Think You’ve Got Your Credit Freezes Covered? Think Again

https://krebsonsecurity.com/2018/05/think-youve-got-your-credit-freezes-covered-think-again/

by el_duderino • 8 years ago

152 84 8 years ago

dsfyu404ed• 8 years ago

I'd pay money for a service that monitors who all the services are in the credit reporting space and freezes my credit at them for me.

Shivetya• 8 years ago

I would rather anyone opening a line of credit be required to obtain proof of acceptance by the person named on the account and until doing so they are 100% liable for all debts incurred. How this is defined will require regulation. The burden is increased at any time a request is made outside of the state and city of residence

toomuchtodo• 8 years ago

Call your local representative and demand this then. That is how legislation is enacted.

njarboe3• 8 years ago

This is already the law. You are not responsible to pay debts incurred by another person. The problem is when the bank or company that gave credit to someone else that used your identity information is allowed to lie to a credit bureau about the fact that it was you who defaulted on the debt. Otherwise you could just tell the bank, "Pound sand stranger, I never borrowed any money from you. Stop bugging me or I'll get a restraining order.", and never have worry about how someone has pretended to be you to a bank.

Large fines for banks and companies that libel people by telling information brokers lies is the way to stop this problem. The idea that when this happens it is "identity theft" and the person whose identity was stolen is responsible for the problem is ridiculous. This problem should be called libel and the perpetrators (the entity reporting false info that hurts you) punished.

reaperducer• 8 years ago

Bottom line: Whenever possible, wherever possible, pay cash.

I used to laugh at my father-in-law whom I once considered to be a conspiracy theory whackjob with his off-the-grid lifestyle. As more and more of his "crazy" insights turn into New York Times headlines, I'm starting to think he was ahead of the curve.

teddyh3• 8 years ago

Privacy Aspects of the Cashless and Checkless Society. Testimony before the Senate Subcommitee on Administrative Practice and Procedure. Paul Armer 1968

https://www.rand.org/content/dam/rand/pubs/papers/2013/P3822...

teddyh3• 8 years ago

Stallman was right:

I never pay for anything on the Web. Anything on the net that requires payment, I don't do. (I made an exception for the fees for the stallman.org domain, since that is connected with me anyway.) I also avoid paying with credit cards . For freedom's sake, insist on paying cash. When a business pressures you to pay in an identified way, that means your help as a citizen is needed: say, "If you won't take my cash, no sale!"

https://stallman.org/stallman-computing.html#internetuse

pmiller23• 8 years ago

Good luck buying a house or a car with cash. I know he's specifically referring to things on the internet, but, I'm sure, Stallman being Stallman, he would say you should follow this rule offline as well.

emodendroket2• 8 years ago

Well, I think paying with a credit card is pretty good, because I get more protections than if I had paid with cash. If it weren't for the pell-mell system of credit and particularly identity verification I think otherwise it would be a pretty good system.

gascan2• 8 years ago

Am I missing something here? Paying cash doesn't prevent the opening of fraudulent lines of credit in your name.

Equifax et al don't particularly care if you pay cash, they have some form of record on you either way.

jessaustin3• 8 years ago

I guess the idea is that if one were "off the grid" enough not to have a phone, one's details wouldn't be in their DB in the first place. That would make one's identity harder to steal, which would cause the thieves to move on to the next victim.

convolvatron• 8 years ago

if you use cash exclusively, then you have no credit to exploit. equifax knows about me, but no one will give me a loan.

Deinos• 8 years ago

Exactly. As long as you have a SSN and other identification out there, you are a potential target...

IncRnd3• 8 years ago

Yes, you are missing the other attack. Someone can take advantage of already existing lines of credit, credits cards, etc. which they presumably will not be able to do if you pay for everything in cash.

lisper• 8 years ago

A much more effective strategy than paying cash is to run your own email server (making sure that it is secure, of course). Email is one of the most common attack vectors, but most scammers are going to target the big providers. Attacking an individual server is not going to be worth the bother.

SilasX• 8 years ago

You still need to get a credit card at some point, preferably early on, or else you may have to go through what I did: where annualcreditreport.com etc will swear up and down that you have a 740+ score but no one wants to touch you [1] because you have no history and appear as subprime.

[1] even apartments. And utilities will require an additional deposit.

tomohawk3• 8 years ago

Especially since its not chip and pin in the US, its really easy for the CC number to be skimmed and stolen. Also, any place like food trucks or restaurants where they take your card, it seems much more likely to have the CC number stolen. We've had way less problems since going to cash for those kinds of things.

Dirlewanger3• 8 years ago

It's all so tiring. It's seriously going to be decades until we get politicians in power that understand the Internet and start holding companies accountable that don't give a shit about security (namely, all of them).

rcthompson2• 8 years ago

Will it ever happen? When the current generation of children reaches office-holding age, a majority of them may understand internet culture, but I don't think a significant fraction will ever understand the internet in a technical sense.

patja• 8 years ago

This reminds me of the scifi first contact novel "Blindsight", which while not the best writing is chock full of intriguing concepts, one of which is the role of the "synthesist": a career where your job is to act just as a communications bridge between those who are so highly technically specialized (including cybernetic body modifications) that they are effectively incapable of communicating to managers and government officials. Hence the role of the synthesist, just to be a neutral observer who can help decision makers make sense of reality.

organicmultiloc2• 8 years ago

The current generation of youngsters seem to be really good at tapping things quickly to get what they want on a phone, but if anything they are less technically literate than previous generations.

My niece dropped a programming adjacent class in college because they required them to use real computers "like with keyboards for old people" and she didn't want to learn how to do that.

They're also really good at optimizing for likes on insta, I would argue that is not technical literacy either.

InclinedPlane2• 8 years ago

What is your reasoning behind that? This is seriously one of the dumbest "kids these days" statements I've ever read. Kids will become technologically sophisticated, many kids already are. Many kids will attain higher technical proficiency than you ever had, for example. Why would it be otherwise?

pishpash3• 8 years ago

You are misreading it as an understanding issue. There are plenty of things politicians don't understand and there are experts for that, or else the country doesn't run. The impetus is never understanding, but power. Until there is political impetus for them to care, they don't.

emodendroket2• 8 years ago

Also, most issues that become contested in the US at present have some sort of powerful business interest on both sides. There isn't a constituency for credit bureau accountability that has the resources for anyone to care.

ashleyn• 8 years ago

That's cute, expecting the federal government to even barely function in this dysfunctional era.

We don't get action on these things because Congress is fundamentally broken.

just_observing• 8 years ago

Brian Krebs - can you please change to a responsive theme?

Thanks.

PotionSeller• 8 years ago

I absolutely hate our entire credit system, the lazy way it handles our sensitive info, and the eagerness to extend credit to anyone without scrutiny of their identity.

Big incoherent rant incoming:

In 2016 someone stole my identity and in about a 1 month period took out tens of credit cards and new bank accounts and phone account which they immediately over drafted. They somehow managed to change the address in my credit file, and so I wasn't getting any failure to pay notices. At the same time it was quite soon I found out because at least one creditor managed to find my real address asking about a 18,000 loan approval for furniture from The Brick. The police were easy enough to deal with and took a report and I had to use this to prove to creditors it was fraud.

I had Equifax do their own investigation, and they agreed it was fraud, but they only removed the creditors who happened to appear on file during their investigation.

A year past, and I check my credit and it was 799, all clear. Then last fall I get a call from a creditor saying I owe them money, they required I go to their bank to fill out the paperwork. One more cleared. Then in February I'm hearing from yet another bank about an overdraft account. Once again I proved to them it was fraud by providing the police report number. "Ok, well it will take us 30-45 days to remove this from your credit file". Its coming up to 45 days and its still there. I called them to clarify about when it will be removed, and get the same bs. I do not believe their word so I have also sent another dispute to equifax. MY MORTGAGE RENEWAL IS DUE JUNE 1 AND THIS SHIT HAS STOPPED ME FROM MOVING MORTGAGE PROVIDERS TO GET A BETTER RATE.

Now during this latest fiasco, I do another credit check and discover ANOTHER phone company on there says I have a bad debt with them and a note that a collections agency is after me. I succeed in having this removed from my credit file after dealing with Equifax, but for reasons beyond me they did not remove the one from the bank I am disputing in the previous paragraph, so I have to hope it will clear when they way it will (30-45 days from early April), or hope my second dispute works. Note that these latest bad debts are still originating from 2016, its just taken the banks that long to pin the blame on me and attack my credit file.

So this has been a lot of stress on me, I have failed to secure a new mortgage lender which will cost me in interest over the next 3 years on mortgage payments. In addition, I just discovered my TransUnion file is still a giant mess with shit from last fall on it. Apparently Trans Union and Equifax don't synchronize.

Long story short, there isn't shit you can do to speed up anyone helping you. The police are competent and will have your back but they can't stop creditors from attacking your file. Equifax is slow and not thorough in their investigations and make themselves hard to reach. The banks can pin a bad debt on anyone they chose, never mind that the onus should be on them to prove I took out the loans they claim. Like, show me a signature, show me the ID used to get the loan... Oh its fake? Then fuck off. Nope, they will make you jump hoops to prove it isn't you, and then the cherry on top is they will be very very slow to do anything to remove it off your credit file once you have in fact proven its not you.

Good luck to all of you, you are all vulnerable to this shit.

TechieKid• 8 years ago

The answer is registered mail, return receipt requested, and a complaint with the CFPB, although how on-the-ball that agency will be since the new administrator was appointed is YMMV.

logfromblammo• 8 years ago

I'd be more inclined to write a pro forma letter, then sue for statutory damages for technical violations under the FCRA and/or FDCPA the instant the established deadlines pass. It puts the burden of proving the validity of the debts on them, and if they ignore you or drag their heels, you win by default.

cwkoss• 8 years ago

I wonder if anyone has ever successfully sued a credit reporting agency for defamation when the agency reports information about fraudulent accounts.

Seems like it would be very easy to demonstrate damages.

pmiller23• 8 years ago

AFAIK, they just aggregate whatever is reported to them. Without any sort of editorial discretion, it doesn't seem likely you could go after them for any damages.

mdpopescu• 8 years ago

Patrick's article might help here: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

kxyvr• 8 years ago

Since I was having a hard time finding the link in the article. Here's the page to add a NCTUE security freeze:

https://www.nctue.com/consumers

Here are the pages for adding security freezes to the other big four agencies:

https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo...

https://freeze.transunion.com/sf/securityFreeze/landingPage....

https://www.experian.com/freeze/center.html

https://www.innovis.com/securityFreeze/index

Most people don't know about Innovis, which was mentioned in the article. That said, I've never run into a company where I've needed to lift an Innovis freeze. Anyway, I agree that it's tiring to constantly track which data brokers allow (are required to) adding a security freeze. In my opinion, better legislation is needed to curb this activity and data brokers in general.

organicmultiloc2• 8 years ago

I tried to fill out the NCTUE freeze page several times, it keeps claiming there is a reCAPTCHA error despite me clicking it out correctly and getting the green check.

Seems to be intentionally broken to avoid people freezing.

Jwarder• 8 years ago

I've seen the reCAPTCHA issue a few times this month on other sites. My guess this is a result of Google shutting down the reCAPTCHA v1 API.

hex1848• 8 years ago

I am tired of people calling me a "victim" of identity theft. I'm not the victim. The companies and government agencies that allowed themselves to be defrauded by someone posing as me are the victims. If you didn't do your due diligence in properly verifying the identity of the person you handed out cash, goods or services too it's on you. That being said, the entire system is broken. I've had 5 cellphones taken out in my name, I've had multiple credit cards opened using my social security number. I've been interviewed by a special agent with the State Department because someone tried to get a passport using my data. I'm sick of dealing with other peoples fraud problems. Fix it already!

dragonwriter2• 8 years ago

I am tired of people calling me a "victim" of identity theft. I'm not the victim.

Usually, the person whose identity is stolen is the victin.

The companies and government agencies that allowed themselves to be defrauded by someone posing as me are the victims.

They are also victims, but until you—often at considerable personal effort—have gotten all the debts and other bad marks by the fraudster dissociated from your identity, you are disadvantaged by it, and if you are disadvantaged or have had to pay a cost to escape that disadvantage, you are a victim, too.

typomatic• 8 years ago

They are also victims, but until you—often at considerable personal effort—have gotten all the debts and other bad marks by the fraudster dissociated from your identity, you are disadvantaged by it, and if you are disadvantaged or have had to pay a cost to escape that disadvantage, you are a victim, too.

You seem to be misunderstanding the point badly--the situation you have described is nonsense.

Firstly, what do we mean by "having your identity stolen"? I submit that this is not an attack on me as a person, it is an attack on a fictional representation of me held by a conglomerate of corporations.

This is the point of OP: I am not involved in these transactions! I haven't committed a crime, purchased anything, or interacted with either the party who has defrauded this conglomerate nor this conglomerate. In fact, due to the way this information is collected and stored, I may not have ever had any direct relationship to either party.

So what's happened here is that a conglomerate of companies have been defrauded and now insist that I am to make amends for it. It's nonsensical, and no amount of repeating the facts of the current situation will make it anything but ridiculous.

AndyMcConachie• 8 years ago

This 2 minute video explains everything you need to know about the phallacy of identity theft. With credits to Mitchell and Webb.

https://www.youtube.com/watch?v=CS9ptA3Ya9E

harlanji• 8 years ago

Good to know. Concurrent crises also F everything on paper without fam wealth, up but are less common and probably not considered. 800 credit until that, as we start talking about block chain of course. May we always be unchained in these matters, or use a chain model that rolls off old data and keeps an initial value aggregate of old data on the effective block0/genesis or so.

slumberlust2• 8 years ago

Anyone else getting an unsecured link warning from the freeze link on the NCTUE website?

https://www.exchangeservicecenter.com/Freeze/jsp/SFF_Persona...

Think You’ve Got Your Credit Freezes Covered? Think Again

Related Stories