Last week, Internet criminals broke into the computers of Experian, one of the “big three” credit reporting bureaus. The crooks made off with the account information of 15 million T-Mobile users, including names, addresses, birth dates, ID numbers (driver’s license, military ID and passport numbers) and, most dangerous of all, Social Security numbers.
Response by Experian and T-Mobile was sadly lame and predictable. A press release was issued stating, “There is no evidence at this time that the data has been used inappropriately…” This is akin to a doctor standing in front of a patient with terminal cancer and a 10-pound tumor hanging off their face and saying, “There is no evidence that the patient is dead, yet.”
T-Mobile CEO John Legere said, “I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian,” although nobody, including Experian, has lost their job. All this while accounts stolen in the attack are already showing up for sale on the black market. The potential for identity theft and fraud is massive. Token efforts at compensating T-Mobile victims include the usual free credit monitoring and “identity resolution service.”
As in hacking incidents of the recent past, such as the U.S. Office of Personnel Management (22 million victims) in September, or discount stock brokerage firm Scottrade (4.6 million victims) announced the same day as the Experian/T-Mobile hack, those affected by the financial marketplaces’ apparent inability to protect the valuable private information of their customers leaves those customers once again holding the bag and fending for themselves.
What’s a person supposed to do? As a former T-Mobile user and potential victim of the Experian hack (just as I was in the great Target stores hack of 2013), I decided to dig deeper into this subject than I ever have. Here are some of the ways regular folks can protect themselves against identity theft.
Credit monitoring and identity resolution services. While Consumer Reports rates ID-theft protection services like LifeLock a dubious value at best, if it’s offered for free, you might as well get it. Experian/T-Mobile hack victims can sign up at www.protectmyid.com/SecurityIncident for the credit monitoring, and calling 866-369-0422 for the identity resolution service. Beware of deceptive up-sell attempts after the fact, though; both LifeLock and Experian have been penalized in the past by the Federal Trade Commission for deceptive practices.
Put both a credit freeze and fraud alert on your credit reports. Also known as a security freeze, credit freezes let you restrict access to your credit report, which in turn makes it more difficult for identity thieves to open new accounts in your name. Fraud alerts require creditors to verify your identity in order to access credit information, and can also be useful in stopping the bad guys. Get them both. The FTC has good information at www.consumer.ftc.gov/articles/0497-credit-freeze-faqs about how to do this.
Get copies of, and study, your credit reports. In addition to monitoring your bank statements, credit card bills, phone bills, insurance statements and other bills, go to annualcreditreport.com (never visit FREEcreditreport.com) and get copies of your credit report from all three major credit reporting agencies. You are entitled to free reports, three times a year.
Never use debit cards. No kidding. If you have a debit card, cut it up, send it back to the bank and have it cancelled. If a crook uses your credit card, you can dispute the charge and delay payment. If a crook uses your debit card, the money is immediately removed from your bank account; you may not even know it’s missing until you get your next statement. Even if you contest the charge, the money is still unavailable until the bank decides in your favor, possibly freezing money you need to pay bills, etc.
File an identity fraud affidavit with the Internal Revenue Service. If your Social Security number is compromised and you know or suspect you are a victim of identity theft, you may want to file IRS Form 14039, Identity Theft Affidavit. Visit www.irs.gov/uac/Taxpayer-Guide-to-Identity-Theft to learn more.
Get copies of your information from consumer reporting agencies. In my quest for identity protection, I was shocked to learn the hidden facts about “consumer” reporting agencies. We’ve all heard of the big three “credit” reporting bureaus (Experian, TransUnion and Equifax), but I had never heard of “specialty consumer reporting agencies” until yesterday. Unknown to most consumers, there is another group of shady snoopers gathering information about you known as Consumer Reporting Agencies (CRA). These agencies do the exact same things as the credit reporting bureaus: they gather as much information about you as possible and assemble it in a way that you can either be granted or denied goods and services such as employment, housing, insurance, mortgages, loan accounts, credit cards, medical insurance, bank accounts, etc. CRAs enjoy a cozy relationship with landlords, employers, banks and insurance agencies that falls outside the laws governing credit reporting bureaus. Even so, the law dictates that you are entitled to free copies of your “reports” and to dispute any negative items you may find. Visit the U.S. government’s Consumer Financial Protection Bureau website at www.consumerfinance.gov and search for “consumer reporting” to learn more.