"Most victims of identity theft have no idea how they became a victim," Stephens says.

Some thieves act quickly, while others sit on victims' information for months.

Eduard Goodman, chief privacy officer with Arizona-based Identity Theft 911, recalls a breach in which medical students' stolen information still hadn't been used by the time the thief was apprehended many months later. The thief told authorities he was waiting for the students to become doctors, Goodman says.

Maryland, like most states, requires businesses to notify consumers if their information has been compromised.

If you're notified of a financial breach, quickly take steps to protect yourself.

Start by carefully scanning your credit card and bank statements for unauthorized charges and immediately report any suspicious charges to the lender or card issuer. Online banking customers have an advantage here because they can check their account frequently and respond faster when they spot suspicious activity.

Don't overlook tiny transactions, which may be a thief testing out the card, Goodman says.

Goodman's own debit card was compromised in February, and the thief made a dozen or so $1 purchases over a few hours before escalating to transactions of about $100 each.

(Here's one reason to use credit over debit cards: A thief can remove money directly from your checking account with a debit card and the bank has 10 business days to return the cash while it investigates, Stephens says. With a credit card, a consumer won't be out any money while the issuer checks out the fraud.)

If your Social Security number has been exposed, take action to prevent thieves from opening new lines of credit.

Place a "fraud alert" on your credit report. "It's helpful, but not foolproof," Stephens says.

The alert warns creditors they should take extra steps to verify the identity of anyone trying to open credit in your name. It stays on your file for 90 days and can be renewed. Still, creditors can ignore the alert.

A far more effective measure is to freeze your credit file with the three bureaus — Experian, TransUnion and Equifax. The freeze blocks new creditors from seeing your file. This stops them from opening new accounts — even for you unless you lift the freeze.

You will pay a small fee — $5 for Marylanders — to freeze a file or temporarily lift the freeze so a new creditor or prospective employer can view your report.

Regularly check your credit reports for unusual activity. Federal law allows you to receive one free report annually from each of the three bureaus at annualcreditreport.com.

State law also entitles Marylanders to free yearly credit reports. As a result, Marylanders can receive 6 reports each year, two from each credit bureau. By ordering one report every other month, Marylanders can monitor their credit files for free.

That beats paying $15 or so a month for a credit monitoring service.

Identity theft victims can have credit reporting agencies permanently block inaccurate information from their reports that is the result of that fraud. This right is available to victims who have filed a police report on the theft. The FTC, which surveyed more than 630 consumers who say their identity was stolen, says most didn't know they had this right.

And remain vigilant because security experts say security breaches are now part of our lives.

"It's not something that is going way," says Coggeshall, of ID Analytics. "It is just going to continue."

eileen.ambrose@baltsun.com

  • Text BUSINESS to 70701 to get Baltimore Sun Business text alerts