For years, Margaret Harrison believed she had an impostor. There were signs her Social Security number was living a double life. Four years ago, an unemployment office in West Virginia almost denied her claim, saying she already had a job at a horse farm in Chelan, Wash. Three years ago, a teller at Bank of America looked up her account number by her Social Security number and then asked, "Is your name Pablo?"
And yet, her credit report was squeaky clean. When she ordered her report, nothing was amiss -- and Pablo remained a mystery.
Harrison spent years trying to find out more about him. She called the credit bureaus and asked for more information. She got none. She called Bank of America's fraud department. Same answer. She purchased credit monitoring. Month after month, there was no indication anything was wrong. She even added her picture to her credit card and debit card for extra security.
And yet, her impostor was nowhere to be found –- at least until last week, when Harrison says she ended up face to face with Pablo in her San Diego home. Bank of America had sent Pablo right to her. Harrison's ATM card had expired and the bank automatically mailed a replacement card to her home. But where Harrison's security photo was supposed to be -- there was a man's picture.
Harrison says the bank later told her that, yes, her new ATM card had been accidentally printed with Pablo's picture on it.
"When I saw this guy on my card, I freaked out," Harrison said. "Now that I have this picture on my card, someone's got to be held liable for this. He can't just keep using my Social. It's not OK."
Pablo apparently holds several Bank of America accounts. And yet, Harrison still is not entitled to know what those accounts are. Telling her would violate Pablo's privacy, the bank told her.
Betty Reiss, a spokeswoman for Bank of America, said the company was investigating the situation. She declined to provide additional details or answer additional questions, citing customer privacy.
Harrison provided an image of her ATM card to MSNBC.com -- she blurred the account numbers, and MSNBC.com blurred the man's face.
Her tale may be bizarre, but it may not be as rare as it sounds. Experts say this kind of identity theft, sometimes called SSN-only ID theft, is a growing concern. But it's hard to say how common it is because for consumers like Harrison, it's nearly undetectable.
Several people, one number
Last week, after catching her breath, Harrison reached for the phone. With her 10-month-old baby in her arms, Harrison then spent four hours on the phone with Bank of America officials. Many told her the story wasn't plausible, that her SSN couldn't be living this secret life. Eventually, she found someone who explained to her, effectively, that these things happen and recommended she call the California state attorney general's office. That office referred her to the California Department of Privacy Protection.
"But, I told (the bank), you knew about this years ago," she said. "You know it's wrong. You just don't do anything about it.… isn't that kind of like aiding and abetting a crime? You know you have multiple people under the same Social."
Harrison has since filed a police report in San Diego and registered a complaint with the California privacy office, which is part of the Department of Consumer Protection.
"This really is a doozy," said Joanne McNabb, director of the privacy office. She is now working with credit bureau Equifax to resolve the case. But in other tangled cases like Harrison's, disentangling is a challenge. "We do get a steady stream of these kinds of cases. They are very frustrating to people."
Can't be spotted in credit reports
SSN-only ID theft -- also called synthetic ID fraud -- is often undetectable because of the way credit bureaus store data and release it to consumers. Free credit reports ordered by consumers don't reveal all credit history entries connected to a Social Security number. Only entries that precisely match a consumer's name, Social Security number and other personal information appear on such reports. Accounts opened using the consumer's number but a different name are often omitted, according to the bureaus. That means SSN-only theft, like Harrison's, can be almost impossible to detect.
It's also impossible to say how common such theft is; the only agencies that would know –- the credit bureaus and the Social Security Administration -- aren't talking. But an investigation by MSNBC.com last year revealed that millions of workers pay taxes using the wrong Social Security number every year, hinting that the problem may be much wider than generally believed.
For Harrison, the frustration began in 2002. Soon after she married her husband, Courtney, a Coast Guard officer, the couple was restationed in West Virginia. Given the meager job market there, she eventually filed for unemployment insurance. That was the first time she heard about Pablo.
"Are you working on a horse farm in Chelan, Wash.?" she recalls the unemployment officer asking her. Unemployment agencies would be among the few that would detect SSN-only fraud, as they are charged with preventing someone from collecting unemployment checks while working. They do that by seeing if wages are reported and taxes collected under an SSN.
She checked with the credit bureaus and the Internal Revenue Service and found no sign of Pablo. With little else to go on, she chalked it up to a clerical error. But less than a year later, Pablo's life intersected with hers again. She switched banks, signing up with Bank of America's special military financial services. One day, she forgot a deposit slip and asked a clerk to look up her account number. When she told the clerk her Social Security number, the teller pulled up a record of Pablo's credit card.
A peek behind the curtain
But the teller would share nothing else, once again sending Harrison off to get her credit reports. And again, they were squeaky clean.
That left Harrison with a disturbing question: Why could the bank officer see Pablo's accounts, but she could not?
The answer: a quirk in the way the credit bureaus do business. Banks, auto dealers and other lenders that have signed contracts with the bureaus are allowed to run a full background report on a Social Security number. Consumers cannot -– not even on their own Social Security number. When there's more than one name attached to a Social Security number at the credit bureaus, some call the extra files "sub-files." Consumers cannot see sub-files; businesses can.
The credit reporting system is designed to help paying customers -- banks, auto dealers, etc. -- avoid lending money to people with a history of bad debts. Many debtors apply for credit using false or altered names, so the system was designed to cast wide nets into people's financial backgrounds. The net is so wide, there are celebrated accidents. Credit reports provided to banks about applicants can include entries that don't belong to the applicant -- if a name matches and most of the Social Security number matches, the bureau will regularly supply that data and let the bank sort it out.
In the same way, credit bureaus sell features with names like "Social Search" to banks that want to make sure a prospective consumer isn't hiding anything. It lists any financial activity connected to a Social Security number.
Consumers cannot order a "Social Search." They get much more limited access to credit bureau data. Consumers who ask for their credit report only get debt history information where Social Security number, name and other fields match exactly.
Shared identities and privacy concerns
Privacy concerns prevent consumers from seeing Social Security number-only reports, said Equifax's David Rubinger for an earlier MSNBC story.
"Companies that have signed agreements with us can access data like that. But we can't let every consumer see it," he said. It would be difficult for the firm to establish definitively who the rightful Social Security number holder is, he said. And there would still be potentially sticky privacy issues related to revealing the impostor's information.
Equifax did not immediately provide comment for this report.
For now, there is no way for consumers to learn if they are a victim of this kind of ID theft. Free credit reports, granted with much fanfare to consumers last year, are useless to spot such crimes. So there was simply no way for Harrison to find out about Pablo. Until, that is, Bank of America sent her an ATM card with his picture on it.
The federal government has known about this problem for years. In a Government Accountability Office report issued last year, the agency said mistakes in credit bureau data are inevitable, because the Social Security number is an unreliable unique identifier. It recommended against allowing consumers to look up the history of their SSN, because such searchers would certainly violate the privacy of other consumers. In other words, the credit data is so jumbled there is no way to let consumers see their own information without showing them other people's information.
Illegal immigrants and SSN-only ID theft
It's not clear who Pablo is. MSNBC.com has decided to withhold his alleged last name and to withhold the photograph because there are several possible explanations for the double life of Harrison's Social Security number. But SSN-only identity theft is often the hallmark of an illegal immigrant using another's Social Security number for work purposes.
Undocumented workers who need a Social Security number to qualify for employment often buy one. They don't intend to steal, just get the necessary documentation to work. Employers often don't verify the numbers. Then, the immigrant will later use the number to get credit cards or other loans. If they are initially successful, a sub-file is created in the credit bureau data.
From that point on, there are two identities tied to a single Social Security number, says Evan Hendricks, author of "Credit Scores and Credit Reports."
For now, Harrison is hoping San Diego police follow up with police in Washington state and find some way for her to regain control of her identity. Meanwhile, despite receiving an ATM card with her impostor's picture, she continues to be told by the credit bureaus that she has no right to information on the accounts Pablo has opened with her Social Security number.
"They tell me I have no right to see it because it's not affecting my credit rating," she said.
And for now, the rest of America is left to wonder how many Pablos are out there. Because today, barring the dumb luck of receiving an ATM card with the wrong picture, there is no way to know if your SSN is leading a double life.
"We know it's a growing problem because we continue to have undocumented people coming in here looking to work and because of the way the credit reporting system works," says Hendricks, the author. "When you add up one plus one, you come to the inescapable conclusion that there is a growing parallel universe of SSNs that don't relate to the same person."