Last Friday evening I got a phone call. A woman asked me if I was Joshua, and I said yes. The person who called said, "I have some important business information for you. Could you verify that the last four digits of your social security number are [****]?" How strange, I thought, that someone was asking me to verify whether they had my social security number before introducing themselves. Well, it wasn't my social security number, but sensing a scam I told the lady "That's none of your business. It's not right to ask for someone's personal information, especially a social security number, over the phone." I hung up, satisfied that I had foiled some telemarketer or scammer.
Yesterday (Monday), I got another call from a different lady who asked me the same questions. Wow, I thought, these scammers are serious. Again I refused to verify whether the four digits she supplied were indeed part of my social security number. I asked what company she worked for, and she said a name rather quickly and mentioned that it was based in Washington. She asked me if I had ever lived at a particular address, one which I had never heard of. I tried explaining to her that my phone number is on the National Do Not Call List, and she rudely cut me off saying that it didn't matter. I told her in a little louder tone that I had never signed up with any "D. R. Solutions" or whatever she said the company's name was, and she yelled rather brashly, "You don't sign up with a collection agency." The plot thickens.
So was this a real collection agency, or was this a scam? I had no idea. All I knew was that if this was a real collection agency, I wasn't the person they were looking for, but if it was a scam to try to telephonically phish for my real social security number by process of elimination, then I didn't want to talk to these people anyway. Regardless of what the real situation was, I had no business with this group.
I don't recall exactly how the conversation ended, although I remember the lady saying that if I refused to verify whether the social security number or address had ever belonged to me then I would continue to get calls from them.
Tonight (Tuesday night—apparently they only take the weekends off from harassing people) I got another call. This time it was a man. When I picked up the phone he asked for Joshua, and rather than confirming my identity I asked who was calling. The man refused to tell me and said that it was an important business call and he needed to verify that I was who they were looking for before he could give me any information. Like the two before him, he asked me if my social security number ended in a certain four digits. As far as I could remember, it sounded like it may have been the same as before, although I hadn't written it down when the other two people called me. Again, I told the person that social security numbers were too private to verify over the phone, and a similar conversation to the one last night ensued. This time, however, I was starting to get pretty ticked about being harassed by some company when I had no way of knowing if it was legitimate, and I told him so. The man was even more brash and rude than the lady last night. He accused me of being the person they were looking for simply because I refused to answer his personal questions, and for the remainder of the conversation he talked to me as though I was this other Joshua they were supposedly looking for.
So why didn't I just admit I wasn't this other guy and get it over with already? Because I still had no way of knowing the legitimacy of this company. Anyone can call someone and claim to be someone else. I don't have Caller ID, but even if I did it's not very trustworthy. Anyone can hack Caller ID. The man offered to give me the address of their Web site, and I immediately told him that anyone can have a Web site claiming to be part of some legitimate company. I told him that if I called someone and told them I was from Microsoft and told them to go to www.microsoft.com, that wouldn't prove anything. Of course, that probably made him more angry.
After a few minutes of trying to explain myself to no avail, I told the guy to give me the company's Web address. He didn't even know it off-hand and took about 30 seconds to find it and give it to me (hmm, I thought, real legitimate). He told me that his company was called ER Solutions, and the address he gave was www.e-r-solutions.com (hm, dashes in funny places... that looks legit). I also asked for his contact information, something I could use to look up the company and call him back, and he said something to the effect of "Certainly, sir. When you're ready to admit who you are and pay what you owe, you're welcome to call me back and we'll talk." Whatever. I told him that if I continued to be harassed I would notify the police, to which he replied "Oh, I'm not afraid of that at all, sir. You go right ahead." Right. If it was a scam, what better way to make someone trust you than to say you're not afraid of the authorities?
After getting off the phone with this man, I began contemplating my options. I had looked up the Web site (which begins with a cheap Flash intro, while the rest of the site looks like it was designed in the mid-1990s). I Googled for the 800 number he provided (1-800-847-2461) and it turned up no results. So far, no evidence that this was a legitimate company. I wondered whether I should call the police right then and file a report. I looked up the local police phone number. The phone book said to dial 911 for emergencies (which this wasn't) and another number for "business calls." I didn't think my call fell into either category, and we don't have the non-emergency number 311 in my area, so instead I pondered a few more minutes. I realized that I didn't know if the phone number given me was actually real, so I called it and asked for the man by name. They transfered me to him, and I could tell by his voice (and his attitude) that it was indeed the same person. So now I finally had a real solid link between the information he gave me and his company... but unfortunately I still could not verify whether the number really belonged to a legitimate collection agency since Google hadn't turned up any results for it. As I sat processing this for another minute, an idea occurred to me of how I could get them off my back without giving them any of my private information.
The first time I was on the phone with the male employee, he jumped to the conclusion that I must be the man that they were looking for, and he revealed that the man in question had a Verizon Wireless bill of over $300 that had not been paid. I told the guy that I had never had my own Verizon Wireless account, nor had I ever cosigned with anyone else (of course, he didn't believe me). The man said that his company was contracted by Verizon to find me. Now as I sat pondering my options, the thought occurred to me that I had a Verizon account—not a Verizon Wireless account, but I did have a Verizon home phone number under my name. So, I thought, if Verizon was working through this company to find me, why couldn't the company just contact Verizon, give them the number at which they had been harassing me, and ask them to verify whether the social security numbers on the accounts matched? This seemed like a good idea; if the people who had been calling me were legitimately working for a Verizon-contracted collection agency, then Verizon would have no problems sharing information that could help track down those who owed them money. On the other hand, if Verizon knew that these people did not work for them, then Verizon would (hopefully) not divulge private customer information.
I decided to call back the man I had talked to and present him with this brilliant idea. I was certain that this would prove one way or the other whether this was an elaborate social engineering scam or a legitimate collection agency that had called the wrong person. Again I asked for the man by name, but this time I was told that he was unavailable (how convenient). I asked if I could leave my name and number (which they already had on file) so he could call me back, and the lady who answered the phone offered to help me personally. I decided that there was nothing wrong with that, since I had already verified that this phone number indeed belonged to the man's organization. I was perfectly honest with the lady, who actually let me explain myself rather than cutting me off or making accusations like the others. I explained to her why it did not seem possible for me to verify whether her company was legitmate, and that regardless of whether the four digits of the social security number matched mine I did not want to reveal this information in case it was a scam. I offered my suggestion that she contact Verizon and give them the phone number at which they kept calling me, and simply ask Verizon to verify whether the social security numbers matched. The lady informed me that Verizon Wireless was a separate branch of Verizon than the one that handles home phone numbers, and that her company was contracted specifically by Verizon Wireless. Well, my brilliant idea was foiled... but what she was saying did seem to make sense. In regard to my concern about the company being legitimate, she explained that they had three locations in the U.S. and that they were registered with the Better Business Bureau and operated under the Fair Debt Collections Practices Act (FDCPA—she didn't know a Web address for it, but I looked it up later). She explained that my first and last name are fairly common, and she said that it may have been possible that I could be a different person with the same last four digits of my social security number (this wasn't the case, but theoretically it could have been possible). She read me the entire social security number that she had on file, and asked me if that was my number. Perhaps because she was making a lot of sense and had given me more ways to research the legitimacy of her company, perhaps because she had listened to me rather than raising her voice or accusing me, and perhaps just because I wanted to get the whole thing over with, I confirmed to her that the complete social security number she read was not mine. She asked me if I had ever lived at the address I had been previously asked about, and I confirmed that I had not. She said that she was very sorry for the trouble that her company had caused me and that I would not receive any more calls from them about this case. Before hanging up, she asked me if the man I had talked to earlier had allowed me to hear the whole social security number or any part of it other than the last four digits, and I said that he had not. She said something to the effect of, "Okay, well as long as he didn't accuse you of being the other person, that's okay." I said with a chuckle, "Well, actually, he did accuse me of being the other person." She said she would talk to him about that and wished me well. I asked her for her name before we hung up, she obligingly gave it to me, and I thanked her for her help.
I felt a little better after having talked with her. I still did not know with absolute certainty whether an elaborate plot was at work here. However, I felt obligated to do some more investigation in case I had just given into some scheme after all, and after some more Googling I came across a page that contained several bits of information on the company that matched what I had heard on the phone. Considering all the pieces that seem to fit together after more research, the probability of this being an extremely complicated scheme is very, very slim.
Nevertheless, the tactic used by this collection agency is rather intrusive and sounds rather fishy to the street-smart. Maybe some people just volunteer their social security number on the phone, but even though I had nothing to hide I wasn't about to confirm anything to anyone without sufficient proof of the caller's identity.
Be very careful about giving personal information to people who call, e-mail, or instant message you, or even show up at your door without invitation. Anyone can pretend to be someone they're not, or to be affiliated with a group when they're actually not. Know your rights, and do a little investigation before you share anything as personal as your social security number, credit card information, or bank account information. Ask yourself what's worse: dealing with a belligerent collection agency for a couple days, or having your identity stolen, your credit or your reputation fouled up, and potentially having to deal with the effects of this identity theft for years to come?
