What’s the first thing on any how-to guide for preventing identity theft? Use a shredder. But what good does it do if banks and retailers aren't doing the same?

When Jonah Nelson, 30, was arrested a couple weeks ago in Sacramento, he said he got all the information he needed to steal more than 500 identities by dumpster diving behind banks and businesses.

Nelson made more than 1,000 fake IDs by first visiting local banks, then using a computer to make the ID cards, blank checks and credit cards, according to the criminal complaint filed against him.

He allegedly admitted to stealing between at least $1 million with this scam, and maybe as much as $2 million.

A local TV station, CBS13 tried some dumpster diving of their own behind a bank close to the station and found processed deposit slips with names and account numbers on them and junk mail with the names and addresses ID thieves need to begin constructing a new identity.

And, last week in Salt Lake City, a man found 20 boxes of medical records in a dumpster while throwing out the trash from work.

The files contained names, addresses, birth dates, Social Security numbers and canceled checks.

Anyone could have taken the files, and it’s possible someone already did--just because 20 boxes were found, doesn’t mean there weren’t more initially.

“They could steal a lot of identities,” said Daron Breinholt, the man who found the files. “A lot of identities were in there.”