The license you didn’t hand over

One · What happened

A listing nobody was supposed to see

A service called Nexus went up on 31 Aug on a Russian cybercrime forum and advertised 153 million US and Canadian driver’s license scans for sale. The same listing carried 10 million other ID cards, 3 million travel documents, and 579,000 medical cards, some of them marijuana dispensary cards, some of them military identification. The FBI’s New Orleans field office opened an investigation the next day. Nexus went dark on 2 Sept. The site now shows one line that says the service is no longer available.

IDScan.net confirmed the breach on 8 Sept. The company’s own notice said an unauthorized third party may have accessed and copied customer information, full names and driver’s license or other government ID numbers among it, and it offered free credit monitoring to anyone affected. IDScan runs the scanner behind the counter at more than 20,000 locations, over 21 million ID checks a month, for clients that include Hertz, Target, and FedEx.

Two · What it is doing

Not knowing which kind of person you are now

A rental counter, a bar door, a dispensary, a delivery driver who checks an ID on a porch. Most people who handed a license to one of those scanners in the last few years did it without a second thought and forgot about it by the next block. That is exactly what made the scan easy to give. Now the same people are trying to remember every counter, every door, every machine that took a picture of the card in their wallet, and they come up with a list that is mostly guesswork.

The specific new habit is checking. The bank app gets opened first thing, then again a few hours later, then again for no reason at all. It never finds anything. A new email with a strange sender gets read three times before anybody deletes it. Handing a license to a bartender or a rental clerk, an act that used to mean nothing, now comes with a small flinch that was not there in July.

A name and a number a stranger can buy for a fee starts to feel like the real thing, more solid somehow than whatever a family actually knows about a person. It is easy, sitting with that feeling, to start wondering which version of yourself counts more, the one who sat at breakfast this morning or the one filed on a forum you will never see and cannot delete.

Three · Where the ground is

Known by more than a number

A stolen license number is a real practical risk, and Proverbs never tells anyone to treat a real risk as though it were nothing. A second, quieter feeling shows up right alongside it, that a person’s worth, his actual self, now belongs partly to whoever is holding the data. Fear tells that lie fast, usually before the practical risk has even been sorted out.

Psalm 139 opens with a claim no database can make. “O LORD, you have searched me and known me! You know when I sit down and when I rise up; you discern my thoughts from afar.” (Psalm 139:1–2). IDScan.net can hold a scan of a license. It cannot hold a single thought a person had while standing at that counter. What it has is a record. What God has, the psalm says, is the person.

Called by name before the theft

Isaiah 43:1 says it straight to a frightened people. “Fear not, for I have redeemed you; I have called you by name, you are mine.” That naming did not wait on anybody’s data staying private. It was already true before any scanner existed, and it stays true with 153 million names sitting in a forum post. A Christian’s standing before God rests on what Christ has already done. A thief who buys a license number cannot rewrite that, whatever else he manages to do with it.

The fraud could still happen. The monitoring IDScan.net is offering will not cover everything a stolen number ends up costing somebody, and Scripture nowhere promises a reader that his specific number stays safe. What it promises is stranger and bigger than a safe number. The person behind it was known before the number existed, and stays known no matter what gets done with it now.

Four · Today

Five things, and none of them are “stay informed”

Worry that never gets a task just keeps orbiting the same 3 bad scenarios. Hand it something to do instead.

1. 01

   Freeze your credit tonight, at all 3 bureaus.

   Equifax, Experian, and TransUnion. It is free by law, takes about 15 minutes online, and a lender cannot open a new account in your name while it is on. Lifting it later for a real application takes one phone call.

2. 02

   Think back, then check for a notice.

   A bar, a dispensary, a rental desk, a package left on a porch, run through the last few years in your head. If a company you actually dealt with has posted something about this, read what it says and take the free monitoring if it is offering one.

3. 03

   Get a copy of your full credit report.

   Use annualcreditreport.com, the one site the law requires, not a link that showed up in an email about this. Read it. Most people have never once read their own.

4. 04

   Loop in whoever would notice first.

   Your spouse, a roommate, whoever would spot a strange charge before you did. Show them what a real fraud alert looks like and settle who makes the call if one shows up.

5. 05

   Say the specific fear to your pastor or a biblical counselor.

   Not the general shape of it. The actual picture in your head of what a stranger could do with your name. Saying it to a real person tends to shrink it faster than a week of checking the bank app ever will.