TechRepublic’s Karen Roby spoke with Eva Velasquez, CEO of the Identity Theft Resource Center, about the importance of cybersecurity. October is Cybersecurity Awareness Month.

Karen Roby: People are working from home, so cybersecurity is more important than ever. Are you guys seeing an uptick in problems and things being reported?

SEE: Identity theft protection policy (TechRepublic Premium)

Eva Velasquez: Unfortunately, we’re seeing a significant and swift increase in the demand for our services and the number of people that are reporting. It’s really a wide variety of issues that they’re reporting to us. A lot of it around the government benefits and an inability to access those. And we know any time that there’s a big pot of money like that, the criminals are going to come out of the woodwork and try to get us to part with our identity credentials, and they’re really on the lookout for those vulnerabilities. And there are some things that we can do ourselves to help with that. So, I’m glad we’re going to cover that today.

Karen Roby: Can people at least try to make themselves less vulnerable to criminals?

Eva Velasquez: You can reduce your risk surface. And while I’m not going to say that you can reduce it to zero, that’s probably not possible, the thieves like the low-hanging fruit. So, don’t be that low-hanging fruit. Do a couple of these things, try to practice them every day, and that will really help.

Karen Roby:  What are some of the things people can do? How do they best protect themselves?

Eva Velasquez: Let’s start with just the idea of cyber hygiene and it’s layers. It’s all of these little practices that you do time that add up to something significant. We’re not talking about these huge undertakings that are going to take a lot of time. In a lot of ways, it’s just keeping your own cybersecurity and your online behaviors top of mind. And realizing that if you don’t know the answer, if you are getting some kind of incoming communication that you’re not familiar with, you don’t recognize it, it is totally OK to step back for a moment and be very thoughtful in how you engage. And it’s OK to seek some help. If you’re ill or you need a doctor, you don’t try to provide your own medical care. If you break your leg, you don’t set your own leg, you go to the doctor.

SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic)

When you have these kinds of questions and issues, especially as they’re incoming, get some advice. If it’s something that appears to be work-related, go to your employer and say, “I want to make sure you’re actually requesting this information for me. I want to make sure that this is actually when my voicemail comes in and I get a message through my email, is that what this looks like? Is this legitimate?” Do some double-checking, and that will go a really long way. Just keeping it top of mind and going to the source and double-checking, particularly when it comes to that incoming information.

Karen Roby:  Are people coming to you when they’re already at a crisis point, like, “Oh my gosh, my identity’s been stolen there. They’ve taken out credit cards, they’ve done this or that”? Or are you finding more people are proactively seeking your help to make sure they’re doing the right things?

Eva Velasquez: We actually get a mix of both. And I’m very happy to say that even prior to the pandemic, we were seeing a shift where we were getting more people proactively reaching out to us. When we first started ITRC 20 years ago, it was only victims, and they were in the thick of it and needed help resolving an actual case, an actual misuse of their identity. And while we still do that and we provide those services and we do that on a daily basis, we are getting more and more people who will reach out to us on a variety of platforms through social media, through our live chat, through text chat, and they’ll contact us and say, “Hey, I got this on my Facebook, this grant, or this free money. Is this legitimate?” Or they’ll live chat with us and say, “Hey, I received this email that was coming in, and it said, X, Y, and Z. Is this legitimate?”

SEE: Phishing attack spoofs IRS COVID-19 relief to steal personal data (TechRepublic)

And they are also taking away the practice of going to the source because that’s really what we try to educate people on is just if you didn’t initiate the contact, go to the source and verify it. If someone says they’re from your bank, verify it. If someone says they’re from a government agency, verify it. I do think it’s really getting through because that proactive attitude will save people a lot of time. It’s much easier to take the five minutes to verify something than it is to remediate an actual misuse of your identity.

Karen Roby:  Let’s talk a little bit about what parents need to keep in mind? What do they need to be telling their kids? Then also talk about what can happen if, unfortunately, a child’s information is stolen?

Eva Velasquez: It absolutely does happen. I know that parents have a lot on their minds right now, so I’ll keep it really simple. There are two things that I want parents to remember; from a high level, we have this notion that if our children are inside the house, they’re safe. Your analogy about looking both ways before you cross the street, we tend to think of the monsters or the problems or the issues as being outside the front door. Of course, that’s important and we need to educate them there. But this notion that, “As long as they’re under my roof and in their bedroom they’re safe, and I know where they’re at and nothing can happen.” If there is an internet-connected device in that room, I don’t care if it’s a gaming device, an online gaming platform, a computer, a phone, a tablet, we need to rethink that as parents. If there’s an internet connection, there are vulnerabilities and you may not even be thinking of.

The second thing that I want parents to remember is identity credentials are valuable. Your children’s identity credentials are just as valuable, maybe even more so, than yours. So when you are treating those credentials as valuable and not self-compromising, not oversharing them, and then you’re educating your children, one, by leading by example, and then two, taking those teachable moments to say, “Hey, you’re old enough now, you’re on social media, don’t post things like documents about you. Don’t overshare, even if someone asks you. Come and get me because that could be a real problem.” The best example I can give is for older kids, for older teens, they get their driver’s license and they’re so excited and they immediately take a picture of it to post on social media to show, “Hey, I’m legit. This really happened.” They’re so in that celebratory mindset that they’re not thinking about the risks that they’re creating for themselves. That’s something that we have to teach them. It’s also a mental shift for parents.

Karen Roby:  As we know, kids can be impulsive and they don’t think things through, and what they might post could come back to haunt them. And when it comes to freezing our own credit or being mindful of our credit, what do you guys suggest that we do for our children in that same vein?

Eva Velasquez: Aside from those teachable moments and keeping it top of mind, freezing your own credit and your children’s credit is one of the most robust, proactive steps that you can take. Now, it doesn’t shrink your risk surface to zero. It doesn’t stop all types of identity theft. But it makes a big impact because when you freeze your credit, that means that nobody, including yourself, but that nobody can open new lines of credit in your name. There’s a process to thaw it so that you as an adult still have access to it, but by doing that for your kids, you are stopping anyone that has access to their credentials from trying to take out financial instruments in their name. 

SEE: Cybersecurity Awareness Month: Train employees to be first line of defense (TechRepublic)

The one caveat that I give to parents is: Please remember this is a big responsibility. Parenting in general, big responsibility, right? This is just one more thing to add to the list. But realize you do have to keep track of that process, that pin number, and make sure that you are sharing it with the appropriate adults in your child’s life. Particularly if maybe you’re a household where the parents live apart, make sure that the other parent knows, make sure that maybe a trusted grandparent or someone else knows, just in case something happens to you. Because unfreezing it, thawing it, when you don’t have access to that information is tremendously difficult. That’s just the one caveat I would give.

Karen Roby:  Something we haven’t heard enough about are the consequences or that what can happen can be devastating.

Eva Velasquez: The other factor here is that it didn’t used to be possible for children, or it was on a limited basis, and there was a cost associated with it. So, the legislation that is making it free and that is allowing parents have access to the ability to do this is relatively new. We do definitely need to get the word out to parents that this is one of those things. While it takes a little bit of effort up front, you can plan to spend anywhere between 20 to 40 minutes per bureau, per child, but once it’s done, it’s just a matter of keeping that documentation. And again, keep it wherever you keep your important documents. You have their social security card, their shots record, their birth certificates. Hopefully you’ve secured those things. Just go ahead and keep that information in that same secure location.

SEE: Report: Despite more cyberthreats during COVID-19, most businesses are confident about cybersecurity (TechRepublic)

Karen Roby:  Great idea. And the work you guys do there, Eva, of course, we’re talking about protecting the whole family, kids and all. It’s unfortunate though, that the work you do, the load is increasing because there’s just so much accessibility. We can’t say it enough that we’ve really got to stay on top of this.

Eva Velasquez: Absolutely. It is just the world we live in. It’s just part of how we engage in the outside world.When you think about how you use your own information, your own data, and your own identity credentials, just remember that your kids are doing the same thing, they’re out there creating data. It can be either used appropriately and for good, or it can be misused if it gets in the wrong hands. We do need to set the stage for them as adults, as they come into the world, we’re only going to be more connected. Training them and teaching them to have that mindset as they launch, I think that’s going to be critical for us keeping the thievery and these types of crimes at bay.

Karen Roby:  Anything you want to really make sure that you haven’t mentioned yet, that you want people to keep in mind?

Eva Velasquez: I think the most important thing that we haven’t mentioned yet is that you don’t need to feel like you’re an expert yourself, and that you need to do this alone. There are so many good and free resources. And of course the Identity Theft Resource Center is available to help. We don’t charge the public for any of the services that we provide. If you are in a situation where you want some of that advice or you have something coming in, live chat with us. There may be resources in your community that are available to you. The Federal Trade Commission is another great free resource. I really do want people to not feel like they are completely overwhelmed, they’re going, “I don’t code, I’m not in the tech space. How am I going to keep track of this?” You just need to know that it’s important and then you can seek the professional advice from the appropriate place. You can do it, and you don’t have to do it alone.

Also see