The Problem
Identity theft can hurt us financially in several ways but the two aspects I'll discuss here are theft from an existing financial account (PayPal, credit cards, Amazon, a broker, etc.) and thieves creating new financial accounts in your name.
Here are two examples of theft from an existing financial account.
Three or four times a year I am contacted by one of my credit card companies to inform me that they have detected fraud in my account, often before I even see it. Their solution is to issue a new card with a new account number. That fixes one problem but causes others because three or four times a year I have to change my card number at places that store it like Netflix and Amazon. Another time, Amazon informed me that someone had ordered a $4,000 TV from my account but that they had stopped the order because it was clearly fraudulent.
Most of these incidents work out OK, except for the inconvenience, because my credit cards are insured against fraud by the issuer.
A lot of elder theft and fraud, however, is committed by family members. If a family member steals your credit card, Social Security check or ATM card, you probably won't be reimbursed unless you are willing to file legal charges against that family member. Sadly, you need to take extra precautions to protect your PINs, passwords and other vital information from family members. Remember that many of them will have physical access to your computer.
The second risk involves someone stealing your identity and opening a new account in your name. Unless you are vigilant, they can use these accounts undiscovered for some time and you will have the nightmare of proving you aren't responsible for the charges. The accounts they open could be anywhere from PayPal to a home equity loan.
Who Steals Your Identity?
What does this mean to you? It means that you can take extensive precautions to ensure that you protect your valuable identity information only to see the thieves just steal it from someone you do business with who also has your information.
The latter is largely beyond your control. You can't control your personal information that Experian or Target keeps and has promised to protect.
Where Do Thieves Find Your Information?
If bank-robber Willie Sutton were an identity thief, he'd explain his attacks on large companies by saying, "Because that's where your data is."
Why rob your home, steal your wallet or hack into your PC to steal one ID when a thief can hack Yahoo and steal millions?
If the Home Depot breach was a bank robbery, the recent hack of the credit-reporting agency Experian was like robbing the Federal Reserve.
[Tweet this]Should you freeze your credit reports? Yup.
The Credit Reporting Agencies
In addition to the three major agencies, there are about 40 others[2], most of which specialize. You should focus on the top three (and perhaps Innovis.)
When you apply for a new credit card, an apartment lease, or a reverse mortgage, for example, the company accepting your application will first check your credit record. Unless you have frozen your credit report at the credit-reporting agency they choose to check, this will be done easily and will not be reported to you.
This simplifies your life but, unfortunately, it also simplifies the life of the thief opening an account in your name.
Freezing Your Credit Reports
The bad guys can't open an account in your name without your PINs. This is less convenient for you because you have to unfreeze your reports when you want to open a new account. (This is typically less inconvenient for retirees because we tend to open fewer new accounts.)
My reports have been frozen for years, so when I recently opened a new account the lender called me to tell me that he couldn't run a credit check because my credit report was frozen. I try to remember this and unfreeze the account when I submit an application, but I often forget.
I asked the lender which agency his company uses and was told Experian. I knew then that I only needed to unfreeze the Experian reports so I logged onto Experian.com, entered my PIN, and unfroze the account.
I could choose to unfreeze it for everyone or for one specific lender so I chose the latter. I could also unfreeze it until I chose to freeze it again or for a specific time period, so I chose to unlock my credit reports for this single lender at one agency (Experian) for five days, after which the account would once again be frozen to everyone.
Inconvenient? Yes, it cost me a few more days in the application process because I had forgotten about the freeze, but not nearly as inconvenient as identity theft.
Credit Monitoring Services
The problem with these services is that they won't notice a problem until your creditor reports it to the credit-reporting agency. (Again, they monitor your credit report at the agencies, not your actual Visa or PayPal accounts.) This is somewhat akin to checking the obituaries each morning to see if you're in them.
You may have seen a TV commercial that shows a bank being robbed while a security guard just watches. "Aren't you going to do something?" a customer asks while lying face down on the floor.
"Oh, I'm not a security guard," he responds. "I'm a security monitor. My job is to tell you when your bank is being robbed. By the way, your bank is being robbed."
The credit report monitoring services are even less useful. They tell you that your bank was robbed, not that it is being robbed.
Protecting Against Fraudulent Accounts
I protect my existing accounts with two-factor authorization everywhere it is available.[3] I also set up email notifications on every financial account that offers them to immediately notify me of unusual transactions, like those for large amounts or charges outside the U.S. Lastly, I set up email notifications for accounts that don't offer this service at Mint.com.[4]
For the second risk, someone opening an account in your name, I highly recommend that everyone — especially retirees, since they open fewer new accounts and may be more financially vulnerable — freeze their credit reports at all major credit reporting agencies. It may cost a few bucks, depending on your state laws[5] and it will be a little inconvenient, but it is worth the effort.
Here are some directions if you choose to freeze your credit reports.
- Assume that your ID has already been stolen. That's the safest assumption and it's probably true. Many IDs have been stolen and the thieves are waiting for someone to buy them. Maybe they just haven't gotten around to yours — yet. Once you accept this fact, you will focus more on how to protect yourself after your information has been stolen.
- Log on to all three credit reporting agencies (links below under "References") and freeze your credit reports.[6-8] Follow their directions. You will need to provide a good deal of personal financial information to do this online so they can be sure that you are you, but you always have the option of calling the phone number they provide.
- Don't do this, of course, over a public Wi-Fi network.
- Request a freeze at the smaller agency, Innovis, because as the Washington Post asks, "Why not?"[9]
- Some concerns have been raised regarding weak PINs provided the agencies and whether PINs were stolen in the Equifax breach.[10] Equifax says they were not, but not everyone is willing to trust Equifax' word right now. To play it safe, you might want to change your PIN if you already had one. Equifax says they will add that ability immediately and begin providing more random PIN numbers, as well.
REFERENCES
[1] 2017 Data Breaches - The Worst Breaches, So Far | IdentityForce®.
[2] Credit Reporting Agencies: Big 3 & Alternative Bureaus | WalletHub®.
[3] Two-factor authentication: What you need to know (FAQ) - CNET.
[4] Mint: Money Manager, Bill Pay, Credit Score, Budgeting & Investing.
[5] Details of credit freeze laws in all 50 states.
[6] TransUnion Fraud Alert
[7] Equifax Alerts
[8] Fraud Alert Center at Experian
[9] Innovis Security Freeze.
[10] After Equifax Breach, Here's Your Next Worry: Weak PINs, New York Times.
