Back-to-school photos might be putting your child's information at risk
First-day-of-school photos have become a familiar part of the back-to-school routine.
A new outfit, a new backpack, and often a sign listing a child's name, age, grade, teacher, and other details. But cybersecurity experts warn those seemingly harmless details can become useful to criminals when combined over time.
KMBC 9 Consumer Investigative Reporter Brya Berry wanted to find out what a stranger could actually learn from a typical back-to-school photo. She showed one to Aaron Weissenfluh with TenFold Security and asked him to break it down.
"I already have {the child's name} and his age. So, I can find his date of birth pretty quickly," Weissenfluh said. "I already have the teacher's name. It's fairly unique. It will be very simple to track where this child goes to school."
Weissenfluh said the concern is not necessarily one piece of information on its own. It's what someone can learn by combining several pieces.
A child's name, approximate age, teacher, and school can all become part of a larger profile. Criminals can also gather information from public records, social media accounts, data breaches, and other sources.
William Steenson, special agent in charge of IRS Criminal Investigation for the Kansas City Field Office, said information shared publicly can give criminals a starting point.
"They can use it to maybe socially engineer a phishing scheme with that family to try to elicit additional information about that child," Steenson said, including attempts to obtain a Social Security number or confirm a date of birth.
A back-to-school photo alone does not provide enough information to file a fraudulent tax return. But Steenson said criminals can combine publicly available details with more sensitive information stolen elsewhere.
IRS Criminal Investigation has handled cases in which children's names and Social Security numbers were used on fraudulent tax returns without their families knowing.
"We've also seen investigations that are just pure identity theft, where an individual's child's Social Security number and name are used on completely fraudulent returns without anyone's knowledge," Steenson said.
The Kansas City Field Office covers Kansas, Missouri, Iowa, Nebraska, North Dakota, South Dakota and parts of southern Illinois. Steenson said roughly 20% of the office's work involves refund-fraud investigations. Not all of those investigations involve identity theft or children, but he said children's identities are involved in a significant portion of the cases his office encounters.
Steenson said identity theft can be especially difficult to detect when the victim is a child.
Children typically do not apply for credit cards, take out loans, or regularly check credit reports. That means fraudulent activity can sometimes go unnoticed for years.
"Kids don't apply for credit cards," Steenson said. If a young child's identity is stolen, he said, the first time the child may discover a problem could be years later, when they are 17 or 18 and need a credit history.
FTC Consumer Sentinel data reviewed by KMBC 9 showed nearly half a million identity-theft reports in the data set. The figures do not specify how many of those reports involved children.
Parents do not have to stop the tradition
Experts say families can still take and share first-day-of-school pictures. The key is limiting the personal information visible in the photo.
Weissenfluh recommends leaving out a child's last name, nickname, age, and teacher's name. Parents should also look closely at the background for anything that could reveal a home address, school, location, or other identifying information.
The goal is simple: keep the memory, but leave unnecessary personal data out of the frame.
What to do if you are concerned about identity theft
Parents who believe their child's information may have been compromised can take additional precautions.
The IRS offers Identity Protection PINs, or IP PINs. The unique six-digit number helps the IRS verify a taxpayer's identity when a federal tax return is filed. Anyone with a Social Security number or Individual Taxpayer Identification Number can request one, and the IRS issues a new IP PIN each year.
https://www.irs.gov/newsroom/identity-protection-pins-help-taxpayers-guard-against-tax-related-identity-theft
Top Picks
A dog's customized pink wheelchair worth $800 was stolen. An organization stepped in to replace it
Scammers are impersonating MyChart. Here’s how to spot them
'Liquid concrete': Why living downstream from a glacier has become a deadly liability
