The Breach Was Step One
The IDScan breach put a huge pile of real driver's license records in criminal hands. Here's how a breach like that turns into the phishing that shows up in your inbox, and the checks it can't get past.
When a company announces a data breach, most of us do the same thing. We skim the headline, wonder whether we're in it, and move on, because nothing seems to happen. No money disappears that day. No strange charge shows up.
That's because the breach isn't the scam. It's the research for the scam.
What happened at IDScan
IDScan.net makes the scanners that check IDs at car rental counters, retailers, casinos, and cannabis dispensaries. On September 4, the company said an unauthorized party may have accessed and copied customer information, including full names and driver's license or other government ID numbers.
A few days earlier, an identity theft service called Nexus had been advertising more than 153 million U.S. and Canadian driver's license records, plus millions of other IDs and travel documents. Some records included front and back scans of the license itself. The FBI is investigating, and several class action lawsuits have been filed.
Keep the numbers in proportion. IDScan hasn't published a verified count, the 153 million figure comes from the people selling the data, and early reports (including one we passed along last week) have varied widely. What's not in doubt is that a very large number of real IDs are now in the wrong hands, and there's no easy way to find out if yours is one of them.
How a breach turns into a scam
Most phishing fails because it's generic. "Dear customer." A bank you don't use. A package you never ordered. You delete it because it obviously isn't about you.
A stolen ID record fixes that problem for the scammer. Here's how it plays out:
- The data gets sold. Records like these are bought in bulk, often by people who have never met and never will.
- It gets combined. Your license record gets matched with your email and phone number from older breaches. Put together, they make a profile.
- The script writes itself. Your real name, address, and birthday go into a "verify your identity" text or call. A record of when and where your license was scanned becomes an email about a "damage fee" on a car you really did rent.
- The ask is small. Confirm your details. Sign in to review the charge. Upload your ID to "restore access."
- The link goes somewhere fake. A sign-in page that looks exactly right, at an address that isn't.
This is what security people call spear phishing: a message aimed at one person instead of sprayed at everyone. It used to be expensive, because someone had to research you. A breach does that research in bulk.
The second wave
Big breaches also bring their own follow-up scams, and they arrive fast:
- "Were you affected?" checkers that ask you to enter your license number or upload a scan to find out
- Fake settlement emails promising a payout from the class action if you "confirm your identity"
- Fake notices from the company itself asking you to sign in and review your record
The lawsuits over IDScan are real. That's exactly what makes the fake claim forms believable. If a settlement is real, you can find it yourself by searching the case name. Never hand an ID scan to a site you reached from an email or text.
What still works
- Freeze your credit. A freeze at Equifax, Experian, and TransUnion is free, takes a few minutes each, and is the single best block against new accounts opened in your name.
- Treat true details as neutral. A message that knows your birthday hasn't proved it's legitimate. It's proved someone looked you up.
- Ask who started it. If the call, text, or email came to you out of nowhere, it gets no benefit of the doubt, no matter how much it knows.
- Call back on a number you already had. The one on your card, your statement, or the company's real website. Not the one in the message.
- Go to the site yourself. Type the address or use a bookmark instead of the link.
- Ask your DMV. Some states will issue a new license number if yours has been exposed.
Where SAFE Portal fits
We can't undo the IDScan breach, and nobody can pull those records back. What we can do is make them a lot less useful.
Link screening compares the domain in front of you with the one it's imitating. The password manager fills only where a page really lives, so a flawless copy of your rental company's or bank's sign-in page gets nothing. Password fields and downloads are checked against your own SAFElist and SAFEwall, so a "settlement portal" you've never verified has to be added by you before it gets a credential. On advisor-managed accounts, it doesn't get one at all.
What it won't do
SAFE Portal can't stop someone from opening credit in your name. That's what the freeze is for. It also can't help with a phone call, or a text that just asks you to reply. If someone asks you to read back a code, the defense is still hanging up and calling back.
Your details are out there. Where you type them is still up to you. SAFE Portal is at SAFEPortal.to. Free to try, about two minutes to set up.