Identity Theft Not As Bad As You Think

1
Identity TheftNot As Bad As You Think

• Ron Gore

2
Major Topics

• Credit Reporting and Identity Theft Laws
• Texas
• Federal
• What to do if you are an identity theft victim
• How to prevent identity theft
• Identity theft services

3
Identity Theft and Credit Reporting LawTexas
Statutes

• Credit file security freeze
• ID theft prohibition
• Security breach warning
• Court order declaring a victim of ID theft

4
Security FreezeCredit File Security Freeze

• A consumer may request a CRA to prevent access to
  credit file by credit grantors
• Must include proper ID and a valid police report

5
Security FreezeCRA Responsibilities

• The CRA must tell you how to
• Place a freeze,
• Remove a freeze,
• temporarily lift a freeze
• allow access for a specific requester or period
• The CRA must send written confirmation and a PIN
  within 10 business days of the request
• The CRA may charge an 8 fee, with a yearly CPI
  adjustment (covers all functions of the freeze)

6
Security FreezeCRA Responsibilities

• Users trying to access your report receive a
  notice of security freeze
• CRAs must notify consumers in writing within 30
  days of any material change to the
• name
• date of birth
• social security number or
• address

7
Security FreezeRemoval and Lifting

• CRAs have 3 business days to remove the freeze
  after a request with proper ID and PIN
• Upon request, CRAs must temporarily lift the
  freeze for
• a designated period, or
• a designated user

8
Security FreezeFreeze ExceptionsGovernment Uses

• a state or local governmental entity
• a child support agency
• the Texas Health and Human Services Commission
• the Texas comptroller investigating delinquent
  sales or franchise taxes
• a tax assessor-collector collecting delinquent ad
  valorem taxes

9
Security FreezeFreeze ExceptionsUser Purposes

• prescreening purposes
• account review
• a check service or fraud prevention service
• a deposit account information service
• a CRA that only resells information

10
Security FreezeFreeze ExceptionsConsumer Uses

• the administrator of a credit file monitoring
  subscription
• a user to provide the report to the consumer at
  the consumers request

11
Texas Law ProhibitionIdentity Theft Prohibition

• Illegal to
• obtain, possess, transfer, or use
• personal identifying information of another
• without consent
• and with the intent to obtain a good, service,
  or anything of value

12
Security BreachesSecurity Breach Notice

• Businesses that own or license data with
  sensitive personal information
• must disclose any breach of system security
• to any Texas resident whose information was or
  is reasonably believed to have been
• acquired by an unauthorized person

13
Court OrderIdentity Theft Victim Order

• The court must enter the order, including
• any known information about the violator
• the specific identifying information and any
  related document used to commit the theft
• identification of financial accounts affected by
  the violation, including
• the name of the financial institution
• any relevant account numbers
• the dollar amount of the account
• the date of the violation

14
Court OrderReleasing the Order

• The order is sealed, but may be released for a
  civil case brought by or against the victim
• The order may be released to the victim to
• prove that a transaction resulted from ID theft
• to correct any record that contains false
  information as a result of the theft

15
Federal LawCRA Access Compliance

• CRAs must maintain reasonable policies to limit
  access to consumer reports to permissible
  purposes
• CRAs must require prospective users to
• identify themselves
• certify the purposes for which they want reports
• certify that the reports will be used for no
  other purpose

16
Federal LawChoicePoint

• The ChoicePoint breach involved 163,000
  consumers records
• ChoicePoint agreed to pay a 10 million civil
  penalty and 5 million in consumer redress
• At least 800 cases of ID theft resulted from the
  breach
• ChoicePoint provided consumer reports to users
  who posed as legitimate businesses

17
Federal LawCredit File Alerts

• Several credit file alerts were required by FACTA
  in an attempt to prevent ID theft
• Initial alerts
• Extended alerts
• Military duty alerts

18
Federal LawFraud AlertsInitial Fraud Alerts

• Initial fraud alert is placed the consumers file
  and provided with all credit reports for 90 days
• You must have in good faith a suspicion of
  identity theft

19
Federal LawFraud AlertsExtended Fraud Alerts

• If you submit appropriate ID and an ID theft
  report the CRA must
• include a fraud alert in your credit file for
  seven years from date of the request
• exclude you from prescreening lists provided for
  firm offers of credit for five years

20
Federal LawFraud AlertsActive Duty Alert

• Similar to the other alerts, it warns that
  consumer is on active duty
• included in the credit file for 1 year
• Excludes consumer from prescreening for 2 years

21
Federal LawFraud AlertsAlert Referral
Responsibilities

• Nationwide CRAs must refer all alerts to other
  nationwide CRAs
• Receiving CRA must follow the same procedures as
  the original CRA

22
Federal LawFraud AlertsNo Credit without
Contacting Consumer

• Initial and active duty alerts must notify users
  that the consumer does not authorize
• new credit or extension of credit, other than a
  credit card charge
• issuing an additional card on an existing account
  or
• any increase in credit limit on an existing
  account

23
Federal LawFraud AlertsReasonable Steps to
Verify Consumers ID

• If the consumer requesting the alert specifies a
  telephone number to be used for ID verification,
  the user shall, before granting credit
• contact the consumer at that telephone number or
• take reasonable steps to verify the consumers ID
  and confirm that the application is not the
  result of ID theft

24
Federal LawFraud AlertsInitial vs. extended
alert

• Extended alerts shall include
• the same information as initial or military
  alerts plus
• the consumers telephone number or other
  reasonable contact method
• Extended alerts 7 years initial alerts 90 days
• You must include an ID theft police report for an
  extended alert

25
Federal LawBlocking Fraudulent InformationBlock
of ID Theft Accounts

• Under FACTA, ID theft victims now have a separate
  process for resolving disputesblocking ID
  theft-related accounts
• circumvents the traditional dispute/response
  process
• essentially reverses the credit bureaus normal
  presumption that the creditor is correct
• a much quicker and certain solution for clearing
  information resulting from ID theft

26
Federal LawBlocking Fraudulent Information
Block Requirements

• A CRA must block information that the consumer
  identifies as resulting from ID theft not later
  than 4 days after the CRA receives
• appropriate proof of consumers ID
• a copy of an ID theft report
• identification of the information to be blocked
  and
• the consumers statement that the information
  does not relate to a transaction by the consumer

27
Federal LawBlocking Fraudulent Information
Notice of Block to Furnisher

• Upon blocking information due to a consumer
  request, the CRA must notify the furnisher
• that information may be due to ID theft
• that an ID theft report has been filed
• that the consumer has requested a block
• of the dates of the block

28
Federal LawFurnisher duties on notice of ID theft

• Furnishers must have reasonable procedures to
  prevent refurnishing information
• If the consumer provide an ID theft report to a
  furnisher stating that information resulted from
  ID theft, the furnisher may not send it to any
  CRA unless
• the furnisher subsequently knows or is informed
  by the consumer that the information is correct

29
Federal Law Furnisher duties on notice of ID
theft

• A furnisher who receives a notice of block may
  not sell, transfer, or place the account for
  collection
• The prohibition also applies to any collector
  attempting to collect the debt

30
Federal LawDealing with collectors

• A debt collector who is notified that a debt may
  be the result of ID theft must notify the
  creditor that referred the debt
• If the ID theft victim requests, the debt
  collector must provide the consumer with all
  information that the consumer would be entitled
  if the consumer simply wished to dispute the debt
  with the debt collector

31
Federal LawBlocking Fraudulent Information
Declining or Rescinding a Block

• A CRA may decline a block, if it reasonably
  determines that
• the block or request was in error
• the block or request was based on the consumers
  material misrepresentation of fact, or
• the consumer obtained goods, services, or money
  as a result of the transaction

32
Federal LawBlocking Fraudulent Information
Nationwide CRA Referrals

• Nationwide CRAs must refer to other nationwide
  CRAs all consumer complaints alleging ID theft,
  all requests for fraud alerts and all blocks

33
Federal LawRecent Guidelines Issued

• The FTC has recently announced, to become
  effective November 1, 2008
• Regulations for credit card issuers receiving a
  request for an additional card within 30 days
  after receiving a notice of change of address
• Regulations governing notices of address
  discrepancy
• Red flag guidelines and regulations for lenders
  regarding ID theft

34
Federal LawAddress Change Requests

• If the card issuer issues a new, additional or
  replacement credit card within 30 days of
  receiving a notice of change of address, it must
• notify the cardholder at his former address,
• notifying the cardholder of the request by other
  means previously agreed or
• use other means to assess the validity of the
  address change request

35
Federal Law--CRA ResponsibilitiesNotice of
address discrepancy

• If the request for a consumer report includes a
  consumer address that is different from the
  address in the consumers credit file, and the
  CRA returns a file to the user, the CRA must
  notify the user of the discrepancy
• Recent regulations require users to develop
  reasonable policies for responding to address
  discrepancy flags

36
Identity Theft and Credit Reporting LawRed Flag
Guidelines

• Require creditors who maintain accounts subject
  to the risk of identity theft to have an Identity
  Theft Prevention Program that will
• detect
• prevent, and
• mitigate identity theft

37
If you are an ID theft victimTop ten steps to
take

• Request an initial fraud alert
• Obtain and review your credit report
• File a police report
• Request an extended fraud alert
• Request a security freeze
• Close any of your own affected accounts
• Notify the CRAs of inaccuracies
• Notify creditors who opened fraudulent accounts
• Monitor your credit file regularly
• Consider obtaining an ID theft victim order

38
If you are an ID theft victimRequest an initial
fraud alert

• Request an initial fraud alert on the web or by
  phone from one of the nationwide CRAs
• Include a phone number for future creditors to
  call you before opening accounts
• Alert will remain on file for 90 days
• Will be referred to other nationwide CRAs

39
If you are an ID theft victimObtain Your Credit
Report for Free

• You were denied credit
• You are unemployed and intend to apply for
  employment within 60 days
• You are a recipient of public welfare assistance
• You have reason to believe that your credit
  report is inaccurate due to fraud
• You request a fraud alert
• You dispute information on your credit report and
  it is changed as a result
• Free FACTA credit disclosure

40
If you are an ID theft victimFACTA Free Annual
Credit Report

• https//www.annualcreditreport.com/cra/index.jsp
• annualcreditreport.com will do
• Other sites offering free credit reports almost
  always require another purchase
• You may obtain one every 12 months (not calendar
  year) from each of the 3 nationwide bureaus
  under this site
• You need not get all 3 at the same time

41
If you are an ID theft victimCheck your credit
report

• Identifying information
• Public records
• Accounts
• Inquiries

42
If you are an ID theft victimFile a police report

• Local police is best
• Go to the FTC website and file an on-line ID
  theft report
• Put all unknown accounts and inquiries from
  credit report on police report
• Amend the police report if new instances of fraud
  occur
• Get a copy of police report when filed and when
  amended

43
If you are an ID theft victimRequest an extended
fraud alert

• In a written request, include a copy of police
  report and ID required by the CRA
• Include a phone number for future creditors to
  call you before opening accounts
• Alert will remain on file for 7 years
• Exclusion from prescreening
• Will be referred to other nationwide CRAs

44
If you are an ID theft victimRequest a security
freeze

• Remember to send valid Identification and a copy
  of your police report
• Receive a PIN and use it to unlock and refreeze
• CRA should notify of any change to ID information
• Remember exceptions to the freeze

45
If you are an ID theft victimClose any of your
affected accounts

• Notify your current creditors of any accounts
  affected by identity theft
• Have your creditors close the affected accounts
• Include a copy of the police report

46
If you are an ID theft victimNotify the CRA of
inaccuracies

• Send the CRA a copy of your police report along
  with a copy of your credit file with fraudulent
  accounts identified
• Remember that this should circumvent the standard
  dispute process where CRA verifies accounts
  with the creditor reporting them
• Be patientyou may need to do this a second or
  third time
• Send to attention of president or general counsel

47
If you are an ID theft victimNotify creditors of
fraudulent accounts

• Send creditors who have opened fraudulent
  accounts a copy of your police reports and state
  that you did not open the account
• Request them to alter their records and to remove
  reports from credit bureaus
• Call to follow up a few days after sending notice

48
If you are an ID theft victimContinue to monitor
your credit file

• New fraudulent accounts may appear
• Watch for public records and new inquiries
• Check before applying for credit

49
If you are an ID theft victimConsider an ID
theft victim order

• Consider obtaining an order that you are the
  victim of identity theft if your situation
  involves
• Multiple fraudulent accounts
• Collection lawsuits against you
• Multiple victim episodes

50
To prevent ID theftMonitor your credit report
regularly

• Protect your personal information
• Stagger requests for free FACTA disclosure
• If any report looks suspicious, use free requests
  to get other bureaus reports
• Place an initial fraud alert if anything unusual
  or suspicious shows up
• Continue to dispute inaccurate information with
  CRAs

51
Identity theft servicesShould you use an ID
theft service?

• LifeLock
• Creditor services
• Credit Bureau services

52
Identity Theft ServicesLifeLock

• Cost 10 per month or 110 per year
• Place an initial fraud alert in your credit files
  every 90 days
• Have a copy of your credit file sent to you
• Cut off junk mail
• Block pre-approved credit offers (prescreening)
• Receive credit report every 12 months
• Support if wallet lost or stolen

53
Federal LawFraud AlertsInitial Fraud Alerts

• Initial fraud alert is placed the consumers file
  and provided with all credit reports for 90 days
• You must have in good faith a suspicion of
  identity theft

54
Identity Theft ServicesLifeLocks Guarantee

• 1 million service guarantee
• to cure the failure or defect in our service
• we will pay professionals to assist in restoring
  any such loss or recover such expenses, as
  required
• Did LifeLocks guarantee help its owner when he
  was an identity theft victim?

55
Identity theft servicesShould you protect your
children?

• Check credit reports every 6 months 
• If one exists, we place fraud alerts on credit
  reports, stating that this is a minor child
• Check for work history and any misuse of the
  Social Security number
• Repeat this process regularly
• Starting out is hard enough. Starting out with a
  stolen Identity makes it ten times harder. We
  think that's worth 25 a year. Do you?

56
Identity theft servicesHow to protect children

• Before applying for credit, have child check
  credit report
• If there is inaccurate information, tell the
  bureaus to correct it
• If unknown accounts are listed, file a police
  report and follow steps for If you are an ID
  theft victim

57
Identity Theft ServicesOther ID theft services

• Creditor services
• Usually offered as an insert in bills, etc.
• Usually a variation of CRA services
• CRA services
• Credit report disclosure deals
• Change monitoring
• Security freeze

58
Identity theft closingShall I sue?

• Litigation is a machine which you go into as a
  pig and come out as a sausage.-- Ambrose Bierce

59

• The End