The first call usually comes before eight. A pleasant voice tells me my business has been pre-approved for a line of credit I never applied for. By lunch there have been three or four more from different numbers, all offering the same money, and a text from a funding specialist who knows my first name and the name of my company. Most days it runs five to seven calls and several texts. My carrier labels junk calls “Spam Likely.” These get past the label.
I place business capital for a living, so I have a fair idea how those lists get built. I was still curious when a privacy subscription service offered a free scan of where my information sits online. The results came back red in every category. Under the red was a line in bold: fraudsters with this information can apply for Global Entry status, a REAL ID license, an IRS tax refund, even a new bank account or credit card. The subscription offer sat directly below it.
What the red means
The data on the scan was real. My address, phone numbers, relatives, and past addresses are listed on people-search sites, and so are those of nearly every adult who has owned property, registered to vote, or kept a phone number for a few years. A scan built on those sites will come back red for almost anyone who runs it.
The list of consequences describes someone holding much more than that page showed. Global Entry requires an in-person interview and fingerprints. A REAL ID requires original documents presented at the DMV. A fraudulent tax refund or a new credit account requires a Social Security number, which people-search sites generally do not publish. What the scan found is the bald face on a Wooly Willy, the toy where a magnet drags iron filings into a beard. The fraud list describes the face with the beard already in place, using filings that were never on the page.
The defenses against the items on that list that matter are free and run by the institutions involved. There are three of them.
The freeze
A credit freeze stops a lender from pulling your report to open a new account. Since September 2018, federal law has made it free to place and free to lift. It does not affect your score, and lenders you already have accounts with can still see your file.
Each bureau is frozen separately:
I froze mine twenty years ago and keep the login for each bureau on file. When a lender needs to pull my credit, I ask which bureau they use and lift that one freeze for a set window. A lift requested online or by phone must be honored within an hour, and a scheduled lift refreezes on its own when the window closes.
This is the real defense against the “new bank account or credit card” line on the scan. A thief holding the SSN still hits a locked file.
The PIN
The IRS will issue a six-digit Identity Protection PIN to anyone with a Social Security number or ITIN who can verify their identity. Once you have one, a return filed under your SSN without it gets rejected. That closes the tax refund line on the scan.
The fastest route is the IP PIN section of your IRS online account, after an identity check. Filers with adjusted gross income under $84,000, or $168,000 married filing jointly, who cannot get through the online check can use Form 15227 and receive the PIN by mail in four to six weeks. A Taxpayer Assistance Center appointment with two forms of ID also works.
The PIN changes every calendar year. If you enrolled online, you retrieve the new one from your account each year before filing.
DROP
California now runs the service the subscription was selling. The Delete Request and Opt-out Platform, built by the California Privacy Protection Agency under the Delete Act, sends one deletion request to every data broker registered in the state. It is free. The agency says sign-up takes under ten minutes, with a confirmation of California residency and no documents to upload. More than 300,000 Californians had signed up by June.
Since August 1, 2026, every registered broker has had to check DROP at least once every 45 days and begin processing requests. Brokers move at different speeds, so status updates can take up to 90 days to appear in your account.
DROP reaches registered data brokers only. Companies you do business with directly are outside it, and so are public records such as property filings and corporate registrations. Outside California, nothing like DROP is running yet. Connecticut is required to launch its own centralized deletion system by July 1, 2028.
• • •
The calls will likely keep coming. Business funding lists draw heavily on Secretary of State registrations and lien filings, which are public record and beyond the reach of a deletion request. The people working those lists bought them long ago and resell them to each other.
The bold line on the scan is another matter. Someone holding my name, my number, and the name of my company can still make my phone ring before eight. With the freeze, the PIN, and the deletion request in place, that is about the limit of what the information buys them.
• • •
Related reading: The Mercy of Being Forgotten, on what happens when every financial event is logged, sold to a bureau, and kept.
Leave a Comment