PHOENIX (3TV/CBS 5) - Gangs of identity thieves are obtaining duplicate driver's licenses belonging to unsuspecting victims from ServiceArizona.com, according to police reports, victims who spoke with Arizona's Family and officials from the Arizona Department of Transportation.
[ARE YOU A VICTM? Contact Arizona's Family]
Those licenses have allowed ID thieves to open fraudulent bank accounts, obtain credit cards, purchase cars and nearly drain one home equity line of credit. One victim actually reported losing $300,000 from her savings account.
The Arizona Department of Transportation acknowledges that this has happened to 164 victims since July of 2018, but the real number could be much higher. Investigators say four large criminal organizations are responsible for most of the incidents. Law enforcement officials have made nine arrests.
"She transferred $160,000 out of our HELOC to her fake account on a Friday," said Bob McPeters, whose wife, Cindy was an ID victim. 3 On Your Side interviewed the McPeters about the fraudulent activity. Fortunately, the couple discovered the transaction and stopped it right before it went through. Had they not, they would have lost $160,000.
Investigators believe suspect Lana Monst may have targeted the McPeters and dozens of other people.
[RELATED: See more 3 on Your Side stories]
Scottsdale Police arrested Monst in February at a post office. They allege that Monst was there to steal mail that did not belong to her. At the time of the arrest, Monst claimed she was someone else, and had a driver's license belonging to the victim whose identity she was claiming.
Monst was released from jail, then according to police reports and other court documents, she continued to steal identities. She was arrested again this summer.
"How the hell can she get a driver's license? We figured she had a fake ID. She didn't. She had a real ID, Cindy's real driver's license," said McPeters.
Another victim also reached out to CBS 5 Investigates.
[RELATED: See more CBS 5 Investigates stories]
"I started to get these notices from US Bank and other lending agencies, saying that they had approved and not approved credit for loans," she said.
"When you think about it, there's so many exposures having your driver's license taken," she said.
According to interviews with ADOT and MVD officials, police reports, search warrants and interviews with victims, the ID thieves have been able to access the victims' personal information from the "dark web." They then used that information to order duplicate driver's licenses and have those licenses sent to new addresses. Often, those new addresses are Airbnb rentals, which were rented with fake names and fraudulent credit cards.
One key to obtaining the driver's licenses, according to victims, Internet security experts and law enforcement is that ServiceArizona.com requires relatively little information in order to obtain a duplicate license.
"It seems like something like a driver's license ought to be treated as important as your bank account, right?" said Brandon Disney, who works for Data Doctors.
Disney says technology is available to make it more difficult for ID thieves, but that the state of Arizona appears to not be using it.
According to cases reviewed by 3 On Your Side and CBS 5 Investigates, officials at MVD and ADOT have known about this problem for at least two years. The most recent cases of ID theft we found took place in August.
When asked why ServiceArizona.com remains online today, Eric Jorgensen, who is the director of the MVD, said taking the site down would be a disservice to people who use it legitimately, "I think that goes back to the idea that we have 6,000,000 almost 7,000,000 people that use service Arizona every year. We have to be very careful as we approach any of these problems to make sure, I want to make sure we continue to be able to offer the service that our customers expect."
After the interview, ADOT sent a statement to 3 On Your Side and CBS 5 Investigates, which states some of the services in question have been removed from ServiceArizona.com, including express delivery of duplicate IDs. The agency has also increased the amount of information required for duplicate driver's licenses.
But the biggest change is coming in December, when the agency replaces ServiceArizona.com with a more secure portal, called AZMVDNow.az.gov. The portal is already up and running, but is not fully operational.
Still victims who reached out to us wonder why it has taken so long and why ServiceArizona is still online.
"This is something that should have been acted on immediately. I mean, if you were not working for the government, working for a regular corporation, you'd be fired for something like this," said one victim.
Gov. Doug Ducey said on Wednesday that he was notified about the website issue a week ago.
“I was made aware of this at the last council meeting. this is unacceptable. Arizona citizens’ information should be secure. I'm getting updated on what the department of transportation is going to do to make this fix, and we're going to have a zero-tolerance policy on Arizonans data-- we need to have it protected,” Ducey said.