Wed, June 04, 2008
We Promise To Guard Your Social Security Number… Next Time
It’s wise to do whatever you can to protect your confidential information, but some ID theft losses are impossible to avoid. According to Computerworld.com, four million or so customers of Bank of New York Mellon recently learned this the hard way.
The bank recently disclosed that in February and April this year a courier service lost a number of data storage tapes containing names, birth dates, and Social Security numbers from customers of BNY Mellon and the People’s United Bank in Bridgeport, Connecticut. Although one might reasonably hope that banks are smart enough not to store such information without at least taking the trouble to encrypt it, that wasn’t the case. The Bank is promising that from now on, it will only store such information in encrypted form. Customers whose data was compromised are being given free ID theft protection services.
According to a study by the Ponemon Institute, this kind of large-scale data breach appears to be on the rise. For some reason, financial institutions – not to mention retail companies, grocery chains and other organizations that hold large amounts of confidential personal information – are having a hard time keeping that information to themselves. So far, there’s only scattered evidence that these large breaches have resulted in actual use of the stolen information, but the stolen data could be used years after the original theft. Unlike credit card numbers, Social Security numbers can’t be closed out when a number is compromised. Even if you get a new number, the old one might still be used by an identity thief to set up a fraudulent account.
Avoiding ID theft hassles
A number of firms are offering various kinds of protection against ID theft. One of the more prominent ones, LifeLock, has a rather sensation promotional gimmick – the company’s president displays his own Social Security number on their web site to demonstrate how certain he is of his company’ services. The company is being sued for fraud in several states. In reality, Lifelock’s services are probably only of use to the most paranoid and still may not provide all the protection that people are expecting unless they read the fine print carefully.
Probably, besides diligently avoiding behavior that exposes your information to theft, the best move that you can take is to have your credit information “frozen” at the three major credit bureaus.
As a victim of identity theft, I finally took the plunge to do this a while ago. I must say that the credit freeze process seems unnecessarily tedious. Why is it that credit bureaus can give you access to your credit report online in a matter of minutes, yet if you want to freeze your credit file you must send each bureau a letter and a bunch of information by mail? If you can document satisfactorily that you’re a victim of identity theft, your credit file can be frozen for free; if not, they’ll charge you a fee that varies with your state of residence.
For some reason, the evidence that the bureaus accepted four years ago (when my first credit card was compromised, I filed a police report and requested a seven-year fraud alert) was not sufficient to get a freeze. After an initial round of back-and-forth letters, rather than hassle with them further I paid the fee; for Massachusetts residents it costs $5 per bureau to set up a freeze.
The downside of a freeze? You won’t be able to open any new credit accounts (mortgages, credit cards, or even utility accounts) without “thawing” your information. Each bureau gives you a passcode with which to request a thaw and (of course), you pay a fee each time you do so (meanwhile, as nearly as I can tell, they’re still free to sell your name to banks that want you to open new credit accounts).
Having your credit records frozen still won’t stop anyone from using a stolen credit card number, but a freeze should prevent anyone from opening a fraudulent account in your name. Fradulent accounts are the messiest form of ID theft to undo, because you must take time to prove that you aren’t really the person who opened the account, and your credit rating can be damaged in the mean time. If you’re really concerned about ID theft, a freeze, coupled with vigilance, is probably the best solution. You never know when a data tape with your account information on it is going to fall out the back of an armored truck….
Related Post:
BNY Mellon: Now It’s Personal