Identity Thieves Could Use Leaked Equifax Data to Have Surgery on Your Dime

As part of the fallout from the massive Equifax hack, fraud experts are warning consumers about a potential wave of bogus phone calls, emails, text messages, and social media posts that claim to be from Equifax or someone working on behalf of the company.

When a breach is limited to credit cards, like the Target breach in 2013, the fix is relatively simple — close the old account and open a new one.

But this particular breach involved data used for identification: Social Security numbers, birth dates and addresses, and for some victims, driver’s license numbers.

“Social Security numbers don’t expire, so this creates massive opportunities for thieves to commit all sorts of identity theft in perpetuity — and not just financial fraud,” Eva Velasquez, president and CEO of the Identity Theft Resource Center, told NBC News.

Identity thieves can use all of this personally identifiable information (PII) to do all sorts of nasty things, such as:

• Open financial accounts
• Apply for credit in your name
• Access medical information that’s billed to you
• Steal your government benefits
• File for your tax refund
• Intercept various government and financial documents.

A Credit Freeze Is a Good Start, But You Need to Do More

Anyone who had their Equifax file stolen — or even suspects it was — should consider putting a freeze on their files at all three credit bureaus. A freeze is the only proactive step to reduce your risk of financial identity fraud — but it won’t prevent an ID thief from impersonating you to take control of existing accounts.

“A credit freeze won’t stop a thief from trying to claim your tax refund. And it won’t prevent them from taking over your mortgage or retirement accounts, your savings or checking accounts, or even your medical file,” said Pam Dixon, executive director of the World Privacy Forum. “As a result, we’re all vulnerable in all of the non-credit areas of our lives and we have to be incredibly vigilant with all of our accounts watching for suspicious activity.”

Anyone who has had problems freezing their accounts should contact the Federal Trade Commission or the Consumer Financial Protection Bureau.

Protect Your Social Security Account

Armed with your Social Security number, criminals can seize control of your Social Security account. If you are receiving benefits, they can have those payments sent to them. They can even set up an online account in your name before you apply for Social Security and wait for your benefits to start.

Here’s how to stop that: Open a my Social Security account. This prevents anyone else from creating an account in your name, even if they have your number. It’s also a good way to monitor your benefits once payments start.

Anyone 18 or older who has a Social Security number, U.S. mailing address and valid email address can open a my Social Security account. If you have your credit files frozen, you will need to go to a Social Security Administration office to do this in person or unlock your Equifax file until the government can verify your identity.

Related: Why Are Our Cat Photos Safer Than Our Social Security Number?

Watch for Medical Identity Theft

One of the most lucrative ways to use a stolen Social Security number is to access an existing medical file. An identity thief can buy drugs or medical equipment — even have surgery done — and have it billed to your insurance. A credit freeze will not stop this and credit monitoring does not spot it.

That’s why it’s essential to check all of your medical bills or “explanation of benefits” notices from your insurance company — you know, those statements that say “this is not a bill,” that often get thrown away.

“Look for any charges for services that didn't happen or any equipment or medical devices you don’t have,” said fraud expert Larry Ponemon, chairman and founder of the Ponemon Institute. “It could be a simple posting error, but it could also be the sign of a big problem — that you’re the victim of a crime.”

Does Credit Monitoring Make Sense?

Equifax is offering free credit monitoring for the next year. Of course, the threat from this breach will go on for much longer than that. Even so, if you qualify, it makes sense to sign up. Remember to make a note in your calendar for a year from now to make sure you don’t get billed for an automatic renewal of that service.

Some people are now rushing to buy credit monitoring in reaction to the breach. Does it make sense to pay $19.95 (Experian and TransUnion) to $29.99 a month (LifeLock Ultimate Plus) to have your credit files monitored?

If you can afford it, monitoring may give you peace of mind. But it’s important that you understand the limits of this service.

Credit monitoring lets you know about changes to your credit file, but it can’t stop a criminal from stealing or using your personal information for non-credit related fraud. The best it can do is alert you to possible trouble which could result in spotting a problem earlier and reducing the amount of the loss. For example, it can spot when there’s an address change or an attempt made to change the address on one of your accounts. This can be a red flag that you’ve been targeted by an identity thief.

Neal O’Farrell, executive director of The Identity Theft Council, cautions that the industry has "over-promised and exaggerated the real strength of these products.”

Related: What to Do About that Equifax Breach

“You just need to stay vigilant and keep watching your accounts to look for problems,” O’Farrell told NBC News.

Here are a few things you can do to protect your identity for free:

• Check your financial accounts every week and look for anything suspicious. Don’t wait for your monthly statement to arrive.
• Get a free copy of your credit report from each of the three credit bureaus once a year — do one bureau every four months. That way, you’re looking for suspicious activity throughout the year.
• Place a free “fraud alert” on your credit file. Contact Experian, TransUnion or Equifax — and the other two bureaus will be automatically notified. A fraud alert warns lenders that you may have been a victim of fraud, and potential lenders should take additional steps to verify your identity before granting any new line of credit in your name. A fraud alert is only good for 90 days and can be renewed when it expires. It does not provide as much protection as a credit freeze.
• Look for anything that seems strange and check it out. This would include any communications from a lender, debt collector, doctor, medical institution, insurance company or government agency that doesn’t make sense. For example, a jury summons from another state or a bill for a late payment notice for a student loan you don’t have. Don’t assume it’s a mistake. Check it out. It could be the warning sign of ID theft.

Be on Guard for Piggyback Crimes

The Equifax breach and the enormous publicity and fear of identity theft that it’s generated have created a golden opportunity for fraudsters to launch other related scams. They can use various ways to trick you into giving them sensitive personal information.

Don't click on the links, don’t open the attachments, don’t respond in any way to any email, text messages or phone calls that request personal information — no matter who the caller or sender claims to be with. You have no idea who you're really dealing with.

The smart move is to go directly to the source. You should contact the company that supposedly needs to hear from you. Call a number you know is for real or go to a website you know is legit.

Herb Weisbaum is The ConsumerMan. Follow him on Facebook and Twitter or visit The ConsumerMan website.