Re: very boring day on GS...lets play a game
I received my letter a few weeks ago. The University of California at Berkeley, where I attended journalism school as a graduate student, wrote to tell me that a computer containing my social security number was stolen in March.
Six million other people in the United States have received similar letters in less than four months, and the number is growing, according to the Privacy Rights Clearinghouse, which advocates on behalf of consumers.
In one of the latest breaches to come to light, Citigroup's consumer finance division last week said social security numbers, addresses and credit histories of 3.9 million customers were lost. United Parcel Service in May picked up a box of tapes containing the information so it could deliver them to credit-reporting bureau Experian.
Bank of America, Wachovia, Time Warner, Boston College, and data brokers Choicepoint and LexisNexis also have compromised their customer's identity recently by losing sensitive data.
UC Berkeley administrators, explaining they "take very seriously our obligation to safeguard personal information entrusted to us," suggested I take a few steps to prevent me from becoming a fraud victim.
First, they said I should put a fraud alert on records maintained by the three main credit bureaus, TransUnion, Experian and Equifax. Next, they recommended I order free copies of my credit reports and review them for accounts opened in my name without my permission. Finally, they said I should call the credit services if there are any entries that I don't understand.
The credit services should be commended for making it easy to flag my account. I called a single toll-free number and was able to put a 90-day fraud alert on my records. That requires creditors wanting to open an account in my name to verify that the request really is coming from me and not from someone who has illegally obtained my personal information. Within a few days I received letters from all three companies saying I succeeded in getting fraud alerts placed on my records.
That's a nice safety net, but there's a gaping hole: the fraud alert stays in place for only 90 days -- as if a thief rummaging through millions of social security numbers will strike within three months or toss the information. The 90-day alert also stops short of requiring creditors to actually contact the consumer when an application for a loan or credit card is received, said Gail Hillebrand, a senior attorney at Consumers Union.
Instead, the Fair Credit Reporting Act, which spells out the steps credit reporting services must follow when information is lost, merely requires companies to use "reasonable procedures" to verify an applicant's identity, she said.
Fortunately, there are other remedies. Consumers whose information has been lost or stolen have the option of putting an alert on their reports for seven years. Not only is the added time nice, but creditors are required to contact the person before issuing a loan or credit card. To apply, consumers have to file an identity theft report with a local, state or federal law enforcement agency and send a copy to one of the credit reporting companies.
The law doesn't say whether the mere loss or theft of my information constitutes an identity theft, but Equifax and TransUnion both say it's sufficient basis to get the extended fraud alert. Representatives from Experian didn't return two phone calls asking them to flesh out their policy.
The Federal Trade Commission makes an affidavit available online (.pdf) that meets the qualification for a theft report.
There may be other remedies, as well. Six states -- California, Texas, Louisiana, Vermont, Washington and Colorado -- either currently have laws or soon will have legislation in place granting the right to put freezes on credit reports.
All this is nice. But putting alerts on records after data has been lost or stolen is a little like pumping the water out of a basement after it has flooded. It's necessary to contain the damage, but it doesn't prevent deluges the next time around.
We need strict policies governing how banks, creditors and other groups store and transport information about individuals. It's unthinkable that the vast databases maintained by Citigroup, Bank of America and the rest of the bunch weren't encrypted so all an identity thief would see when accessing the files would be gobblygook.
If these groups don't voluntarily implement stringent protections, Congress is likely to do it for them. The U.S. Senate is scheduled to hold a hearing this week on the topic of identity theft, and all five members of the Federal Trade Commission are on the list of witnesses expected to testify. Legislative wheels could start turning soon.
With or without government intervention, companies that fail to take effective action will surely suffer for it. Already, I'm thinking twice about donating money to UC Berkeley or continuing my relationship with Bank of America. Better to keep my information out of their hands altogether than risk them losing it.
where are we going?