I've Been Mugged

Judge Rules In Favor Of Experian Over Lifelock

This blog first discussed the Experian v. Lifelock lawsuit back in February of 2008. Last week, a U.S. District Court judge in California in favor of Experian. Finextra reported:

"US District Judge Andrew Guilford of California's central district backed the claim of credit referencing agency Experian in a lawsuit filed against LifeLock last year. As part of its $10 a month service, LifeLock requests that Experian, and other agencies, places fraud alerts on customers under the US Fair Credit Reporting Act (FCRA). It also renews the request every 90 days, when the alerts expire. Experian argued that under the act, companies like LifeLock cannot request alerts on behalf of customers. The judge agreed and granted the Experian motion..."

The Fair And Accurate Credit transactions Act of 2003 (FACTA) established the Fraud Alert as a free tool for consumers who have been or feel they will soon be victims of identity theft and fraud. The Fair Credit Reporting Act (FCRA) further specified how credit reporting agencies should administer Fraud Alerts, including how users of consumer credit reports (e.g., potential lenders, banks, and other businesses) before lending credit should contact consumers who have a Fraud Alert attached to their credit reports.

Lifelock gained consumers' attention with with splashy ads featuring its CEO advertising his real Social Security number, and a few celebrities like Rush Limbaugh promote the company's services. In March 2008, Lifelock proposed stronger fraud laws including:

• Restitution by the criminals for identity-theft victims
• Emphasis and funding for law enforcement to pursue identity-theft criminals.
• Clearer, consistent legislation across states about what consumers' personal data companies can archive, how they must protect it, and what items must be purged by when
• Consistent "Shine The Light" notification laws across states (requiring retailers to disclose where consumers' personal data is shared)
• Consistent data breach notification laws across states
• Consistent anti-skimming laws across states
• Stronger legislation to protect whistle blowers, and stronger penalties for companies and individuals who abuse them
• Suggestions to to strengthen data security among small businesses

Many of these proposals made sense back in March 2008, and still make sense today. Consumers need stronger protections. What does all of this mean?

This ruling means that individuals, and not credit monitoring companies, must place Fraud Alerts on their Experian credit reports. Lifelock will probably continue to place Fraud Alerts for consumers on their Equifax and TransUnion credit reports -- until those companies sue Lifelock.

It seems to me, these two companies have fought over who gets to "protect" consumers' credit reports with an arguably weak Fraud Alerts tool. The number of data breaches soared 47% in 2008 compared to 2007, and fraud victims struggled. Meanwhile, these two companies chose to waste a lot of time, money and effort fighting over a Fraud Alert tool that needs improvement, while their core services lack the comprehensive features consumers need.

This fight between Experian and Lifelock was like two five-year-old kids arguing over who gets the last brownie on the kitchen table while there is a fire burning in the living room.

There are bigger issues at stake. Credit monitoring does nothing to stop:

• Criminal identity theft: when a criminal uses another person's identity during a crime
• Medical identity theft and fraud: when a person uses another person's identity to gain free medical care, and wrecks the victim's access to health care they rightfully paid for
• Data breaches and fraud at outsourcing vendors and at offshore outsourcing vendors
• Poor data security practices by companies and employees
• Insider identity theft and fraud

This court case did absolutely nothing to strength a weak Fraud Alert tool. Consumers need far more comprehensive identity protection and resolution services than either company provides today.

In April 2008, Consumer Reports reviewed Lifelock's services. In this blog, you can read reviews of the Experian Triple Alert credit monitoring service and Experian's product line. I don't recommend any of these services, but judge for yourself.

Rather, I'd love to see a service with a truly comprehensive suite of identity protection and resolution services for consumers:

• Unlimited access to the full text of all of my credit reports from both the major credit reporting agencies and from the smaller, regional credit reporting agencies (e.g., Innovis)
• Unlimited access to the full text of all of my C.L.U.E. insurance reports
• Unlimited access to the full text of all of my sensitive personal medical information
• Monitoring of my identity across social networking sites
• Instant e-mail, text messaging, Twitter, or RSS alerts about status changes to any of the above
• Tools and calculators to help me evaluate these reports
• The ability for to customize alerts based on my individual needs
• Options to add Fraud Alerts to any or all of the above reports
• Options to add Security Freezes to any or all of the above reports
• Criminal fraud monitoring (if my identity is used by thieves during a crime)
• Identity fraud assistance when traveling outside the USA
• Identity resolution services and insurance covering all of the above reports
• 24/7, and easy access to a real person in customer service via phone and via e-mail
• Arrangements with employers so that after a data breach, I get reimbursed for my monthly fee for this service, rather than receive an offer for another credit monitoring service I don't need

Consumers can't get all of the above. To get large portions of it, a consumer would have to cobble together (and pay for) at least five or six different services. It shouldn't be this hard. It shouldn't be this costly, too.

So, as far as I can tell a truly comprehensive identity protection service doesn't exist. When it does, I will be happy to subscribe.

Are Fraud Alerts Useless?

Monday's blog post discussed the findings of the Annual Survey by the ITRC of identity fraud victims' perspectives. The report included a section about victims who were unable to clear their records of the damage done by identity thieves and fraud:

"Many [victims] reported that the factors complicating their ability to clear negative records involved issues beyond their control, such as: inability to get a police report, credit accounts being reposted on credit reports, fraud alerts are being ignored, and the inability to prove innocence even with a police report. These factors may indicate system failures by various entities involved in resolving the victim’s case. Other situations appeared to be more consumer/victim related such as: I gave up (too many hours), don’t know how to clear my report, and family related issues."

In the survey, about 23% of respondents, who were unable to clear their records, reported that "My imposter is still active - fraud alerts are being ignored." On page 20 of the report, the ITRC's Julie Ferguson concluded:

"The failure of fraud alerts is a three-pronged problem. We have seen that when a consumer sets a fraud alert with one bureau, it does not always propagate to the other two bureaus 40% of the time. The second problem is that not all creditors place phone calls to consumers but use challenge questions at the point of sale. Unfortunately, the thief might know that information and when consumers do not receive a phone call they may perceive the alert is ignored. I also believe a fundamental problem is not being addressed, the fact that businesses write off the losses instead of prosecuting the suspect, which allows the criminals to continue to use the stolen information even after the consumer has cleaned it up. There ramifications for an identity thief are minimal and the odds of getting caught, arrested and prosecuted, I liken to winning the lottery or being struck by lightening.”

I agree with Ferguson. There definitely are several problems at work here.

First, the Fraud Alert tool always seemed weak to me, because potential lenders could easily ignore it. One could argue that this is an ethical problem among potential lenders. I often wondered if the Fraud Alert tool was simply a method for credit reporting agencies to claim that they offer consumers some protection, while still being able to sell as many credit reports as possible.

Second, as a victim of IBM's data breach, I have always wanted the strongest protection available for my sensitive personal and financial information. I first tried the Fraud Alert tool after IBM notified me its data breach, and later renewed my Fraud Alert on my own. When I compared the Fraud Alert tool to the Security Freeze tool, the Fraud Alert tool seemed weak. Ultimately, I added a Security Freeze to my credit reports since IBM never recovered its lost/stolen data tapes and my sensitive personal data is still out there exposed to criminals.

Third, I have written repeatedly about how the Security Freeze tool is not available nationwide for C.L.U.E. insurance reports. And, most consumers I have talked with are unaware of the regional and second-tier credit reporting agencies like Innovis. To me, these are gaps in the financial system that allow criminals to operate more easily than otherwise.

Consequences of the Heartland Data Breach

About a week ago, my friend Janet (not her real name) received a phone call from Visa about suspect charges on Janet's Visa credit card through her credit union. Janet asked me not to disclose the name of her credit union, but it is a well-known higher education credit union located in the Northeast.

Janet asked me what she should do next. Her story has implications for many consumers.

Visa was proactive with contacting Janet about several small charges. Visa wanted to know if the charges were valid. Together, the five charges were less than $50 total, but Visa explained to Janet that often identity thieves and fraudsters submit small charges first. The identity thieves hope that the charges go paid and unnoticed, since many consumers don't check their monthly credit card statement. The real damage is done later when large, fraudulent charges are submitted.

Janet informed Visa that the charge were indeed bogus. Visa closed her credit card account and opened a replacement account. Visa also said that they were going to send Janet an affidavit to sign, indicating that the charges were were indeed fraudulent, which Janet must sign and return to Visa.

My advice to Janet:

1. Keep breathing. Yes, identity theft is scary but her situation is manageable. It definitely seemed that fraudster had obtained her credit card number, if not more sensitive personal data.
2. Definitely sign the form and return it to Visa via Certified postal snail-mail with a return receipt requested. That way she'd have a written record of when Visa received her signed form.
3. Keep a copy of the signed form for her records.
4. File a police report with her local police department, and attach a copy of the affidavit if needed.
5. Definitely accept the new credit card account Visa had arranged
   
6. Check her credit reports for any bogus entries. (Janet had already placed a Security Freeze on her credit reports years previously, when this became available in Massachusetts.)
7. Inform her credit card issuers of her upcoming travel abroad, so they know that credit card purchases in certain countries within certain dates will be valid charges; and do not suspend or close her credit card accounts
8. File a complaint with the U.S. Federal Trade Commission, since the FTC tracks fraud and relies upon consumers to notify it
9. Check her monthly credit card statement closely for bogus charges. Janet said that she already did this regularly and would continue doing so.

Then, I asked Janet if her credit union or Visa had mentioned the Heartland Payment Systems vendor. Like most consumers, Janet hadn't heard of Heartland since Heartland isn't a vendor consumers usually do business with. Janet, like most consumers, is familiar with the credit card companies and banks.

I briefly explained to Janet the Heartland data breach, how hundreds of thousands of credit card numbers were exposed/stolen, and how Heartland isn't sure exactly how many credit/debit card accounts were exposed/stolen. A January 2009 Washington Post story mentioned that the Heartland breach may be the largest breach ever for the number of accounts stolen. Janet said that she'd ask Visa about it the next time she talked with them on the phone.

A few days later, Janet informed me that Visa confirmed that they use Heartland to process credit card transactions, and that this was probably a result of the Heartland breach. Janet's story has several implications for consumers:

• Check your credit card statements closely every month
• File a police report about the fraud with local law enforcement. If local law enforcement won't accept a police report, contact the elected officials in your state
• File a complaint with the FTC. The FTC analyzes the size and scope of identity theft and fraud
• Use a credit card issuer that proactively will warn you of possible bogus charges before your monthly statement arrives
• Know the sensitive personal data about yourself that you should protect
• If you suspect that identity thieves have collected more sensitive personal data than just your credit/debit card number, check your credit reports at the big-three credit reporting agencies for accuracy and for any bogus entries
• If you are the victim of fraud, consider placing a Fraud Alert or a Security Freeze on your credit reports at the big-three credit reporting agencies
• Know the difference between a Fraud Alert and a Security Freeze
• Know the risks of shopping with your debit card versus your credit card. Even better, use cash at retailers you believe may not practice good data security

What bothers me about Janet's story is:

• As of April 12, the Heartland breach site still does not disclose the number of consumers' credit/debit card accounts affected by its data breach. Either the company knows and refuses to say, or they don't know the number affected. If Heartland knows, then the number must be huge -- bigger than the TJX debacle
• Consumers like Janet are not being informed that their credit/debit accounts may have been affected (e.g., stolen) during the Heartland data breach. This seems to contradiction states' laws requiring consumer notification
• At its breach web site, Heartland encourages companies not to take any action about the Heartland breach since things will be fixed soon. Huh? Consumers have been affected. This "take no action" advice seems to also apply to communications to consumers. After all of the problems in the financial and banking industry during the past year, I would have thought that Heartland would understand the benefits of transparency about communications. Keeping secrets does damage, and consumers' trust is damaged or broken by secrets
• Janet's credit union doesn't seem to have provided much help, so far

To be fair, this week Janet plans to contact her credit union for more information and to see what they are doing about the fraud. Maybe Janet's credit union is following Heartland's advice.

If you have experienced fraud recently on your credit card or debit card account, I hope that you'll follow Janet's lead to protect yourself and your sensitive personal data. If you want to share your story below, it would be appreciated.

Fraud Alert or Credit Freeze: What's The Difference?

While discussing identity theft with a business acquaintance, the topic came up about how best to protect our identities. The person mentioned that they had a Credit Freeze in place, but that it was only good for 90 days. This was a clue to me that the person had a Fraud Alert in place and not a Credit Freeze. A comparison of the two options:

	Fraud / Security Alert	Credit / Security Freeze
Definition	A special message attached to a consumer's credit file that indicates the individual may be a victim of identity theft. The alert may require potential lenders to contact the consumer via phone before issuing credit.	A feature for national credit reports where all companies and potential lenders (except where exempted by law) cannot access a consumer's credit report without the consumer's permission.
Advantages	1. Free for consumers 2. Alert durations available for 90 days or 7 years. Military personnel: Active-Duty Alert (12 months) 3. After adding an alert at one credit bureau, the other 2 credit bureaus automatically add an alert	1. Generally, free only for identity theft victims (IL, NM, and RI: free for all residents 65+) 2. Stops identity thieves from opening new accounts or getting credit, loans, or mortgages in your name 3. Stops credit bureaus from distributing your credit report 4. Consumer can lift or remove the freeze when needed for potential lenders (PIN number provided)
Disadvantages	1. Credit bureaus still distribute your credit report 2. Identity thieves can apply for credit or loans and approval may still "sneak through"	1. If you are not an identity theft victim, fees apply to add, lift, or remove a freeze at each credit bureau 2. You must add, lift, and remove a freeze separately at each credit bureau 3. To apply for credit, you must temporarily lift the freeze on your credit reports. This may cause a delay getting credit approval 4. Banks and companies that provide consumer data to the credit bureau will not be allowed to update the name, address, SS#, and birth-date data on your credit reports
Availability	Nationwide	Nationwide, including Puerto Rico, Guam and the U.S. Virgin Islands
Other	1. Adults only	1. Adults only 2. Temporary freeze lift: 3 days minimum and 30 days maximum

Want to learn more? You should be aware of certain identity-theft situations where neither a Security Freeze nor a Fraud Alert will prevent. Also, the Security Freeze laws in many states do not cover consumers' C.L.U.E. insurance reports. You still should shred snail-mail and paper documents with sensitive personal data. And, for maximum protection you should also take advantage of the opt-out resources.

Debix, LifeLock, and TrustedID

A recent issue of the New York Times discussed three new companies which offer consumers identity protection solutions:

"This week, a young company called Debix, which places automated calls to its customers every time someone opens credit in their name, will announce that it has raised a round of financing from private investors..."

Investors in Debix include Gideon Yu, the former chief financial officer of YouTube and the current chief financial officer of Facebook, and Launny Steffens, a former vice chairman of Merrill Lynch.

"A raft of new companies like Debix, LifeLock, and TrustedID say they can make it easier for consumers to protect themselves — for a monthly fee of about $10."

Time will tell if theses companies can deliver the promised value to consumers. In my opinion, the value for consumers is based on a complete solution covering several services:

• Monitoring of credit reports with notification via multiple channels
• Monitoring other reports with sensitive data about consumers, like C.L.U.E. insurance reports
• Assistance with credit restoration and payment on fraud insurance claims
• Assistance with criminal fraud restoration both in the U.S. and in other countries
• Assistance with and restoration from medical identity theft
• Assistance with effective opt-out choices
• After a data breach, coordination of credit monitoring coverage with the employer's or former employer's credit monitoring offer
• Durability: the identity theft protection company should have staying power. Consumers may be reluctant to switch vendors since it involves disclosing sensitive personal data

AARP And Identity Theft

When I was in my mid 40's, I joined AARP. At that time, I needed to learn a lot about elder care since my mother had died and my dad was seriously ill. (He died in 2002.) I figured that reading the print version of the AARP Magazine was the best way to learn the language of retirement (e.g., Medicare, Medicaid, etc.), and to learn about the issues related to elder care.

the magazine has some really interesting and inspirational articles, like the recent interview of the actor Morgan Freeman. During the years, I've subscribed to AARP's various e-mail newsletters and RSS feeds. The AARP web site recently published a good article about identity theft, titled Block Your Credit Reports to Prevent ID Theft.

If you are unfamiliar with the subject of identity theft, or if you want simple clear descriptions (like the difference between a Fraud Alert and a Security Freeze), then this is a good starter article. The article includes sample letters for users to request a Fraud Alert from one of the three national credit bureaus. The article should have included toll-free phone numbers for the three credit bureaus, but didn't.

As I mentioned, this is a good starter article. While the article doesn't tell you everything, it provides the basics in an easily readable format, so a consumer can place a Security Freeze on their credit report.

Fraud Alert Renewal: Easy & Fast

During the last week of September, I called the Experian credit bureau to renew the Fraud Alert on my credit file for another 90 days. I called since Experian has an easy and quick phone system for consumers.

During the phone call, Experian advised me that it would automatically notify the other 2 national credit bureaus, which would also place a Fraud Alert on my file at their services. The entire phone call took maybe 5 minutes max. About 3 days later, I received via surface mail from Experian a written confirmation of the transaction:

"We have added an initial Security Alert to your credit file as requested on your behalf by one or more of the nationwide consumer credit reporting companies. This message, which will expire after 90 days from 09/27/2007, alerts credit grantors to verify your identity in case someone is using your information without your consent. As an additional precaution, we have removed your name and address from pre-screened offer mailing lists for six months."

The next day after that, I received via surface mail confirmation from the TransUnion credit bureau of my Fraud Alert renewal. I placed the initial Fraud Alert on my credit report at all three national credit bureaus back in July, after IBM notified me of their data breach. If you want to place a Fraud Alert on your credit report, the TransUion site lists phone numbers for all three national credit bureaus.

I fully realize that limitations of the Fraud Alert tool. The national credit bureaus make money by selling consumers' credit reports to (hopefully responsible) creditor companies. The Fraud Alert tool doesn't stop the credit bureaus from selling my credit report to credit grantors. The credit bureaus simply append an alert notice to my report. If you want to learn more, the Experian site lists the reasons companies purchase consumers' credit reports. Since credit bureaus don't notify consumers when our credit report is distributed, I use my credit monitoring service for notification.

Now that 2 of the 3 national credit bureaus will offer the Security Freeze tool starting in November 2007, I look forward to using that tool to really lock down my credit report so that nobody has access to it, unless I authorize access. As each credit bureau releases details about its Security Freeze program, I will share my findings in this blog.

Will I let the Fraud Alert expire on my credit reports once I have the Security Freeze in place? I haven't decided yet about that.

Fraud Alerts

After IBM informed me that IBM had lost data tapes with my personal data, one of the first things I did was contact the three credit bureaus in the USA. These thieves didn't have to do any dumpster-diving, or break into my snail-mail-box, or hack into IBM's computers, since the data tapes fell off the back of the truck.

A Credit Bureau is a company that compiles and distributes credit and personal information about consumers to creditors. This credit information may include payment habits, the number of (existing and prior) credit accounts, the balance for those accounts, and the length and place of employment. There are three credit bureaus in the USA: Equifax, Experian, and TransUnion. The Identity Theft Victims Guide lists the phone number, mailing address, and web site for all three credit bureaus.

Creditors are the companies that loan money or sell goods "on credit" to consumers. A variety of companies contact a credit bureau for the credit data of a consumer applicant. For example, when you apply for a loan (with a bank, auto company, or finance company) or apply for a wireless phone plan, that company (or bank) will contact a credit bureau to learn more about your habits with money. The company's goal is to learn enough to decide if you are a good credit risk or not. Consumers deemed a good credit risk receive the loan and pay less for the same goods; typically a lower interest rate. Consumers deemed a poor credit risk won't get the loan, or if they do will pay a higher interest rate.

One scam is when identity thieves pretend to be somebody else to apply for a loan, mortgage, or buy a large dollar-value item. The thief uses the identity victim's good credit and, of course, doesn't pay off the loan or pay for the product. Then, the creditor seeks the identity theft victim to pay for the loan or purchase that the victim never made. So, anything that makes it difficult (or impossible) for identity thieves to access credit information is a good thing.

One tool to make it difficult is a Fraud Alert. A Fraud Alert is a "flag" or indicator on a consumer's credit file that the individual may be a victim of identity theft. The Fraud Alert requires the creditor to contact the consumer via phone before issuing credit.

Consumers have a choice of a fraud alert for 90 days (my choice) or seven years. At the end of the period, the consumer can extend the alert by contacting the credit bureaus.

To place a Fraud Alert on your credit file, you simply contact any one or all three credit bureaus. (I left nothing to chance and contacted all three by phone.) Each credit bureau will inform the others of your Fraud Alert request. All credit bureaus will send a written confirmation of your Fraud Alert. The Equifax confirmation included this:

If you are a victim of fraud, the first step in protecting your credit information is to add a fraud alert to each of the credit files maintained by the three national credit reporting agencies. Adding a fraud alert may aid in the prevention of further fraudulent activity. We were successful in adding an alert to your Equifax credit file.

The TransUnion confirmation included this:

"We have received a request and added to your credit report an initial Fraud Alert. The alert will remain on your file for 90 days, as specified by the expiration at the end of the statement, and will be provided to anyone who receives a copy of your credit report. The alert will inform all credit grantors to take precautionary measures to verify the identity of the applicant before extending credit."

The confirmation also stated:

"As TransUnion is a credit-reporting agency, your credit report may be released to credit grantors who are active members of our agency. In order for the credit grantor to view the Initial Fraud Alert on your file, the credit grantor must first access your credit report."

As I read all three confirmations, I began to understand that the system is tilted to allow all three national credit bureaus to continue to distribute my credit file with my fraud alert appended. A careless credit bureau could still pass personal data to a thief pretending to be a valid creditor, and the identity thief could still take advantage of my (and your) good credit. This has happened to one data aggregator! See any news story about ChoicePoint at C/Net or PRC or InfoWorld or Consumer Affairs.

Definitely not a bullet-proof system. I felt a slightly better. Not great, but slightly better. A little protection, but not bullet-proof. I like bullet-proof.

This is one reason why I believe that the U.S. commerce system is tilted away from consumers and towards companies - to facilitate profit-making and lending credit. By sharing consumers' credit information, companies can make more money, but both the companies and the consumers incur risk. If I am going to participate in a system where I incur risk, I want rewards for my risk. Conversely, if companies want to benefit from sharing my personal data, then they'd better adequately protect my personal data. If they can't protect it, don't use my personal data and delete it!

If you feel this way (or not), I'd love to hear from you and why. In my opinion, the system needs to be balanced between companies and consumers, with stronger protections for consumers who typically have less resources than a corporation.

The TransUnion confirmation also stated:

"Under federal law, you are entitled to request a free copy of your credit report within the next 12 months."

This was good news at a time when I was receiving plenty of bad news. It's always good to get something for free... especially when you need it.

Next entry: IBM's offer