Experts Say You Should Freeze Your Children's Credit. Here's How

If you have a child, there’s a good chance their personal information is on the dark web. That’s because hackers target schools, along with everything else.

Last September, NBC News reported that the dark web is "littered with personal information of children." Ask yourself how well-protected from cybercrime you think your child's school is, and the school district, doctor's office, sports league, and community program. Odds are, that data is not secure enough.

So far this year, 63 districts in the United States, with about 1,000 schools among them, were hit with a ransomware attack, according to Brett Callow, a researcher at the cybersecurity firm Emsisoft, which conducts an annual tally. (Here's the tally for 2020.)

He adds that data was stolen in more than 30 of those 63 incidents. "So it's not only the hackers who may (mis)use the info; other people can download and (mis)use it too," he wrote to KQED.

"Ransomware is huge," said Eva Velasquez, who heads the Identity Theft Resource Center in El Cajon, east of San Diego. The nonprofit supports victims of identity crime, and also issues reports.

"We don’t wrap our brains around that this is actually a thing. Especially parents. 'Really? That’s one more thing I have to worry about?' But it is the world we live in right now," she said.

A recent survey by the ITRC found "just three percent of respondents said they placed a credit freeze to block new accounts from being created." That's for themselves — never mind their children.

So here's one more thing to add to your list of New Year’s resolutions for 2022: Freeze your child's credit. It's not a panacea, but it will stop criminals from using data to do anything that requires a credit check, once it's in place.

"There’s a misconception among parents that a lot of this is behavior-driven," Velasquez explained. "'My child doesn't engage online. They don't have social media accounts. They don’t have a bank account.' I’m sorry to burst your bubble here, but that is really giving you a false sense of security. Your children do have identity credentials."

Identity credentials are home addresses, passport numbers, phone numbers and, if they're old enough. driver's license numbers.

"We are creating data about our children," Velasquez said. "If you’re claiming them on your taxes, they have a Social Security number."

In short: Your children have an online profile already, one that's attractively clean, because it's been barely used.

Why do hackers want kids' data?

Hackers can do a variety of things with kids' data. Here are only a few examples:

• Financial identity theft: opening credit cards, taking out car loans, getting payday loans.
• Government identity theft: applying for government benefits (like unemployment) or tax refunds.
• Medical identity theft: purchasing medical equipment, paying for a hospital stay or other medical debt.
• Criminal identify theft: giving law enforcement your information to sidestep the consequences of a crime.

These days, hackers will often craft what are called "synthetic" profiles, cobbling together a Social Security number from one person with a home address from another and a photo from a third.

Parents may not have a sense of urgency

Retired dentist Anu Minocha of Saratoga has three children: a 19-year-old at UCLA and a pair of 17-year-old twins in high school. Minocha says she wasn’t raised in a financially savvy or transparent way. So it’s been important to her and her husband to raise their children to be comfortable discussing money.

"Where are they going to learn that from if you don’t show it to them?" Minocha asked. Since the children were in middle school, the family has met weekly to go over everything. Said Minocha, "So [her teenagers] know our income. They know how much electricity, water, everything costs, mortgage, the insurance. The vacations, which they so enjoy: They know how much they cost!"

The 19-year-old has a Discover card. The twins have bank accounts. Minocha is aware that ransomeware attacks have spiked in the last year, but she said she’s not alarmed. "What do you do? I mean, that’s the world we live in, right? So you can’t hide under a blanket. I think you have to teach kids how to manage that world," she said.

For Minocha, that means being on the alert to respond quickly to hacks — but she says she wasn't thinking about freezing their credit before speaking with KQED.

Then, we talked for this story. Minocha wrote back to say, "Thank you! As a followup, I froze all my girls' credit with two of the agencies. Working on the third. Froze mine, too. Am in process of freezing my parents. It’s a real pain, as each one has a different process, needing copies of social security cards, birth certificates, drivers licenses, utility bills, but that’s the world we live in. Gotta do what you gotta do."

How to freeze your child's credit online

Freezing a child’s credit can be time-consuming, and it requires completing the process with all three major credit-monitoring services: Experian, Equifax and TransUnion.

"There is another layer of complexity," said Velasquez. "You not only have to have their foundational identity documents available and ready, you also have to demonstrate that you have the legal authority to act on behalf of that child."

You also have to snail mail your request. Below is an example from Equifax of what you need. However, each agency has slightly different requirements:

To prove your identity, please provide copies of one of the following pieces of identification:

• A copy of your driver’s license or other government-issued identification
• A copy of your Social Security card
• A copy of your birth certificate

To prove you are the child’s parent or authorized representative, please provide copies of one of the following pieces of documentation:

• A copy of the child’s birth certificate
• A copy of a court order
• A copy of a lawfully executed and valid power of attorney
• A copy of a foster care certification

To validate the child’s identity, please provide copies of both of the following:

• A copy of the child’s Social Security card
• A copy of the child’s birth certificate

Once you've established a security freeze, it remains in place until the child decides otherwise, by phone or by mail. They won't be able to set up an online account until they hit 18.

Here's an additional thought: Consider freezing the credit of vulnerable older family members, too.

Since hackers target everything — including the big three credit-reporting agencies, some parents wonder about the threat of the hacking of credit agencies as a reason to avoid sending sensitive documents. Experts say: The benefits of freezing children's credit outweigh that risk.