategies by government and the private sector to protect our state’s consumers and businesses. I strongly encourage more use of encryption to significantly reduce the risk of data breaches.”

In 2013, the number of reported data breaches increased by 28 percent, from 131 in 2012 to 167 in 201. The number of Californians’ whose records were affected increased by over 600 percent, from 2.5 million in 2012 to 18.5 million in 2013. This increase was largely due to two massive retailer breaches at Target and LivingSocial, each of which put the personal information of approximately 7.5 million Californians at risk.

More than half of the 2013 breaches (53 percent) were caused by computer intrusions, such as malware and hacking. The remaining breaches resulted from physical loss or theft of laptops or other devices containing unencrypted personal information (26 percent), unintentional errors (18 percent) and intentional misuse (four percent).

The report includes specific tips and recommendations to reduce the frequency and impact of future breaches.

            For Consumers:

• Monitor your credit and debit card accounts for suspi­cious transactions and report any to the card-issuing bank. Ask the bank for online monitor­ing and alerts on the card account.
• If a data breach notice says your health insurance or health plan number was involved, contact your insurer or plan and ask them to note the breach in their records and to flag your account number.
• If a data breach notice involves your password or user ID, change both for that account and any other accounts containing the same information.

            For Retailers:

• Update point-of-sale terminals so that they are chip-enabled and install the necessary software.
• Implement appropriate encryption solutions to devalue payment card data, including encrypting the data from the point of capture until completion of transaction authorization.
• Implement appropriate tokenization solutions to devalue payment card data, including online and mobile transactions.
• Respond promptly to payment card data breaches that occur in retail systems and improve the helpfulness of the “substitute notices” provided via web site and media.

For the Health Care Industry:

• Use strong encryption to protect medical information on laptops and on other portable devices, and consider encryption for desktop computers.

For the Legislature

• Consider legislation to amend the breach notice law in order to strengthen the substitute notice procedure; clarify the roles and responsibilities of data owners and data maintainers; and require a final breach report to the Attorney General.
• Consider legislation to provide funding to support system upgrades for small California retailers.

In 2003, California was the first state to pass a law (AB 700, Simitian) mandating data breach notifications. This law requires businesses and state agencies to notify Californians when their personal information is compromised in a security breach.

In 2012, companies and state agencies subject to the law were also required, for the first time, to report any breach that involved more than 500 Californians to the Attorney General’s Office. (SB 24, Simitian).

Two recommendations from Attorney General Harris’ 2012 data breach report have been enacted as amendments to the AB 700. Attorney General Harris’ 2012 report recommended that, as a result of increased criminal focus on stealing online account credentials, this type of personal information should be included in SB 24. Based on the California Department of Justice’s recommendation, SB 46 of 2013 was enacted to do just that and the law took effect in January 2014.

The 2012 report also recommended that companies should offer mitigation products or provide information on the security freeze to victims of breaches of Social Security numbers or driver’s license numbers. In 2014, AB 1710 was enacted, requiring the source of a breach of such data to offer identity theft prevention or mitigation services at no cost to the affected person and for no less than 12 months.  It will take effect in January 2015.

The full Data Breach 2013 report is available here: https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/2014data_breach_rpt.pdf?

LOS ANGELES – Attorney General Kamala D. Harris today announced a $28.4 million settlement with Aaron’s, Inc., the second largest rent-to-own business in the nation, to resolve allegations that the company violated California consumer protection and privacy laws.

“Aaron’s concealed its illegal privacy and business practices from customers in a deceptive attempt to avoid California’s robust consumer protection laws and increase its profits,” Attorney General Harris said. “This settlement provides millions of dollars in restitution to consumers and requires Aaron’s to make significant changes to its business practices.”

The settlement requires Aaron’s to refund $25 million to California customers who signed lease agreements between April 1, 2010 and March 31, 2014 and to pay $3.4 million in civil penalties and fees.

Approximately 100,000 California customers will be eligible for restitution.

The complaint alleges that Aaron’s violated California’s Karnette Rental-Purchase Act, which is the strongest rent-to-own law in the country, by charging improper late fees, overcharging customers who paid off contracts early, and omitting important contract disclosures.

In addition, the complaint alleges that Aaron’s violated California state privacy laws by permitting its franchised stores to install spyware on laptop computers rented to its customers. A feature in the spyware program called ‘Detective Mode’, which was installed without consumers’ consent or knowledge, allowed the Aaron’s franchisees to remotely monitor keystrokes, capture screenshots, track the physical location of consumers and even activate the rented computer’s webcam. The installation of this software without customer consent violated California law.

Aaron’s, which is headquartered in Atlanta, GA, rents household merchandise, including furniture, appliances and electronics for a monthly or semi-monthly fee. The company operates approximately 75 stores across California (http://www.aarons.com/storelocator.aspx).

According to a Federal Trade Commission report on the rent-to-own industry, nearly all rent-to-own customers have a household income below $50,000 and the vast majority have attained a high school education or less.

Customers who are eligible for restitution will receive notice at their last known mailing address. Customers who believe they are eligible for restitution can also proactively submit a claim by visiting www.rent-to-own-settlement.com or calling 877-449-8548.

It is expected that restitution notices and payments will be mailed in early 2015 and individual restitution payments will vary based on each consumer’s contract.

As part of a stipulated judgment filed this week in Los Angeles County Superior Court, Aaron’s has agreed to full compliance with the Karnette Act in all respects and is prohibited from using or installing spyware on rented computers.

The Los Angeles County Department of Consumer Affairs provided assistance with the investigation.

Tips for consumers regarding rent-to-own businesses:

• Know your rights. Under California law, you have many important protections if you enter into a rent-to-own agreement.  For example, you may be entitled to a reduction in the amount of your lease payment if you suffer a hardship like losing your job. For more information: http://www.dca.ca.gov/publications/legal_guides/s-10.shtml.

• Read your contract carefully before signing. Make sure you understand your obligations under the agreement, including the length of time specified in the contract, and not just the cost of your monthly lease payment.

Copies of the complaint and stipulated judgment are attached to the online version of this release at www.oag.ca.gov/news.

SAN FRANCISCO – Attorney General Kamala D. Harris today issued a series of recommendations for businesses that directly address recent changes to California privacy law. The guide, Making Your Privacy Practices Public, provides businesses with an up-to-date resource to craft a useful, transparent privacy policy for consumers.   

“California has proven that robust and balanced privacy protections are consistent with a thriving innovation economy,” Attorney General Harris said. “This guide is a tool for businesses to create clear and transparent privacy policies that reflect the state’s privacy laws and allow consumers to make informed decisions.”

In 2003, California established the landmark California Online Privacy Protection Act, which was the first law in the nation to require operators of commercial websites, including mobile apps, to conspicuously post a privacy policy if they collect personally identifiable information from Californians. In 2013, the Act was amended by Assembly Bill 370, which requires privacy policies to include information on how the operator responds to Do Not Track signals or similar mechanisms. The law also requires privacy policies to state whether third parties can collect personally identifiable information about the site’s users.

In 2012, Attorney General Harris created the Privacy Enforcement and Protection Unit to enforce federal and state privacy laws regulating the collection, retention, disclosure, and destruction of private or sensitive information by individuals, organizations, and the government. The unit also works to educate consumers and recommend best practices to businesses on privacy-related issues.

After receiving requests from the business community regarding privacy policy requirements, Attorney General Harris’ Privacy Enforcement and Protection Unit consulted with numerous stakeholders from the business sector, academia and privacy advocates in developing these recommendations.

The guide is available here: http://bit.ly/RUh7Do

Key recommendations from the guide include:

• Prominently label the section of your policy regarding online tracking, for example: “California Do Not Track Disclosures.”
• Describe how you respond to a browser’s Do Not Track signal or similar mechanisms within your privacy policy instead of providing a link to another website.
• If third parties are or may be collecting personally identifiable information, say so in your privacy policy.
• Explain your uses of personally identifiable information beyond what is necessary for fulfilling a customer transaction or for the basic functionality of the website or app.
• Describe what personally identifiable information you collect from users, how you use it and how long you retain it.
• Describe the choices a consumer has regarding the collection, use and sharing of his or her personal information.
• Use plain, straightforward language that avoids legal jargon and use a format that makes the policy readable, such as a layered format. Use graphics or icons instead of text.

“HP commends the work of California in establishing expectations-based guidance for privacy as it strikes the right balance between innovation and the protection of legitimate consumer rights,” said Scott Taylor, Vice President and Chief Privacy Officer, Hewlett-Packard.

"I applaud the California Attorney General's publication of best practices for communicating with citizens about privacy. Their common-sense recommendations are clear, readable, useful, and mercifully short.  Companies will understand how to comply with the letter and spirit of California transparency laws. In particular, I am delighted to see a light-touch legislative approach for transparency around Do Not Track," said Aleecia McDonald, Director of Privacy, Center for Internet and Society, Stanford Law School.

"Publication of Making Privacy Practices Public is an important step toward helping consumers understand what companies do with the data they collect about them.  Too many privacy policies are incomprehensible legalese.  The best practices spelled out by the California Attorney General if adopted by companies would put privacy policy statements in straightforward, understandable language,” said John Simpson, Director of Privacy Project, Consumer Watchdog.

Attorney General Harris has been a staunch advocate for policies that both protect consumers’ personal information online and foster the continued growth of California’s robust technology economy.

Most recently, Attorney General Harris issued recommendations to California businesses to help protect against and respond to the increasing threat of malware, data breaches and other cyber risks. The guide, Cybersecurity in the Golden State, provides recommendations focused on small to mid-sized businesses, which are particularly vulnerable to cybercrime and often lack the resources to hire cybersecurity personnel. In 2012, 50% of all cyber attacks were aimed at businesses with fewer than 2,500 employees and 31% were aimed at those with less than 250 employees. (http://bit.ly/1p9DGiA)

In 2013, Attorney General Harris issued a guide, Privacy on the Go: Recommendations for the Mobile Ecosystem, which provided app developers with recommendations to develop strong privacy practices, translate those practices into mobile-friendly policies, and coordinate with industry actors to promote transparency. (http://bit.ly/1lZIZAC) 

In October 2012, Attorney General Harris sent letters to approximately 100 mobile app developers and companies that were not in compliance with the California Online Privacy Protection Act and gave 30 days to post a conspicuous privacy policy. (http://bit.ly/1lZIEOv) In December of that year, the Attorney General filed the first legal action against Delta Airlines, Inc. for its failure to do so. (http://bit.ly/1k2y6Pb)

In February 2012, Attorney General Harris reached an agreement among the seven leading mobile and social app platforms - Amazon, Apple, Facebook, Google, Hewlett-Packard, Microsoft and Research in Motion (now Blackberry) - which required that mobile apps provide privacy policies that users could find in a consistent location in the platform store and review before downloading an app. (http://bit.ly/1nkfUiF)

SAN FRANCISCO -- Attorney General Kamala D. Harris today issued recommendations to California businesses to help protect against and respond to the increasing threat of malware, data breaches and other cyber risks.

"My office issued this guide to support California’s businesses and ensure a robust economy,” Attorney General Harris said. “Technology has created new opportunities and new risks for California businesses, including cyber attacks. This guide offers specific, straightforward recommendations to help businesses continue to thrive by reducing cyber security risks to employees and customers.”

The guide, Cybersecurity in the Golden State, provides recommendations focused on small to mid-sized businesses, which are particularly vulnerable to cybercrime and often lack the resources to hire cybersecurity personnel. In 2012, 50% of all cyber attacks were aimed at businesses with fewer than 2,500 employees and 31% were aimed at those with less than 250 employees.

Click here to view Cybersecurity in the Golden State: https://oag.ca.gov/cybersecurity

The guide is a product of a collaborative effort between the California Attorney General’s office, the California Chamber of Commerce and Lookout, a mobile security company.

“Prevention is the best medicine. Not only does the guide provide useful information to reduce the threat of cybercrime, it highlights the need to be proactive in preventing data breaches. This is good for California businesses and consumers,” said Allan Zaremberg, President and CEO of the California Chamber of Commerce.

“Security should not be viewed as a technology problem; it needs to be viewed as a business problem. If companies take a more proactive approach to security, they mitigate issues related to cyber risk,” said Kevin Mahaffey, co-founder and CTO at Lookout. “We’re happy to collaborate with Attorney General Harris to identify the steps businesses can take to improve their security practices -- for companies of all sizes.”

Key Recommendations for small business owners:

• Assume you are a target and develop an incident response plan now.
• Review the data your business stores and shares with third parties including backup storage and cloud computing. Once you know what data you have and where it is, get rid of what is not necessary.
• Encrypt the data you need to keep. Strong encryption technology is now commonly available for free, and it is easy to use.
• Follow safe online practices such as regularly updating firewall and antivirus software on all devices, using strong passwords, avoiding downloading software from unknown sources and practicing safe online banking by only using a secure browser connection.

In 2003, California was the first state to pass a law (AB 700) mandating data breach notification, which requires businesses and state agencies to notify Californians when their personal information is compromised in security breach. In 2012, companies and state agencies subject to the law were required for the first time to report any breach that involved more than 500 Californians to the Attorney General’s Office (SB 24). That first year, The Attorney General’s office received reports of 131 data breaches, which placed the personal information of an estimated 2.5 million Californians at risk. More information is available here: http://oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-releases-report-data-breaches-25-million

Attorney General Harris created the eCrime Unit in 2011 to identify and prosecute cyber crimes such as hacking, theft of intellectual property, identity theft, on-line fraud and extortion and identity theft. Attorney General Harris also established the office’s Privacy Enforcement and Protection Unit in 2012 to enforce federal and state privacy laws regulating the collection, retention, disclosure, and destruction of private or sensitive information by individuals, organizations, and the government.

SAN FRANCISCO – Attorney General Kamala D. Harris today kicked off Tax Identity Theft Awareness Week by issuing tips for Californians to follow to prevent tax-related identity theft as the annual tax compiling and filing process begins.

Tax-related identity theft increases in January and commonly occurs when:

• Thieves use stolen personal information to file tax returns in someone else’s name in order to obtain a refund.

• Thieves use a stolen Social Security number (SSN) for employment, which may complicate state and federal income tax obligations for the victim.

• Thieves send phishing emails that look like they are from the Internal Revenue Service (IRS) or the Franchise Tax Board (FTB) that ask for personal information or include links to official-looking web sites.

California consumers are urged to use the following tips to better prevent tax-related identity theft:

• Never open an email or a text message that says it is from the IRS or the FTB - they are always fraudulent. State and federal tax agencies never initiate contact with taxpayers by email, text message or social media to request personal or financial information or to send notice regarding audits or refunds.

• It’s fine to show your Social Security card to your employer when you start a job or to your financial institution for tax reporting purposes. Do not routinely carry your card or other documents that display your SSN.

• While preparing your tax return for electronic filing, make sure to use a strong password. A strong password is at least eight characters and includes a combination of at least three upper and/or lowercase letters, punctuation, symbols and numerals.

• Once you have e-filed your return, save it to a flash drive, CD or similar device and then delete the tax information from your hard drive. Store the CD or flash drive in a safe place, such as a lock box or safe. If working with an accountant, ask about what measures they take to protect your information.

• Use a locked mailbox and don’t leave your mail in it for long periods of time. Take your mail that contains sensitive information (bills, tax returns) to the post office.

• If your SSN is stolen, reference the California Attorney General’s Identity Theft First Aid page for instructions on what to do: www.oag.ca.gov/idtheft/first-aid.

You may have a tax identity theft problem if you receive a letter from the IRS or FTB stating that:

• you filed more than one tax return,
• someone has already filed using your information,
• you have a balance due, refund offset or have had collection actions taken against you for a year in which you did not file a return, or
• you received wages from an employer for whom you have not worked.

If you receive such a letter (not an email) from the IRS or FTB, immediately contact the agency’s identity theft unit:

Internal Revenue Service: phishing@irs.gov

IRS Identity Protection Specialized Unit

1-800-908-4490

California Franchise Tax Board: www.ftb.ca.gov/individuals/id_theft.shtml#ID

ID Theft Resolution Coordinator

1-916-845-3669

Additional Resources:

Internal Revenue Service

Identity Theft web pages:  www.irs.gov/uac/Suspicious-e-Mails-and-Identity-Theft and

www.irs.gov/uac/Indications-your-identity-may-have-been-stolen-and-how-to-report-it-to-us

Franchise Tax Board

Identity theft web page: www.ftb.ca.gov/individuals/id_theft.shtml#ID

California Attorney General

Identity Theft Protection and First Aid: http://oag.ca.gov/idtheft  

Federal Trade Commission

Tax Identity Theft Awareness Week: http://www.consumer.ftc.gov/features/feature-0029-tax-identity-theft-awareness-week 

For more information on how to identify and protect yourself from identity theft visit Attorney General Harris’ website.

SAN FRANCISCO – Attorney General Kamala D. Harris today issued tips for the holiday season on how Californians can protect themselves from identity theft and make the most of their charitable giving.

Tips for safe shopping:

• Review your bank and credit card statements frequently for unusual transactions.
• In the event of a security breach involving your credit card, monitor your account and contact your bank promptly if you see any suspicious transactions.
• If the security breach involves your debit card, the best way to protect yourself is to immediately cancel the card and get a replacement with a different number.
• Don’t make purchases in free Wi-Fi hotspots, such as a coffee shop, which can put your passwords and other information at risk.
• Shop on secure websites. One indicator about which websites are safe, and which are not, is the presence of a yellow padlock icon in the browser bar. Another indicator is ‘https’ in the web address.
• Never send sensitive personal or financial information through e-mail. Legitimate companies will not ask you to do so because it is not a secure way to transfer sensitive information.
• If you are receiving text messages on your cell phone saying you have won a prize or gift card, do not click on the link in the message – it is most likely a scam and may install a virus on your phone.
• Know the return policies of the retailers you shop with before you leave the store or conclude an online transaction. Many retailers will give you a refund if you have a receipt and your return is prompt, but some may only give store credit. Ask a clerk if the policy is not posted at the register.

Tips for donating wisely:

• The best way for many donors to select worthwhile charities is to work with a local charity as a volunteer. This helps provide first-hand knowledge about programs that benefit your community.
• You may want your donation used for a specific program or purpose within a charity. If a website has a “donate” button, check to see if you can designate a specific purpose for your donation. If you can’t, contact the charity to be sure your donation will be spent for the purpose you intend.
• If you are contacted by a solicitor on behalf of a charity, ask if he/she works for a commercial fundraiser and what percentage of donations goes directly to the charity. You may prefer to contact the charity directly to make a donation.
• If you receive an email or text message asking for a donation to a charity, contact the charity directly and confirm that the request is legitimate.
• If a solicitor tells you the donation is for your local police, firefighter or other public safety agency, check directly with the agency to avoid a potential scam.
• Don’t assume that charity recommendations on Facebook, blogs, or other social media have been vetted. Research the charity yourself.
• Make charitable contributions directly on a charity's website. If donating by check, use the full name of the charity rather than initials or an abbreviation. Do not give your credit card number to a telephone solicitor or in response to any unsolicited phone call you receive.

Additional consumer tips, information, and lists of resources are available at:

The California Attorney General’s consumer tips on identity theft and other privacy issues, https://oag.ca.gov/privacy/info-sheets

The California Attorney General’s Guide to Charitable Giving, http://oag.ca.gov/sites/all/files/agweb/pdfs/charities/publications/CharitiesSolicitation.pdf

www.ftc.gov, or toll free nationwide at (877) 382-4357

www.give.org, for additional information about a specific charity