Prudential’s rock crumbles when it comes to securing personal information

Prudential Financial gets a spot on our office’s Identity Defense Wall of Shame this month. They had a temp worker collect personal information from a customer then the temp worker stole the customer’s identity to go on a three month, $70,000 spending spree!

According to the article about this event, Prudential takes customer information and security very seriously. We see that clearly from the end result of this encounter between a Prudential temp employee and a Prudential customer.

Stop and think about what happened here. A financial conglomerate worth $36 billion does not have the sense of how to secure personal information that it receives. Collecting customer information is the most volatile point in a transaction because it is up to the person who collects it as to how the information is treated. This is where Prudential’s security falls apart. The people collecting information should be trusted, longer term, well paid employees, who hopefully, will want to keep their job and have little or at least minimal incentive to steal. Instead they gave that crucial task to a 23 year old temp worker, who obviously did not care about his temp job and felt he needed to supplement his income.

I’m sure they spend millions on data security, and backup systems and passwords and encryption etc. As a financial institution they are required to have secure systems on all fronts. But no matter how big your walls are, or how many lines of defense you have, if you can’t complete step 1 and put the information into secure areas, it is useless. Picture your bank having the tellers leave all the money on the counters at night and still go lock the safe.

If Prudential has procedures in place, the management team is not reading the company manual. To be fair, this could easily happen with just about any employee and it is where a significant portion of all ID theft occurs. But when you assign tasks to someone who is not even an employee, then any incentive to do the right thing is minimized because there is no long term bond.

For the sake of all of their existing customers let’s hope they have a better system in place for securing their personal information.

Identity Thieves are Now Becoming Scapegoats

It is a sign that something is becoming mainstream when identity thieves start taking the blame for committing an offense probably not worth their time or effort.

Recently a woman was sued by and went to trail against the RIAA (Recording Industry Association of America) and lost. The RIAA is the trade group turned watchdog group whose members are recoding artists. They are the group that is fighting illegal P2P (peer 2 peer) downloading among mainly younger computer users.

The judgment came in the form of a fine of over $250,000. She was offered an out of court settlement and turned it down. Most if not all individuals offered this option are accepting it since they are liable for much more that the industry is requesting. They (RIAA) are really getting a pittance compared to the industry losses and the legal costs of suing young individuals is surely more then they are getting in return. But they are setting a great example. Until now.

This woman refused to settle because she is claiming an identity thief stole her web identity to file share on P2P. Is this idea original, probably not. There have likely been many users claiming they didn’t do. They claim it was someone else using their computer, hijacked their account etc. But I believe it is the first time it has been used in court when defending a suit filed by the RIAA. Is this defense possible? Anything is possible, but the court did not buy it and ruled against her.

Is this realistic? With so much to gain financially doing other misdeeds, would identity thieves go to this length to file share a few songs? Put in another light, if you are an identity thief, you obviously have little regard for the law, so worrying about file sharing, not even on the bottom of any list. But because the thieves are becoming so commonplace, the public has now decided that they could be a good scapegoat. And why not, since there are plenty of them lurking in every corner of the planet.

In retrospect, the RIAA should spend some of that recovered money educating parents on how identity thieves really use P2P networks to actually steal identities. Maybe if they got the attention of more adults they would have a much better army of soldiers to combat their problem of lost revenue, while at the same time educating individuals, college students and moms and dads, of the other unseen peril of illegal downloading, identity theft.

Apple Online Lawsuit Brings to Light Another Threat of Identity Theft

A recent lawsuit alleges Apple Store is not in compliance with Fair Credit Reporting Act, thereby making it easier for identity thieves to gather more personal information on consumers.

All businesses need to heed this as an example of things to come and protect their clients' personal information in any way that they can after a class action lawsuit, case number 07-22040, was brought against Apple Store online last week in Florida Federal Court alleging that the stores violated the Fair Credit Reporting Act (FCRA). The FCRA is a federal law designed to help ensure that consumer reporting agencies act fairly, impartially, and with respect for the consumer's right to privacy when preparing consumer reports on individuals.

In 2003, an amendment was added that states, "No person that accepts credit cards or debit cards for the transaction of businesses shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the card holder at the point of sale or transaction."

It was this amendment that Apple Store online was violating. Apple Store was apparently printing credit card expiration dates on the receipts, in addition to the other personal information. Companies were given a three-year grace period to comply with the law and the cost is so miniscule to make the change that most have made the change well in advance of the deadline. Apple Store, as of last week, was still not in compliance.

Identity thieves are getting smarter and smarter. Consumers must stay one step ahead and protect themselves from the financial devastation of identity theft. Consumers expect businesses to uphold the law and do what they can to protect personal information they acquire.

While no proof of a specific identity theft has stemmed from Apple Store's non-compliance, it is a recipe for disaster that reminds consumers to take every precaution when making an online purchase or any purchase with a credit card. The federal government has made efforts to protect citizens from identity theft but consumers must be on the offense and take matters into their own hands.

Place yourself in a situation to protect your personal information from theft and learn to practice fire prevention versus firefighting.

Credit Freeze Not the Only Solution to Identity Theft Prevention

Many people who live in states that allow you to freeze your credit are recognizing the benefits of such actions. But a lot are stopping there and not doing any more feeling they have covered the bases and have done what they can to protect themselves.

Governor Deval Patrick from Massachusetts recently signed into law comprehensive identity theft prevention legislation. This new law will require Massachusetts state residents be notified immediately if their personal information has been lost or stolen via security breaches with businesses and government agencies.

As a part of the legislation, the law also states that consumers have the right to freeze their credit reports to prevent new accounts from being fraudulently opened and also puts into effect strict standards for businesses when disposing of personal information.

The portion of the law that puts into place the standards for disposing of personal information is a step in the right direction to identity theft prevention. But allowing a consumer to freeze their credit report does not prevent the theft.

Personal information can already be in the hands of the wrong people. When personal information, such as social security numbers, drivers' license numbers or bank account information is used for widespread fraud, an emotional and potentially expensive mess is left for the victim to clean up.

Of the millions of victims of identity theft last year, many of them had crimes committed against them that had nothing to do with a credit card or loan. This would not be picked up by on credit report which is the focal point of a credit freeze. The black market is booming for individuals' names and IDs for thieves to sell and the buyers will use them for many different types of identity theft. That could include medical treatments, prescriptions, arrests, and theft of existing or open accounts.

One major solution to the problem is for people to practice self defense when it comes to their personal information. Society has become so accustomed to keeping droves of information available we are leaving it laying around us everywhere. The identity thieves are everywhere picking it up.

When it comes to your identity you need to think in terms of fire prevention and not firefighting.

Burden of Proof with Identity Theft

Victims of identity theft often feel victimized twice when identity theft happens to them.

We are all familiar with our legal system where the burden of proof is up to the prosecution for the people and you are innocent until proven guilty.

But with identity theft you are guilty or liable until you prove your innocence.

It doesn’t really seem to make sense but if you look at the logic, it does make sense. Although it puts the victim in a difficult, tedious, and time consuming position of defending themselves while all the while feeling violated because they are a victim.

Our financial system is set up and regulated by the federal government to provide easy and convenient transactions to keep the economy moving along without interruption. You can thank federal laws that limit your exposure to credit card fraud. They enacted those laws long ago to make people feel comfortable with using credit cards when they were first introduced. If people felt liable they would have been reluctant to use the system. Now our economy is completely tied to credit.

Those laws are visible in other areas as well. Take check cashing scams for example. The thieves take advantage of federal laws that require funds for checks to be made available quickly again, to keep the flow of commerce moving. People get taken due the expediency that banks provide funds for check presented, but then find out weeks later that the check was returned as a fraudulent device. You become ultimately liable for any fraudulent check that you present for funds.

In both cases of checks or credit cards you were given the benefit of the transaction in real time while it may be quite some time before the bank or you determine fraud has occurred. In the case of credit card fraud you need to prove that you did not actually make the fraudulent charges and with a check the bank relies on you to know who you are conducting business with.

The banking system really is set to benefit you, so when something goes awry you need to prove you were not involved. Most people never consider that when they conduct transactions. Who is to say that you where not involved in a fraudulent transaction and were not colluding with the perpetrator from the start.

If you become a victim of identity theft, you are really a victim in the eyes of others only after you prove it, and that will never feel good.

Can Past Lessons Offer Clues to Combating Identity Theft?

In 1994 about 58 percent of the US population was buckling up. By mid 2006 approximately 81% of the US population buckled up. Why the dramatic change? Did everyone suddenly recognize that the seatbelts they had been ignoring for years were suddenly cool? No, the reality came partially with education campaigns and laws enacted by many states in the 80’s that forced or convinced people to buckle up.

Today, the generation who never or barely used seat belts is giving way to a generation who has always used them. Part education, part learned behavior, but regardless the effort has paid off immensely. There are thousands alive today that would not be, if this effort had not been undertaken by numerous agencies, both public and private. Local television news channels tout that drivers of horrific looking accidents survived because they were buckled in. All of this adds to awareness and the effort has made seatbelt use the norm not the exception.

So how well is education and enforcement working? The latest numbers available from the US Department of Transportation shows an increase in drivers, miles driven, and number of registered cars on the road. But the fatalities per number of licensed drivers, per miles driven, and per registered vehicles, have been steadily dropping since 1994. The statistics from the NHTSA from 1986-1999 have clearly demonstrated an absolute link to the reduction in fatalities from seatbelt use.

This proves that the plan of educating and enforcement has worked and continues to work up to this day, but shockingly 19%, or 1 out of 5 still don’t think they need this life saving device. They live in the world of “it will never happen to me”, or “it only happens to other people”. Yet, every 13 minutes there is a vehicle fatality and of those some deaths could be avoided with a seatbelt if the person had only believed or understood.

How this is similar to identity theft is when it comes to our identities many are living in the same world of “it will never happen to me”, or “it only happens to other people”. There are many simple but effective changes people can initiate to stop identity theft from happening but choose not to. There are preventative measures they can put in place to mitigate it, but the majority will sit and wait for something to happen before they react.

As with seat belts, only until people become educated will they take the steps to prevent an event from occurring. Many still refuse to embrace technology to reduce risk, and instead they avoid or ignore it.

Over time, thousands lost lives while sitting on the simplistic technology of an unused seat belt. Will consumers finally step up to the plate and take simple but effective pro-active steps to prevent identity theft, or will they continue to ride around unbuckled and hope an accident never occurs? Every 21 seconds there are 3 new identity theft victims, of which 2 were potentially preventable by the victim.

Abatement of identity theft will start to change significantly once individuals start to take control of their personal behavior and not rely on others or hoping nothing will happen to them. Recognizing the vulnerabilities in personal everyday habits and making changes will reduce your risk significantly.

Many are already recognizing that they need to do something, and the actions of those will undoubtedly start a trend. But for those who are unsure of what to do, and still do nothing, are likely to become tomorrow’s victims.

Hopefully it doesn’t take 15 years for 80% of the population to finally become educated on how to adequately protect their identity.

GAO Reports on Identity Theft, Sort of

Recently the US Government Accountability Office released its findings of a study on the net effect of data breaches, stolen data, and unaccounted for data and how much actual identity theft resulted from such occurrences. They undertook this task to help Congress decide if a federal law should be considered for a national breach notification requirement. Some states already have laws in effect to various degrees requiring notification of data lost so that consumers can take immediate actions to see if they’ve become a victim.

Sounds a bit odd, but breach notification would most likely just give you a heads up a bit sooner if you are a victim. Many times a data breach notification is the first time a victim looks at a bank or credit card statement, balances a checkbook for the first time in ten years, or obtains a credit report.

The GAO was asked to examine three distinct areas

(1) The incidence and circumstances of breaches of sensitive personal information

(2) The extent to which such breaches have resulted in identity theft

(3) The potential benefits, costs, and challenges associated with breach notification requirements.

The GAO used various sources for the research and came up with an earth shattering discovery; data thefts are rampant and occur frequently and are probably underreported due to lack of voluntary or mandatory disclosure.

They also determined they can’t directly link identity theft to many of the data thefts they reviewed because there is not clear and conclusive evidence that directly links those breaches with identity theft. Apparently the identity thieves are not disclosing the abundant sources of their windfall.

There you have it, if it is not conclusive then it must not have occurred, or at least they can’t say it occurred. It does not mean that it didn’t.

They even admitted that the lack of reporting on the part of victims also leads to skewed and invalid data that cannot be used to create a valid statistical picture.

So how do many interpret this : “GAO finds little identity theft results from data breaches”.

Apparently there are a lot of thieves going to a lot of trouble stealing personal data, then changing their minds finding religion and doing nothing with it after all.

But if that is the case, then where did all that personal stolen information come from that results in the billions of dollars in personal losses from the millions of actual victims each year? There was not a place to include them in this report.