Dark web monitoring: Keeping your identity safe

New Africa via Shutterstock.com

The easiest way to get a sense of how much of your personal information is available on the internet is to Google yourself. You may be surprised at the details you find, freely available, that could potentially assist the perpetrators of identity theft.

But as ever more victims of cyber crime are coming to know, there is another side of the internet, the “dark web,” that is impervious to conventional search tools. Moreover, it serves as a marketplace for criminals to buy, sell and store elements of people’s identities. 

“The dark web is not generally accessible by standard web search tools like Google and with the usual browsers we use,” says Julie Kuzmic, head of consumer advocacy and compliance at consumer credit rating agency Equifax Canada. To check the dark web for your data, you need to subscribe to a dark web monitoring service. “A monitoring service is valuable because it’s not something that the average person is going to find on their own,” she says.

How dark web monitoring works

Dark web monitoring is software-as-a-service typically offered on a subscription basis. Once subscribed, you will be asked to enter pieces of your personal information. It will continuously search for your data and will also alert you if it’s found on the dark web. You might start with simple identifiers such as name and address and proceed to more sensitive details such as bank account number, credit card number, passport number and Social Insurance Number (SIN).

“The scanning that is taking place is only as good as the details that the user is entering,” Kuzmic notes. The application will not search for your passport number, for example, unless you ask it to.

What to do when your info turns up

Once you have provided the dark web monitoring application with multiple identifiers to search for, ideally, nothing comes up. If, however, some personal details are found on the dark web, the action you need to take depends on what has been found. “Figuring out  the nature of the information that’s been compromised will dictate the steps that need to be taken,” Kuzmic says.

The discovery of your street or email address on the dark web may not be an immediate cause for alarm. But if your credit card number comes up, that account should be locked down immediately to prevent any fraudulent charges being made and you will need to notify the financial institution that issued the card so that it can issue you a new one.

Some personal information can’t be readily changed, such as birthdate and SIN. “If these are found to be available on the dark web you can put free credit alerts on your credit reports with both Equifax and TransUnion. In some provinces you can lock your credit report to prevent new credit being applied for in your name,,” advises Kuzmic. 

People whose data has been compromised should also contact their bank or credit union. Many institutions now flag such accounts or add an extra password for anybody claiming to be the account holder to access it.

Beyond choosing a reputable provider with a familiar brand name to protect your most sensitive personal and financial secrets  here are some features to look for in a dark web monitoring service:

• Comprehensive scanning: Make sure the service is capable of scanning all types of information, including SIN, passport number, email addresses, and bank accounts. 
• Risk-based scoring: Better service providers not only alert you if your information is discovered but also help you to assess the level of danger and urgency needed in responding to your compromised data.
• Actionable alerts: The service should provide you with a list of recommendations to help you respond to any information discovery and help you to take the necessary steps to limit further damage.

Equifax has its own dark web monitoring tool. Working with its trusted partners, it features all of the key capabilities mentioned above. The service is included in Equifax Complete Premier, the company’s entry-level credit and identity protection product, as well as Equifax Complete Protection, which brings together a range of digital security services including:

• Credit report monitoring
• Password manager
• Device protection
• VPN for more secure public wifi access
• Parental controls
• Social media monitoring

“One of the key aspects to fraud prevention and detection involves layers. You want to have different layers of protection to help protect you from all kinds of fraud, as well as assistance if and when something does go wrong,” notes Kuzmic.

Read more about fraud and scams:

• Beware, small business. The ‘perfect’ customer may not exist
• What to do if your information is found in a breach
• Synthetic identity fraud: The scam where there’s no real victim to find
• What happens if your information lands up on the dark web?