From the category archives:

identity theft

Do you change your own oil? Most of us are capable of performing this simple maintenance on our vehicles, but we choose not to. After all, it is messy work, requires a few specialized tools, and disposing of used oil can be a hassle. To boot, the cost of an oil change at the local service station, specialty stores like Direct Tire or Pep Boys and even the dealerships is relatively modest.

So what’s the connection with identity theft? Identity theft is a big problem that is affecting more and more people each year. At a minimum, the problem creates a great deal of aggravation and considerable worry. At worst, it can cause debilitating harm to your credit, making it difficult or impossible to buy a car, rent an apartment, refinance your home or even get a job.

To combat this problem, many companies such as LifeLock, TrustedID, IdentityGuard, ID Watchdog and others offer services that they claim are designed to help you prevent, identify and correct any problems that may arise due to identity theft. They claim to do this through a multi-faceted approach that includes removing your name from pre-approved credit card mailing lists, providing annual copies of your credit reports and searching the web for potential indicators that your identity has been compromised. And then when a problem occurs, they provide counseling and guidance on how to repair the damage.

Until recently I was not very much in favor of identity theft protection services. After all, many of the features offered by these services are items that anyone can easily accomplish on their own, just like changing your oil. For instance, under federal law, consumers are entitled to receive a copy of their credit report from each of the three major credit bureaus once each year. Likewise, anyone can sign up at www.optoutprescreen.com to limit unwanted credit and insurance offers. And much of the information needed to repair credit damage is readily available on line (The FTC has extensive information available here). So why then should anyone pay on the order of $100 or so each year when they can do this all for free?

The reality is that we are busy people. Or we’re not perfectly organized. Or we just don’t trust that we are going to dot all the i’s and cross all the t’s. Just as with the convenience of the oil change services, there is clearly a place for these identity protection companies even if all they are doing is something that we can do ourselves.

However, before engaging in such a service, be certain that you know exactly what you are getting and what you are not. For instance, many people may mistakenly think that the “million dollar” guarantees offered by these services will pay them money to cover substantial loss of income or provide other compensation if they are forced to pay higher interest rates on mortgages or car loans due to damaged credit. Read the fine print very carefully – in many cases, they do not make any direct payments to the consumers except possibly to reimburse certain limited expenses. To the extent that any significant money might be paid, it is primarily for lawyers and other professionals who they hire to clear your name. Lost income, if it is covered, is very limited (i.e. only for the time off work spent fixing your identity).

More important, the insurance may not even be available unless you can show that your loss was due to a failure of the service and not some other cause. Identity theft is tricky business and there are many ways that thieves can get hold of your information. The protection services cannot possibly stop all of the leaks, so unless it is their fault that you have a problem, their insurance may not be available to help you fix the problem.

What are you doing to protect your identity? Have you used one of these services? Has it been of any value? Do you have questions about identity theft? Please fill out a comment or send me a note.

What do you think? Add your comments here...

I recently had breakfast with my good friend, Cherie Hafford, and we talked about the Massachusetts Data Security Regulation and how much of a burden it creates, especially for small businesses (more on the Regulation here and here). The Regulation is supposed to be scalable – that is, the degree of compliance should be proportionate to the size of the business and its resources. But for small businesses, even the most stripped-down, basic plan will still require considerable time and money—time and money that most business owners simply do not have or will not spend.

The Regulation likely affects millions of businesses around the country and perhaps the world. Read literally, the law is not confined only to Massachusetts businesses; it applies to any business wherever located that has customers or employees in Massachusetts. So if a small crafts shop in Santa Fe accepts a check from a customer in Cambridge, the shop must implement a written information security policy, or WISP. And a gas station in Orlando that accepts a credit card from a tourist who lives in Quincy would have to comply with the Regulation even if they had no idea where the customer lived.

Did the state go too far? Setting aside the constitutional and enforcement challenges, was there perhaps a simpler way to achieve the goals that would not impose such a burden on small businesses that are already struggling?

Here are six ideas on how to fine tune the law to make compliance easier and achieve the same objectives:

1)      Many businesses that accept credit cards never store the account numbers. They simply swipe them in a POS device and hand the card back to the customer.  Why not make that activity compliant with the Regulation without the need for any written plan?

2)      Same thing with checks. Most businesses that accept checks want to get the money into their accounts as quickly as possible. How about a rule that says businesses are compliant if they deposit checks within two business days and keep the un-deposited checks under lock and key until they are deposited?

3)      Focus the regulations on the banks, credit card companies and the businesses that provide the POS devices and connections. Require that the data be locked down tightly and impose substantial penalties for a breach. The standards already exist – i.e. PCI (Payment Card Industry) standards.

4)      Businesses that have employees need to have their social security numbers on file for payroll, benefits and other purposes. Just as with checks, if they are kept under reasonable security and only employees with a need to know or see the information are permitted access, then this should be deemed to be in compliance without the need for any further written plan. The Regulation could set forth a simple plan that if adopted and followed will be deemed to be compliance.

5)      Work within the parameters of the Fair Credit Reporting Act to reinforce the rights of victims of identity theft. There are far fewer victims than there are businesses who need to protect the information from possible misuse.

6)      Do more to educate businesses about the various practices that reduce the risks of identity theft. For years, we have seen signs in restaurants telling employees to wash their hands before going back to work. Maybe there should be similar signs in the human resources and finance departments advocating safe practices with sensitive financial information?

Of course no matter what is done, there will still be dishonest people who will take advantage of a situation and cause harm to others. This is not to excuse careless or negligent business practices –enforcement should still require a reasonable degree of caution and vigilance. But the new Regulation ignores the practical reality of small business and imposes too many requirements that may be unnecessary.

Please share your own ideas on the Regulation by posting a comment below.

What do you think? Add your comments here...

20 Year Sentence for Identity Theft

March 26, 2010

As cyber-thief extraordinaire Alex Gonzalez is sentenced to twenty years in prison, I find it ironic that his brilliance is outweighed by his stupidity. Gonzalez pleaded guilty to the massive theft of credit card numbers by hacking into TJX, BJ’s and many other payment servers. Certainly some amount of talent was required to perform these [...]

Read the full article →

Identity Theft and Credit Card Receipts – Is Your Slip Showing?

March 22, 2010

I’d like to think that it’s common knowledge that credit card receipts can be a prime opportunity for identity theft. However, too many of us simply crumple the receipts and throw them in the trash without a care. If the receipt shows your full credit card number and expiration date, this is an invitation for [...]

Read the full article →

Truth or Delusion? – Myths and Misunderstandings about the Massachusetts Data Security Regulation. Part II

March 8, 2010

In my previous article, I discussed the lack of guidance from the Attorney General on implementation and enforcement of the new Massachusetts data security regulation. The law is aimed at protecting residents from identity theft by requiring practically every business with employees or customers in the state to implement a written information security plan (WISP). [...]

Read the full article →

Truth or Delusion? – Myths and Misunderstandings about the Massachusetts Data Security Regulation. Part I

March 4, 2010

As of this past Monday, the nation’s “most comprehensive data protection law” went into effect, yet many questions remain as to how the regulation will be interpreted and enforced. The law was promulgated by the Office of Consumer Affairs and Business Regulation. While OCABR put it together, the Massachusetts Attorney General is charged with enforcement. [...]

Read the full article →

Small Businesses Most Vulnerable to Data Breaches That Lead to Identity Theft

February 24, 2010

We hear it every day. Criminals prefer the low hanging fruit – the easy mark that is not likely to detect the invasion and where the damage done is too small to justify a major investigation.  Identity thieves are no different. Most are not willing or able to target a major corporation with multiple layers [...]

Read the full article →

New Identity Theft Law Aimed at Prevention – Heads Up Business Owners!

February 22, 2010

Do you have any customers or clients who live in Massachusetts? What about employees? If you answered yes to either of these questions, then you had better pay attention to the new identity theft law that takes effect on March 1. It almost certainly applies to you and your business and will require that you [...]

Read the full article →