(Image used under: Creative Commons 2.0 [SRC])

Of course this isn't a problem limited only to Facebook, but the FBI issued a warning about the rise of hijacking scams. This is where a bad guy gets your login information through various means and then poses as you on your account. They'll send an urgent request for help or money to all your friends who may be fooled and comply (as in the case of Bryan Rutberg).

Remember to use good passwords and protect them especially the password for your e-mail account (which can be used to unlock all your other accounts).

Ben Stein is tired of losing his money so he's going to take yours.

I can't really state this often enough. There's only one place to get free credit reports and that's AnnualCreditReport.com. Everywhere else is going to take your money and give you grief.

Freescore is that company that's been advertising with Ben Stein on TV and they've been at the same dirty tricks as all these bogus free credit score places. However, because of a blogger who posted that they're a "predatory bait-and-switch" and also pointed out that the parent company of Freescore is VERTRUE, INC who has a Better Business Bureau score of F for charging people unexpectedly and then hassling them to get their money back (quoted loosely from here).

Freescore decided to file a libel lawsuit that looks surprisingly bogus to Felix Salmon, a blogger at Reuters. Not only did they never accuse the blogger of posting anything false, but the only part of the post that could be considered libelous was a direct quote from Felix's blog in the first place!

Well, this nonsense is no surprise to anyone that's watched these companies taking people's money and providing nothing in return.

Remember, there is only one place to get free credit reports and that's AnnualCreditReport.com. Anyone else that offers you free credit reports is lying or has a gimmick.

(Image used under: Fair Use doctrine)

I have no idea how I missed this, but it's great news regardless!

If you signed up with Lifelock and are unhappy with their service or guarantee or just want further info on the class action you can contact David Paris at Marks & Klein, (732)-747-7100.

I almost wish I had signed up for Lifelock so I could get involved.

His name is Todd Davis.
His SSN is 457-55-5467.
And he's making millions!

(Image used under: Fair Use doctrine)

Lifelock is that company where the CEO posted his Social Security Number with a challenge to take his identity (which someone promptly did). If you've been considering getting the service, wait. First realize what you're paying for.

If you were to go to their site and read through what they actually do, you'll find that you're not getting much for your money.

NOTE! This is for the original version of Lifelock. Due to legal settlements, they've changed their service somewhat and details are below.

1. They place fraud alerts. The problem is, fraud alerts are practically worthlesss as far as protecting you from ID theft.

2. They renew the fraud alerts every 90 days. Note that this isn't actually a separate benefit, but they sure seemed to want to have six benefits to their service instead of just five.

3. They remove your name from pre-screened credit card offers. You can do it yourself, freely, and quickly at optoutprescreen.com. Also note that this is a one-time benefit and not something that you should be paying monthly for.

4. They order your credit reports once per year which is easy for them because they can use the free annual credit report you are due by law. The bad part here is that if you wanted to use the very clever advice of getting your report from one of the companies every four months so you can keep a semi-constant tab on your credit, you can't. Lifelock blew your free coupons all at once.

5. They'll keep a list of the companies you have credit cards and such with so you can quickly call them if your wallet is stolen. The FDIC has a great guide about how to do this yourself including the advice to carry a bare-minimum of cards and information and to make your own call-down list.

6. Lastly, insurance (which some people claim you can't collect on).

The BEST way to actually prevent ID theft is with a Credit Freeze

Worst of all, the "fraud alert" features (1 and 2) that they provide have been blocked as a result of a recent lawsuit by Experian who claimed that Lifelock was abusing the fraud alert system by placing them for EVERYONE instead of just people who feel in imminent danger of ID theft.

Lawsuit Changes

Because of the lawsuit, they had to pull the fraud alert "feature" from their list of services. Along with some other recent changes I didn't update on, here is the complete list of Lifelock "features" as of Sept '09:

1. LifeLock Identity Alert™ – In theory they somehow monitor whenever a credit application is entered and alert you. Isn't this what credit-monitoring services do?

2. eRecon™ – They claim to monitor known criminal websites for your personal information. If they find it, they alert you and help you remove it.

   My BS-meter is blinking for two reasons. First, what known criminal websites are out there that Lifelock can get to more than anyone else? If they're public websites, a google-alert would work just as well (and it's free). If they're NOT public websites, how did Lifelock get access to them? Do they have criminal connections?

   Second, if they're known criminal websites, why haven't they been taken down? What's lifelock going to do to "resolve the problem" that the police couldn't do?

3. TrueAddress™ – Monitors change of address databases and alerts you if someone tries to change yours. I don't know how well this works or even if it works as described, but if it does, this might be the first real service that Lifelock provides that isn't easy and free to do yourself.

4. WalletLock™ – Already described this

5. Credit card offer opt-out – Already described this

6. Request your annual free credit reports – Already described this

7. 24 Hour Phone Number – As it should be.

8. $1 Million Guarantee – Sort of. Read on…

In a different class action lawsuit, the lawyers argue that despite the "1 million dollar guarantee", it's actually almost impossible to collect. The guarantee only comes into action if you can show a "defect in their service", but…

the only way fraudulent activity could result from a defect on LifeLock's behalf was if the company failed to sign its customer up for a fraud alert or add its name to an opt-list. Even if that happened, Carey said, it would be difficult for a customer to prove it was LifeLock's fault.

Other lawsuits

Lifelock also had multiple lawsuits brought by the FTC for their deceptive advertising and other BS. They first settled for $11 million in 2010, and then $100 million in 2015 for violating the terms of the first settlement. Will they ever straighten out and behave? It's hard to say, but it's also hard to imagine.

If you're tired of the crap and lies and want solid information and risk management information that will tangibly improve your defense against ID Theft, check out my Goodbye Identity Theft online course!

After the Lifelock scam was uncovered, few companies offer "only" ID Theft insurance anymore. Instead, it's a smorgasbord of supposed services and defenses to help you with the ID Theft problem. Here's what you might get for your money:

Insurance

Turns out you can make a lot of money by charging people for insurance . Who knew?

(Image used under: Fair Use doctrine)

Insurance plans are a risk equation that you'll almost always lose (or else the companies wouldn't stay in business). That's not to say that all insurance is a scam, but you need to weigh your actual risk versus the benefits. Do you really know what the conditions are for making a claim? Will you actually be able to collect? How much? Under what circumstances? According to a Forbes.com article:

The balance of the usual $5,000 to $15,000 coverage is available for legal fees to undo judgments and criminal records racked up by thieves in your name. But Federal Trade Commission statistics show that just 16% of ID theft victims suffer such problems, and only 40% report out-of-pocket costs greater than $1,000.

Even assuming your risk was as high as the fear-mongering suggests, you need to read and understand the terms of the plan before you have any assurance you're getting what you paid for. Tthe original version of LieLock's insurance plan which offered a "1 Million Dollar guarantee" (OMG!) was impossible to collect on based on their stated terms, but that didn't stop millions of people from signing up.

Dark or Deep Web Scanning

What up my fellow theives! You don't happen to be talking about any of my customers do you?

(Image used under: Fair Use doctrine)

These terms refer to the parts of the Internet that aren't reachable by search engines. Private chat channels, forums and boards that are hidden from view, and so on. It's a real thing, but not nearly as nefarious as these companies make them out to be. Sure, there's a lot of illegal and nasty stuff out there, but if was that easy to find and "monitor", why wouldn't the authorities be doing something about it?

Granted, I've not worked for these companies and don't have first-hand knowledge of what they do and don't do, but their claims sound as ludicrous as if they had said "we have undercover people in crime rings who'll make sure that they pass over your address when choosing which houses to rob. Best of all, the only way for them to monitor your information, accounts, etc. is to have all the information and access themselves putting you at even more risk of breaches or unscrupulous employees.

Other Fluff and Nonsense

I tested one such company out and it was really uncomfortable to give them access to my social and other sensitive information, but you can bet I wasn't giving them my banking login details no matter what "protection" services they were supposedly adding.

And did you know that Lifelock is still listing "Lost Wallet Protection" as one of their "services"? I looked around their site and even their terms and conditions and couldn't find specifics, but if it's like what they used to offer, they would keep a list of company phone numbers for the various cards you keep in your wallet to make it easier for you to make all the calls and do all the real work if you lost your wallet.

Likewise, all these supposed benefits are loosely defined on average. Using psychologically proven words that give feelings of comfort like "guaranteed", "covered", "protected", "help", and so on, but very little information about what they actually DO, what they don't do, and how it all works. Almost as if it was more about making you feel good than actually helping.

Exercise

Exercise by Nick Youngson - Alpha Stock Images

(Image used under: Creative Commons 3.0 [SRC])

If you have been doing these lessons in order, this will look familiar from the ID Theft Monitoring lesson, but let's do it again. To really evaluate what you're paying versus what you get:

1. Log into your service and take a look around. Make some notes about what they're actually providing to you.
2. Rate each from 1 to 10 on two factors: 1) how well do you understand the feature, and 2) how valuable/important is it to you.
3. In particular pay attention to terms surrounding any insurance plan. You really should make the effort to read their actual terms and exclusions. There's no shame if you lack the interest/motivation/skill/energy to do it… they're counting on it. Just keep in mind that it's insurance is devilishly hard to collect on and unless you know the terms as well or better than they do, your chances of collecting are probably depressingly low.
4. Look through your email for messages from your monitoring service. Write down the number of emails received and, out of those, how many had important and worthwhile information.

Just like with Monitoring, hold on to your notes. Don't make any decisions on your paid services until we get to the Credit Report Freeze section!

Free credit reports? No. It's actually a monitoring service in disguise.

Unlike fraud alerts which are a complete waste of time, credit monitoring promises to alert you when there's activity on your credit file and that's exactly what they do. But what are you actually getting for the money?

• Activity alerts are trivially cheap to send – Every day I get regular activity alerts from email, banking, and social sites; often so many that I have to change my preferences to shut them up. Besides, Experian alone made about ~900 million in 2018 from their data brokering business using your data, my data, and that of hundreds of millions of others. I think they can afford it.
• Credit report activity is (relatively) rare – Unlike Facebook posts that can come 30 or more a day, credit activity happens only when I (or a thief) is doing something. In theory, your bank or landlord or other creditor could check now and then, but when researching people's experiences with monitoring online, every example people listed was of receiving alerts for their own activity only.
• And, most importantly, it doesn't do anything.

ALERT! Your care has overheated.

(Image is in the Public Domain)

Early detection systems like those in a home security system, email and device access alerts, and so on can help to show you someone is targeting you and you should take precautions. Monitoring is like that, but where the thief always has your key or password and is inside before you receive the alert. Credit activity is nearly always as a result of an approved credit transaction, not a test one, and (because fraud alerts don't work) not a blocked one.

I'm not saying monitoring your credit is pointless, but is it worth hundreds a year when you can do decent job on your own anyway? Per the FTC recommendation:

Monitor your credit reports for free. Federal law requires each of the three major credit bureaus to give you a free credit report — at your request — each year. Visit "AnnualCreditReport.com" — the only authorized website for free credit reports. If you want to monitor your reports over time, you can spread out your requests, getting one free report every four months.

Before you pay…

The type and variety of monitoring services out there is innemerable and they have varying extras like monitoring all three CRCs and addons and gimmicks etc which you will have to evaluate on your own to determine that it's worth it, but there are two reasons I don't bother:

First, the CRCs caused the ID Theft crisis and should take responsibility. Even if alerting you wasn't trivially cheap to do, the loose controls on credit information of the CRCs have made the credit-base ID Theft problem accelerate even after decades of ever-increasing regulation. It's their fault and I'll be gobsmacked if I'm going to entertain their racketeering scheme to pay them for protection.

Second, and more importantly, there's a better way and it costs nothing: credit freezes.

Spoiler alert: Credit freezes are the best defense you have, but we'll get to that in a later lesson.

Exercise

Exercise by Nick Youngson - Alpha Stock Images

(Image used under: Creative Commons 3.0 [SRC])

Do you really know what you're paying for with monitoring? If you have a monitoring service:

1. Log into your service and take a look around. Make some notes about what they're actually providing to you.
2. Rate each from 1 to 10 on two factors: 1) how well do you understand the feature, and 2) how valuable/important is it to you.
3. Take a moment to see if you have access to that same information elsewhere. For example, some banks and credit unions offer free credit scores as part of their service.
4. Look through your email for messages from your monitoring service. Write down the number of emails received and, out of those, how many had important and worthwhile information.

Don't do anything yet, but keep these notes handy for the end of this lesson after I've shown you some alternatives.

Let's just get your SSN, a few fingernail cuttings, an elbow-print, a sample of saliva, and fill out this form of all your deepest fears and personal secrets!

(Image is in the Public Domain)

Defending your information doesn't stop when you walk out the front door. How many times when you're at the store, at the doctor's office, or otherwise out and about does someone ask for your private information? Do you provide it? Should you? How can you know?

The defense is simply this: ask. Why do they want to know? What will they do with it? How do they protect it? Ask and depending on the answer, decide what to do. For example:

• When I went to a new dentist, they asked for my social security number. When I asked, they claimed they needed it for insurance purposes, but a quick call to the insurance company confirmed that wasn't the case and I refused. They were able to put a random number instead and everything worked fine: I got service and they got paid.

I was once asked for my SSN at a video-rental store! Obviously they didn't need it for anything, but it made me wonder how many people provided it just because they were asked.


Most stores will take the Jenny number for discounts and such
(See online!)
• Lots of stores have "club cards" or some kind of membership where you theoretically get discounts or they can pull up your purchase history for returns or some such nonsense. Depending on the specifics, I might sign up (leaving everything I can blank — which is usually a lot if not most of it), but sometimes I'll just give them a common phone number that someone else has already set up. Specifically your area code plus one of the following almost always works: 555-1212 (the number to general information) or 867-5309 (the Jenny number).
• Electronic signatures are everywhere, but are you really comfortable giving companies yet another important piece of data to lose? The system isn't going to check what you put in (even if you draw funny or inappropriate pics instead) so it's up to you what to do in this case. If I were of a privacy mind, I might draw the first letter of my signature for myself (so I could tell later it was me who signed it) and then scribble the rest randomly.

Fun fact: I quite literally stopped the nurses at the birthing ward to ask them why they wanted a SSN on the admission paperwork while my wife was in active labor in the wheelchair behind me. Due to the impending baby, we agreed to handle the paperwork later (spoiler alert: they didn't need it either).

Summary

By being stingy with my data, I have avoided letting people put my information into yet another computer system and be at risk from abuse and hacking. It's not a 100% solution of course, but it costs me little other than some time and confused looks from employees who've never been challenged before. For my effort, my data is harder to find, harder to lose, and harder to exploit.

Exercise

Exercise by Nick Youngson - Alpha Stock Images

(Image used under: Creative Commons 3.0 [SRC])

This section doesn't lend itself well to exercises. Just be careful out there ok?

What you can do is check out the resources page (next in the guide) and make sure to click any remaining orange-colored dots next to the lessons in the guide. This will mark them complete and once all are so-marked, you will receive a course-completion badge in your profile. Congrats for making it through 🙂

(Image is in the Public Domain)

Scenario: A drug dealer gets a cellphone to make drug deals. They sign a lease in your name, hook up electricity, and then go shopping for supplies all in your name. What do all of these have in common? Each of these requires a credit check.

A credit check for the phone, a credit check for the lease, another for the utilities, and the last for the store's credit account. The real problem with identity theft isn't the thieves (who have always been there), it's the system that makes it so easy for them to get goods and services while leaving you with the bill.

It's not thieves or breaches or some mysterious unsolvable problem; CRCs directly caused the ID Theft epidemic by positioning themselves as the gateway to all credit decisions and then freely handing out your information with insufficient controls.

The Solution

I already explained the various types of non-credit ID Theft, but the vast majority of instances do involve a credit check which simplifies the problem: block the check, block the theft. I won't bore you with the long and bitter war with the CRCs with us trying to get freezes available and them trying to block laws and discourage people from using them. Bottom line, since 2018, freezes are free in all US states.

Here's why you should care:

What if someone was actually protecting your credit report from unauthorized access? Better yet, what if that person could be YOU? Freezes make it happen

(Image is in the Public Domain)

Freezing Your Credit Reports

1. Go to the three CRC's freeze pages online (they keep changing the URLs so check the FTC's page for an up-to-date list or register a complaint while you're there if they changed them again).
2. Enter your data, but NOT your credit card or other payment information.
3. Watch out for upsells and addons as they trying to use the freeze system to milk you for monitoring or other "services".
4. Make sure you have a freeze PIN or they notify you it's coming in the mail (but make sure you actually GET it).

Boom, you win.

What's the big deal? It used to be I only needed a little bit of your information to pretend to be you and get credit, but with a Freeze PIN in place, now there's an extra piece of required data… something only YOU and the CRC have. If you're doing it right, you'll store the PIN securely and NEVER allow any store or creditor to "thaw your credit for you if you just give them the PIN". Instead, do the following:

Thawing Your Report

Time Based

1. Contact the CRC by phone or through their website.
2. Provide the freeze PIN along with a date range

Once complete, access to your credit report is open for the time period you specified. Granted, this means you're totally exposed during that time, but it's still a small window of time for thieves and is the most effective way to handle several different companies need access to your credit report at once (like if you're going loan shopping or moving into a new place and need to let several people check your credit in sequence).

Company Based

1. Contact the CRC by phone or through their website.
2. Provide the freeze PIN along with the name of a company.
3. Note the temporary PIN they provide you.
4. Give the temporary PIN to the company that you're applying for credit with.

When you apply for something that requires a credit check, ask them which CRC they use so you can thaw the right one. There's no sense taking the time and trouble to thaw more than you need to.

Drawbacks

Freezes DO NOT affect existing credit accounts or credit cards. Only new applications for credit that require a CRC check.

There is only one drawback that I know of: having a credit freeze will naturally introduce a delay when getting credit. If you are the type to apply for instant-credit deals, you might find this to be cumbersome. Similarly, if you have a pressing need to get credit (car broke down or something) delays can be a problem. The CRCs are supposed to unfreeze your credit within an hour of making the request online, but I've had some trouble getting them to approve the thaw this way due to (in my opinion) shenanigans (thanks Equifax… you scumbags).

The CRCs are supposed to make thaws easy. If you think they're making it harder than it should be (purposefully or incompetently), file a complaint at the Consumer Financial Protection Bureau.

Pros

• You get to control who sees your credit report. Outside of a small set of exceptions credit report access will be blocked until and unless you proactively unlock it first.
• In some (all?) cases, attempts to access your frozen credit will generate email or mail alerts. So much for paying for monitoring.
• Having a little cool-down time to rethink getting into more debt isn't such a bad thing.
• They do not affect any existing credit accounts or credit cards in any way (only NEW credit applications that require a credit check). In fact, there are robust protection laws to keep you safe when using credit cards. This is unrelated to freezes, but still cool so check it out!

Still, this is balanced by the incredible protection of actually having control over who sees your credit.having a little time to actually think before adding to your debt really can't be such a bad thing.

Exercise

Exercise by Nick Youngson - Alpha Stock Images

(Image used under: Creative Commons 3.0 [SRC])

Ready to get your money's worth?

Freeze your credit reports!

Do it. Do it now. It's free as of 2018 and it actually helps to prevent ID theft. (this link goes to the FTC article on freezes and links to each of the three websites and gives phone numbers in case the websites aren't working for some reason).

Each company will try to steer you into some kind of monitoring, credit score, or service plan that will allow them to keep making money on you. Make sure you don't fall for it. You should be able to get through the whole process without pulling out your credit card. If not, you probably took a wrong turn somewhere, so go back and try again.

Now, if you are currently paying for some kind of monitoring or protection service, take your notes from the exercises in the previous lessons and go down the list of "features" for your service. As yourself whether the "feature" still makes sense now that you have freeze in place. Let me help you get started:

• How many people do you know who were victims of ID Theft? How many of those were NON-credit ID theft?
• If your experience matches mine and you've rarely heard of anyone who suffered ID theft that didn't require a credit report, ask yourself: what are my odds of ID theft really now that my credit reports are properly locked?
• If your risk has been significantly reduced, does paying $10, $20, or more a month for insurance or monitoring still make sense?

And so on… Bottom line, you have to make your own decisions and determine if you're happy with what you pay for what you get. But even if you decide to keep paying, the freeze made you more secure today than you were yesterday so your final exercise for this section:

Send this link to at least one other person, but preferably everyone you know: https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs#place. Tell them that it's a free and legally-mandated right to protect your credit reports the way we should have been able to from the beginning.

The Bad News

Bottom line, ID Theft is a low risk crime with only two steps:

1. Get someone's data
2. Use the data

Now I have goods, services, and special accesses, but you get all the consequences. Worst of all, government entities responsible for protecting you don't and companies make more money on ID Theft than they lose. There's no one looking out for you; you're on your own.

The Good News

Until now, you've been given incomplete or bad advice for how to respond to ID Theft risks, but that changes today. I will give you the bottom-line basics you need to make informed decisions; i.e., which defenses actually work and which are just snake oil pitched by ID Theft profiteers.

Let's get started!

Learning styles vary greatly so the material is available in two formats: video and text. The videos are intended as a high-level overview for covering ground quickly while the text version will have numerous inline references to sources and examples to give you a deeper understanding the the material. Use either or both to learn the material in the way that works for you!

This is a free online course. To get started, ID Theft - The Straight Basics

(Image is in the Public Domain)

The Hacker's Choice, a non-commercial group of computer security experts, has released a video showing a cloned passport being approved by a security scanner at a Dutch airport. When the reader scans the passport it is revealed to belong to one Elvis Aaron Presley, complete with picture.

RFID is not ready. Every country that has tried to use it for identification has failed and miserable.