When the human resources department at Kris鈥檚 work asked if she was taking time off under Oregon鈥檚 new paid leave program, she was a little confused.
鈥淚 sit right next door to our human resources, and they informed me that I had applied for paid leave,鈥� Kris said. 鈥淎nd I was like, 鈥楴o, nope, I did not.鈥欌��
But she had a pretty good idea what was going on: Fraudsters had used her identity to file a fake Paid Leave Oregon claim. This wasn鈥檛 the first time she鈥檇 been caught up in data security questions at a state agency.
OPB agreed not to use Kris鈥檚 last name because her personal information is already vulnerable to scammers: In 2014 she was among the 850,000 Oregonians whose identities were compromised in an Employment Department data breach. The Oregon Employment Department also administers the Paid Leave program.
Now, scammers are using identities stolen from previous hacks to create fake paid leave claims in an attempt to access benefits. Their efforts are raising concerns among Oregonians about the safety of their personal data. The state鈥檚 paid leave program allows eligible Oregon employees to take 12 weeks of paid leave for illness, a new child or to seek safety from domestic violence. The program supports up to 14 weeks for some pregnancy cases. Paid Leave Oregon has sent out nearly $46 million since it started paying out benefits in September.
Already, in the few months since the program started accepting applications, some Oregonians who have been the victim of previous data breaches have reported fake Paid Leave claims in their names. The program is so new that officials say they have yet to quantify how often this is happening, but urge applicants to take steps within their control to protect their data.
Kris said it took a couple of days for the human resources department at her work to sort out the false claims. In addition to two claims made in Kris鈥檚 name, there was a pair of claims from employees that did not actually exist.
鈥淚n two months we鈥檝e had four fraudulent claims, is my understanding, and two of them were mine,鈥� Kris said. 鈥淟ucky me.鈥�
Public benefits have long been a target of scammers, and it took no time at all for fraudsters to start sending in fake Paid Leave claims when the window for applications opened in August. Kris said she has concerns about how the program 鈥� and any state benefits program 鈥� protects people鈥檚 data, including salary information and social security numbers.
Paid Leave Oregon director Karen Madden Humelbaugh said program staff are prepared to deal with these fake claims and identify fraudsters before money is doled out or information is handed over.
鈥淭here is not a mechanism where we would be sharing information with a fraudster,鈥� Humelbaugh said. 鈥淭his is why we have so many multiple layers of things going on in the background, and if you were to call us or to communicate with us, we would be verifying a number of points with you before we would talk to you about your claim. That鈥檚 true for every claimant.鈥�
But Humelbaugh said Oregonians should be concerned about the security of their personal data. Even though Paid Leave Oregon has not been subject to a data breach, she said scammers have other ways of obtaining information like the dark web, where identities are bought and sold over and over again.
鈥淎ny of us could be a victim of this,鈥� Humelbaugh said. 鈥淚 personally have also had a paid leave claim filed in my name because my identity got stolen.鈥�
Humelbaugh said the program is not yet able to share how often fake claims are filed because Paid Leave Oregon is new and staff are still collecting and categorizing the information.
But she knows hackers are continually trying to gain access to programs like Paid Leave, and she anticipates they鈥檒l keep trying. Identity thieves have already been successful in Oregon. Earlier this year, . In 2019, 600,000 were subject to identity theft when .
Since 2014 when Kris鈥檚 identity was compromised in the employment department data breach, she estimates spending upwards of $5,000 to secure her information. She wants others to know the common suggestion of checking a credit report for suspicious activity once a year is not enough to keep your data safe.
She鈥檚 put fraud alerts on her credit. She鈥檚 paid to have alerts for when her data shows up on the dark web. She鈥檚 put locks on her credit reports, new bank accounts and her social security number 鈥� and encourages others to do the same if they鈥檙e worried their information has been compromised.
鈥淵ou have to take control of your own data,鈥� Kris said. 鈥淚t鈥檚 going to make your life a little bit more miserable when you try and go and apply for credit, but you鈥檝e done everything that you can possibly do to lock down your data on your side.鈥�
The extra work might be worth it, she said, if it can save Oregonians time and money dealing with the fake credit, loan or even public benefits accounts created with identities stolen in data breaches.
Copyright 2023 Oregon Public Broadcasting. To see more, visit . 9(MDA4MzU1MzUzMDEzMTkyMzAwMzY5MjY1Mw004))
