Hainsworth left with the merchandise, but a Citigroup agent called the real Cameron Dana to double-check the purchase.
Dana, 32, is a sixth-generation Arizonan descended from Mormon pioneers and raised in Mesa. He's a tall, burly guy with close-cropped hair and big hands who makes a living buying and refurbishing homes, then selling them at a profit. After hanging up the phone with Citigroup, Dana asked a buddy what to do and was soon looking at his credit reports on the Internet.
They showed a total of 16 new credit accounts opened in his name, each one laden with charges:
A $30,000 truck, the $20,000 in goods from Home Depot, a Harley-Davidson from a Prescott motorcycle dealer, cell phones, a $5,000 visit to OfficeMax.
Dana called police, then began conducting his own investigation.
"To every one of the merchants, I said, 'Get your security tapes,'" he recalled. "My most motivating factor: I wanted to see what this guy's face looked like."
He turned over everything he found to the cops.
"I would have liked to strangle the guy," he says.
Hainsworth was arrested in June 2006 by Gilbert police and later convicted on a 2005 charge of stealing a boat. He's serving 61/2 years in prison, but faces another sentencing soon in Yavapai County for stealing the Harley.
Mesa police say they are using the evidence they collected in Dana's case to aid in the Yavapai prosecution.
Dana, on the other hand, wound up fine despite his complete lack of identity-theft protection.
It cost him a few postage stamps to make the five-figure debt disappear, though he was forced to commit a few solid hours to the mess. He obtained a police report and filled out a Citigroup identity-theft form, then gave copies of the documents to the credit bureaus. He made 16 copies of the Citigroup form and mailed them to each of the merchants who gave out the credit. He put a seven-year fraud alert on his credit report. Then he was done.
Just in case some other thief gets hold of Dana's personal data, he will have to check his credit report more often in the future.
"I can do it myself," he says.
On the second floor of the nondescript Lincoln Towne Center in Scottsdale is the headquarters of Identity Theft 911, which moved to the Valley in late 2004 from San Francisco. One of the company's stated goals is education, and it puts out a lot of information on its Web site about how to beat identity thieves. It's a for-profit firm that partners with major financial institutions, which give its victim-help service to customers.
Mark Fullbright is one of several advocates who work the phones at Identity Theft 911.
"People are shaken, angry," says Fullbright, who says he has worked at local banks for the past 15 years and has become something of a fraud expert. "We give them a lot of assurance. You could have a phone call last an hour, or just a few minutes."
The company's clients include AFL-CIO member unions' employees, banks, credit unions, and insurance companies. Outside of its victim-help service, Identity Theft 911 offers credit monitoring to customers for a fee, but it doesn't push the feature.
"We don't know why anybody would pay for [anti-identity-theft] service," says Eduard Goodman, the company's general counsel.
Goodman and Fullbright also eschew the prevailing wisdom about fraud alerts, saying, although their company can place the alerts, people don't really need them unless they believe it's very likely they'll be victimized.
Goodman also points out a potential drawback to more people placing fraud alerts on their accounts: "The more fraud alerts out there, it's like crying wolf."
The attitude is different at other companies, like Debix, an Austin-based competitor of LifeLock that markets to individual consumers by playing up the fear angle.
"The risks for you as a consumer, you know, just like car accidents, are real," says Debix CEO Bo Holland in a telephone interview. "House fires are real."
Debix is very similar to LifeLock, and its services cost about the same: $99 a year. The company places a fraud alert with the credit bureaus but adds a twist. When someone tries to open a line of credit in the name of a Debix customer, the company calls the customer and asks for a PIN to complete the transaction.
Despite the bells and whistles, it's still the same old thing. You pay a lot for someone to do a few minutes worth of easy work. Same with Truston, TrustedID, the services offered by the credit bureaus, and many others.