Separating myth from reality in ID theft