How To Find Yourself Again After Identity Theft

If you’ve ever been robbed, you know that having to account for exactly what’s missing is often harder than you’d think. Can you really remember everything that’s tucked away in your dresser drawers at any given time? Or in your glove compartment? Or purse? And, post-theft, remembering all that went missing may not be as simple as recounting the contents of a stolen backpack. In identity theft, for example, the list of suddenly missing things can include a complicated web of financial records, leaving victims feeling not just like they've lost money, but also like they’ve lost control of their lives — and their grip on their own identity.

Samuel Lesane, a 60-year-old Black resident of New York City, first became aware that he was the victim of identity theft when he was contacted by his bank. He says that in early December 2019, Citibank alerted him via email that a $500 (£350) electronic transaction had been made through Cash App, to a name and account Lesane didn’t recognise. He says he called Citibank immediately to say he hadn’t authorised it.

“This money was used to pay somebody else’s rent,” Lesane says. He pays rent by direct deposit, never through Cash App — and he has made a point of never using Cash App for large transactions. “Fifty dollars or maybe $100 (£75) — never $500 (£350),” he says. For an amount that large, he says he’d go to an ATM or visit a bank branch. He suspected that a houseguest had used his phone to make the transaction, though to this day it’s not clear who exactly gained access to his Cash App account. Citibank opened an investigation and credited Lesane the missing $500 (£350).

But then, in late January 2020, Citibank told him that the transaction was found to be authorised, and claimed that there wasn’t enough evidence to support Lesane’s dispute. It removed $500 (£350) from his account again.

It made no sense to Lesane. When a bank sends an automatic alert suspecting fraud — as Citibank had sent him — it’s generally triggered by a deviation from usual banking patterns. Couldn’t the bank recognise from the tripping of its own alert system that this transaction was a deviation? Lesane tried to find out how Citibank had arrived at its decision, but he says the bank shared no information on its investigation process. Lesane accepted the result at the time, even though $500 (£350) is a lot of money. It wasn’t clear what other recourse he had.

Then, it happened again.

"It was the second time [it happened] that I really had problems with Citibank," Lesane says. “I really remember the moment very well, because it was maybe three in the morning. I don’t really sleep through the night often.” This time, Lesane says, Citibank notified him that they’d received an application for a PayPal credit card — which he hadn’t applied for.

When Lesane called the bank, a rep told him that someone had tried to withdraw $1,000 (£850) from his account that morning. He says the bank assured him that the attempt had failed; they cancelled his bank card and issued a new one. But about a week later, Lesane says he noticed that his account was overdrawn. He says that Citibank presented him a transaction record with five withdrawals taking place on April 3rd, amounting to $4,772.50 (£3,800), with $306 (£276) in overdraft fees on top of that. Lesane says he looked in his wallet and realised that his new bank card had been stolen.

What followed was a frustrating back-and-forth between Lesane and various institutions he turned to for help. While filing a police report isn’t legally required of identity theft victims, Lesane says that Citibank encouraged him to do so; the police, in turn, told him he needed an affidavit from Citibank. But then, he says, Citibank refused to give an affidavit. According to the lawsuit against Citibank filed by Lesane and his attorney, a Citibank rep told him “she would not give him a copy of the affidavit to take to the police because she didn't want him acting like a ‘vigilante’ by filing a police report against the suspected perpetrator of the identity theft.”

Lesane eventually filed a police report without an affidavit, but recalls the experience as being tense. At one point, an officer threatened to jail him for taking out his phone and attempting to take a picture inside the station.

According to the lawsuit, in late April of last year, Citibank informed Lesane that they had found the April transactions he’d disputed to be authorized as well, because his PIN and bank card had been used, and because they found it to be consistent with his usual banking patterns. On top of that, they determined that the $1,000 (£850) withdrawal Citibank had initially declined had also been found to be authorised.

“I felt infuriated when they said that there was a pattern there,” Lesane says. “Nowhere in 20 years of my banking was there a pattern of me, within an hour’s time, going to two separate banks, drawing out five lump sums of money. So I was angry about that. How did you come up with this? How did you come up with this information?”

“There was some sort of suspicion,” Lesane recalls. “I felt like I was a suspect. They even stated it in a letter, basically, that the amount of money that was taken out — they felt for some reason that I had something to do with it.”

While the investigations dragged on, only some minor transactions were provisionally credited, according to Lesane. The remaining thousands of dollars were still gone. “It was a very dark time,” he says. “Because of the pandemic, and I was being harassed by creditors, debt collectors — I was behind in rent. My bank account was reflecting negative $300 (£180), negative $500 (£350).” Infuriatingly, while his money was still missing, Lesane says that Citibank started calling and sending letters about fees he owed them. “I just opened up a letter today that Citibank is saying that I owe $10 (£7). Ten dollars. You’re sending me phone calls and sending me letters about $10, but you couldn’t give me back what was wrongfully taken from me? You let me go through five, six months of the hardest time dealing with this pandemic, and times of sitting up here barely eating?”

The theft, and Citibank’s decisions, had a swift impact on Lesane’s life, he says. He couldn’t afford his typical groceries, and for a while lived on hot dogs. And then, he turned to food pantries for the first time in his life. “There's no shame in that whatsoever,” Lesane says, but he was scared to leave his home and risk infection during COVID, and it’s hard not to feel traumatised by sudden changes in your financial circumstances. It’s easy to feel that you have lost control of who you are — something Lesane says he’s always taken pride in knowing. 

“I felt there was an assumption of who I am,” he says. “And I know who I am. I'm very clear on who I am. I'm very clear on my contributions, my character, how I was raised. And it's like, now I'm that person in the [food pantry] line at four or five o'clock in the morning because of what Citibank did.”

“It also happened at a time when I was grieving — losing my sister, losing a brother of mine that was killed,” he says. “I had just put out money to try to bury my brother.” Hardship compounded upon hardship, and Lesane became withdrawn, feeling unable to tell anyone in his social circle what was happening to him.

In June, Lesane finally got an attorney through Legal Services NYC. “I didn't have the financial means to get a lawyer, but thank God for Legal Aid. Thank God for Mary,” he says.

That’s Mary McCune, Lesane’s attorney. “My clients generally are low-income — they live in low-income communities of color where banking services are limited, and this is typically what happens to them,” McCune says, explaining that often, for low-income people, fixing identity theft becomes a long, frustrating undertaking — far from the imagined experience of simply calling up your credit card company and being taken at your word that you've been wronged. “Most people don't have the stamina, and they just walk away and give up.”

After months of disputing Lesane's claim, Citibank has now returned all of his money — but Lesane says the bank didn’t communicate what they were doing clearly; he doesn't recall receiving notice that they'd reversed the decision on a $500 (£350) transaction they'd previously found to be authorised. For some other transactions, he only found out some of the money had been returned when he called Citibank and a rep told him that his account was no longer overdrawn.

The bank, for its part, denies that its treatment of Lesane was in any way prejudicial or racist. "While we cannot comment on ongoing litigation, we take allegations of discrimination very seriously and our review indicates it was not a factor," Citibank said in a statement to Refinery29. "However, we did find that we failed to live up to the level of service that we seek to provide all of our customers and we deeply apologise for the inconvenience that we caused Mr. Lesane in the course of crediting his account in full.”

For Lesane the harm done has exceeded the stolen money, and the lawsuit is seeking damages. The theft has led to Lesane being delinquent on rent and bills, and his credit score has taken a hit. “I’m trying to clear up my credit now,” he says. “It really is one of those rollercoaster situations. One thing leads into the next, into the next — people can't get ahead.”

One through line of Lesane’s experience of navigating identity theft is that it isn’t just about the money. Important as the return of his money was, a great part of Lesane's suffering came from the fact that a financial institution essentially manufactured a story about who he is: someone to be suspicious of, someone who cannot be believed, someone who is — at best — irresponsible, and at worst, criminal. After feeling like they couldn't trust him, Lesane realised he could no longer trust the bank he’d been with for 20 years. He’s currently in the process of switching — but will his new bank be any better?

There’s a lot that’s misunderstood about identity theft. Many people imagine it involves mysterious cyber hackers and massive data breaches. But identity theft precedes the digital age, and as Lesane’s experience shows, it can be as rudimentary as a random individual gaining access to your usernames and passwords through an unlocked phone, or stealing your bank card, or going through your trash; it can even be a family member who already has access to your personal information, but uses it in a way to which you didn’t consent.

A lot is also misunderstood and unknown about the victims, sometimes because of data gaps and sometimes because of how the data is looked at. In 2016, the last year of national identity theft data that the Bureau of Justice Statistics (BJS) has released, about 26 million Americans reported identity theft. White, high-income earners — households making over $75,000 (£50,000) a year — had a higher prevalence of identity theft than non-white people making less money. Over half of victims said it took a day or less to resolve their identity theft case, and 88% said they incurred a loss of less than $1, or zero out-of-pocket losses. These stats track with the existing perception that identity theft is either a pretty equal-opportunity danger, or that it’s actually more likely to harm rich people with great credit scores — they have more to steal, the thinking goes. Taking the aggregated BJS data, you might think that identity theft is generally not a devastating crime.

But this bird’s-eye view obscures the stories of people for whom identity theft is an extremely traumatising experience, as well as the specific way in which it traumatises. The BJS divides cases into three broad categories: misuse of an existing account, misuse of a new account, and misuse of personal information (to gain access to medical care, for example), and also differentiates between whether the theft involved a credit card or a bank account. In general, resolving a case of existing credit card fraud is easier than resolving a case where someone opened a new bank account in your name. You dispute the charge with your credit card and they usually believe you — the burden of proof is shifted toward the merchant.

And because credit card fraud is the most common type, it skews the data. When you look closely at the other two types, the prevalence rate for Black and Latinx people goes up. A study by researchers at the University of Alabama at Birmingham, published in 2010, also found that white people were overwhelmingly more likely to experience existing credit card fraud than the other types. Meanwhile, in existing account fraud and new credit card fraud, Black victims were significantly overrepresented. Overall, the study found that when looking at these two types of more damaging, harder-to-resolve identity fraud, victims were “more likely to be female, Black, young, and have lower incomes.”

A recent paper by Dr. Sara Sternberg Greene, a law professor at Duke University School of Law, also debunks the idea that identity theft is mostly a concern for wealthy people. It points out that at least 30% of victims are low-income, and poor people with bad credit are, in fact, very attractive targets to thieves in part because they’re so much less likely to report the theft, and because it takes them much longer to resolve their theft.

Jordan Brensinger, a sociologist and PhD candidate at Columbia University, is currently working on a dissertation on identity theft resolution. The question of what it even means for identity theft to be “resolved” is something he has been wondering. For low-income victims, identity theft is often entangled in other hardships. It could mean going into debt or falling into more debt; it could then also lead to wage garnishment; someone might not receive the tax refund they expected and needed because someone else had filed in their name. “One thing that comes up a lot is public benefits being denied because of identity theft,” Brensinger says. Such consequences could take a long time to rectify, and have devastating impacts in the meantime.

The fact that lower-income people are more likely to be receiving public benefits is also what makes their data more vulnerable, according to Greene’s paper, because these programs often require people to submit a variety of personal information. As part of his research, Brensinger has interviewed almost 50 identity theft victims so far. One thing he’s observed is that, as a consequence of the theft, victims become “more aware of the vulnerability of their data.” That can heighten the fear it might happen again, contributing to a feeling of financial insecurity and the feeling that your brush with identity theft is never quite "over.” Its specter lingers.

This isn’t an unfounded anxiety, either. Victims of identity theft are more likely to be re-victimised. Stealing information related to your identity isn’t like stealing your bike; an infinite number of people can have it at once. “Data is data because it's not something that one individual possesses — it’s something that connects people to other people and organisations,” Brensinger says. He likens it to Pandora’s box: once it’s out there, there’s no returning it. So to leave the safeguarding of such data mostly on individuals, instead of seeing it as a sociological and organisational issue, is a problem.

Even if someone manages to overcome the material hardships associated with identity theft, victims often seem to see that as separate from getting justice. “Almost every single person in my study described [identity theft] using the term ‘violation,’” says Brensinger. “They experienced this deeply as a personal violation. Somebody wronged them.” It contradicts the perception that identity theft is relatively low-harm, something that can be easily brushed off as long as you file a dispute.

This feeling of violation can only be worsened when victims face disbelief and obstacles to restitution. Lesane’s feeling that there was an aura of suspicion directed at him is not all that unusual among identity theft victims, especially those whose cases don’t get “resolved” quickly. “[Those] people will often even describe feeling like they are criminals, or the way they're treated by organisations can make them feel like they're the one who did something wrong,” says Brensinger. “A couple of people said the presumption of innocence seemed to go out the window.”

“Personal finances are also moral,” he says. “People understand them within a context of personal responsibility, and what it means to be a good adult. So identity theft can make people feel like others might think that they're irresponsible. There's a moral injury.”

The consequences of that can be far-reaching for some, leading to an erosion of trust in their social network. In his own research so far, Brensinger has noted a pattern in how non-white and low-income victims internalise what happened. “One of the things that I found was that both low-income people, and people of colour regardless of income, tended to express greater suspicion regarding people in their immediate network,” he says. “Either they believed someone in their network perpetrated the fraud, even in the seeming absence of supporting information, or they understood identity theft as teaching them a lesson about the need to change the way they interacted with people.”

“I had a number of people of colour in the study say that they were more suspicious of letting people stay with them or come over to their house,” says Brensinger. “One guy who recently moved to New York and was homeless said, essentially, I’m never going to be foolish again. I had a surprising number of low-income people and people of color say something to that effect.”

Brensinger recalls that one Black woman he interviewed left her entire friendship group in the aftermath of identity theft, even though it seemed unlikely that the thief was someone she knew. “She still told me, ‘This was something where I realised, I'm hanging around with the wrong crowd,’” he recounts. “I don't think I heard this from white people. And if I did, it was certainly only low-income [white] people. What really emphasises this is that I spoke to more economically privileged white people who knew that their identity theft was committed by people they knew, and it still didn’t affect their trust in those around them.”

“It suggests that identity theft actually has the possibility to reconfigure the kind of social support that people of color may depend on,” says Brensinger. For people living in under-resourced communities, social support can be especially crucial — but identity theft can leave them less likely to offer and rely on it. It’s hard to quantify the cost of losing trust in people around you, or the burden of looking over your shoulder, but they’re certainly not insignificant. It also leads to questions of how inequality potentially influences internal dialogues around our own identity. How do I regain control of myself after identity theft? Is it by removing myself from my social group? Is it by making sure I’m never “foolish” again? Or does it mean an effort to hold institutions accountable to protecting and helping me?

One idea Brensinger suggests to make identity theft less traumatising is creating a single centralised agency that everyone could report to, unburdening victims from basically having to resolve their own victimisation. He also notes that victims often say they want more transparency about the investigation process. You shouldn’t have to do what Samuel Lesane did, and file a lawsuit in order to get some answers.

“It takes its toll,” Lesane says. “Financial compensation does nothing for the period of time you’re going through this.”

Still, he has persevered. He recognises that if it’s happened to him, it’s happened to countless others. “I’m a fighter at heart,” he says. “I used to be a community activist for over 10 years around things that impact Central Harlem — that part of me is very much inside of me. I decided that enough was enough.”