Slashdot Mirror
Big Data Breaches Give Credit Monitoring Services a Boost
Hugh Pickens DOT Com (2995471) writes "As attacks like the one on Target have exposed up to 40 million customer payment card accounts and the names, addresses and email addresses of as many as 70 million shoppers, Tiffany Hsu and E. Scott Reckard report in the LA Times that increased activity by data hackers has produced millions of victims but there has been one big winner: credit monitoring businesses. "It's almost a terrible thing to say, but these kinds of situations raise awareness of the need to protect yourself and to be more vigilant in checking your transactions," says Yaron Samid. Meanwhile services with names such as BillGuard and Identity Guard report a surge in sign-ups from people anxious to be protected. For example, the number of AAA Southern California members opting in for the club's identity theft monitoring service — whether for free or for an extra charge — boomed in January, up 58% from December." (More below.)
"I have to believe part of it was these different data breaches that have been occurring, people being concerned about that," says Jeffrey Spring. The BillGuard credit monitoring application, launched in July, uses crowd-sourced reporting from its members to issue alerts about possible payment card security concerns. Since the Target breach, the app's user base has ballooned by nearly half a million participants and identified $1 million in fraud. "We have built a crowd-source system of identifying fraud on debit or credit cards," says Samid. "The system will ask others if this charge is OK or not OK, and if system see a few people saying this is not an unauthorized charge, we alert others that it is potentially fraudulent. The more people that join the network, the more effective it gets." Card issuers and transaction processors have spent hundreds of millions of dollars dealing with electronic fraud in the last three years says Michael Moebs and consumers can soon expect increased annual fees to recoup the costs. "The view is data breaches and hacking have become a way of life, and the industry must get used to it.""
Got to love consumers having to pay for the weakness of credit bureau's security and the need for a social security number and easily searchable public data "being secret".
Are Credit Monitoring Services Worth It?
In the wake of one data breach after another, millions of Americans each year are offered credit monitoring services that promise to shield them from identity thieves. Although these services can help true victims step out from beneath the shadow of ID theft, the sad truth is that most services offer little in the way of real preventative protection against the fastest-growing crime in America.
[...read the rest on the blog...]
What other industry has done so much damage to the economy? Whether it's parasitic fees for retailers, the ready availability of debt to anyone who can produce a social security number (a number that is not supposed to be used as a form of ID), likely-to-default mortgages traded in a shell game to retirement funds, or the great myth of the credit score running your life, you can be sure if there's something wrong going on it originated in the financial industry.
... then there's money to be made prolonging the problem!
I was a victim of identity theft. Someone obtained my name, address, date of birth, and social security number and opened up a credit card in my name. (Apparently, Capital One doesn't care if you get Mother's Maiden Name wrong. So much for that being a "security question!") My only saving grace was that the criminals paid for rush delivery of the card and THEN changed the address. The card got sent out before the change of address was processed and it came to me instead of to them. Otherwise, I would have found out when the collection agencies banged on my door demanding I pay the thousands of dollars that I would have "owed."
Unfortunately, the thieves weren't caught. The local police were woefully undertrained on technology. (They had an IP address of the web form filled out and the time submitted and I needed to show them how to find the ISP and what the next step should be.) They also weren't highly motivated. After all, I didn't lose any money and chances are they would do some legwork and then the case would need to be transferred to some agency out of state. The feds were completely uninterested as this was too small-time to warrant their attention.
Even if the thieves had been arrested, though, who knows how many other people have my information. I did research on how to keep this from happening again and turned up three things:
1) The Fraud Alerts are garbage. They are a voluntary note on your credit that credit issuers are supposed to check but sometimes don't. Plus, they only last 90 days. Once your information is out there, it's out there for good. Thieves aren't going to delete it after 90 days, why should the fraud alert end there.
2) You can freeze your credit. It can be a pain because you'll need to pay to thaw it if you want to get a loan/credit card/etc, but it means that no thief can add a line of credit in your name. Period. Of course, credit agencies hate it when you freeze your credit since this means you won't be opening tons of store cards and the like which means they can't make money off of you by selling your name to those "you've been pre-approved!" card issuers. To a consumer, though, this is an additional benefit.
3) Get your free credit reports and closely examine them, but don't get them all at once. You get one from each of the three major credit agencies each year, but for the most part they'll be the same. For maximum coverage, stagger them. For example, you could get Experian in January, Transunion in May, and Equifax in September. Then you could start back at Experian once January rolls around again.
None of this is fool-proof, of course. No security ever is. But this does offer as good of a protection as you can get and there's no reason to make it easy on the criminals. Trust me: Even if you catch it before any damage is done, having your identity stolen is EXTREMELY stressful!
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I figure they would be an even bigger treasure trove of account information than the original sites that were breached?
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
No later than today I've blogged about another example of that: to make a long story short, my bank has "shared" my details with some 3rd party... whether they're 0wned or selling the data is yet to be answered. http://florent.daigniere.com/p...
The problem with most of the credit monitoring companies is the little they do can be done by the consumer for a lot less. The real work comes when your identity has been stolen and the hundreds of hours it takes to clean up the mess. This is where you need a company that will do the legwork for you. I use Zander Insurance's ID theft program. I look at it as one more insurance that I pay per year. If/When I need them they are there and I won't have as much pain to endure and the massive learning curve to cleaning up ID fraud on your own.
..that Anti Virus corporations such as Symantec and McAfee benefit from virus and worm outbreaks. Make of that what you will, you either believe there's a conspiracy or that they're just filling a needed niche. *shrug*
Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.
Fraudulent credit monitoring services are not the answer to the problem of fraud. What we need is a simple credit card size device that lists the company, the date/time, and the amount and has a keyboard for authenticating the owner built right into it. That would ensure only the money authorized by the card holder could be transferred out.
Such a device should be fairly simple technologically. The register would simply send the store number, the amount, and date/time. The user would check these with the cashier and enter there pin onto the credit-card device. That information would then be encrypted with something like GPG and sent to the financial institution issuing the card. The cards could use the register itself to send that information. Once the card holder's financial institution received this they could approve (to the merchant) the transaction and send a receipt to the merchant indicating payment was received.
Then the customer can't claim it was unauthorized and the merchant doesn't have to worry about charge backs. There may still be avenues for fraud here if control over a register is obtained, but it's a risk that the store owners would be in a position to harden against. Failure to maintain security updates, locked registers (physically inaccessible USB ports for instance), etc would be the liability of the store.
The same device could work for online web sites by simply having wifi built-in. In fact you could probably even do traditional mail catalog based orders and offline sales (although an offline merchant wouldn't know for sure if the transaction was valid until later, and thus fraud could occur with a modified device) simply by having the user be able to enter the store # onto the device and then having a unique # appear on the screen that is attached to an amount and a store number. There wouldn't be anything to steal then as the merchant would be the only one technically able to capture the funds.
A thoroughly well designed, tested, and attacked design by security researchers I think this would go a long way to ensuring future-proofing too. While the device wouldn't be a never-need-to-upgrade again thing (most likely) it would likely increase the time span between merchants and consumers not being vulnerable and being vulnerable.
So, I wonder if there are some sort of kickbacks and incentives shared between the credit bureaus and big data ....
Just going to leave this here... http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/
There is also a significant increase in fraudsters posing as credit monitoring firms. People should be advised to be very, very careful when engaging such services.
I had Lifelock when the Stratfor hack went down. Stratfor told us all Christmas Eve IIRC though the hack happened in early December. I and thousands of others verified our cards were in the wild, took action, cancelled cards, etc. Finally, in mid-January, Lifelock informed me that my card had been compromised with a single e-mail, long after I already had my new card.
Totally useless.
How about a moderation of -1 pedantic.
Screw credit monitoring: what we need is some CongressSockPuppets with enough nerve to pass restrictions on the credit bureaus. For starters, they could require all negatory information to be redacted upon receipt of a notarized sworn statement from the account holder (until the credit bureau can provide proof to the contrary, said proof not being based on random letters from banks or collection agencies, etc). The current situation, which is essentially "prove a negative," is worthy of the Courtroom of the King&Queen of Hearts.
After that, there are plenty of smaller things to fix. One example: I lost a few points because my monthly spending on one credit card was over 75% of my limit *on that card* . Never mind I always pay on time and in full, or that I happen to have another card with 5 times the credit limit. The lack of logic in the ratings algorithms is appalling.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
Governments (including ours) have been using credit for centuries to advance their power. Businesses also. Bankers thrice. Jesus railed at the moneylenders also.
Just make credit monitors responsible for any charges made by ID thieves....
That'll either put an end to the credit monitors or the thieves.
Didja know that small companies that do windows repair and replacement periodically go around their community smashing car windows with hammers or shooting them with BB guns? It's a nice way to drum up business.
Maybe throw a brick through a plate glass window.
Tire repair places go around slashing tires in a way to make sure the tire must be replaced and not be repairable.
There are no victims as far as they are concerned because insurance will cover the replacements. Kah Ching!
Are the credit monitoring companies hiring people to break into retailer computers and copying off credit card information? Gee, it CAN'T be possible, is it?
Banks and credit card companies should be monitoring accounts for fraudulent activities FOR FREE. They charge account holders monthly service fees to maintain the account. A basic tenant of maintaining the account is making sure that criminals are not racking up fraudulent charges / making fraudulent withdrawls.
The whole "credit monitoring" industry is a system of a broken system.
Seriously, want to stop the spam, or the ability of somebody else to get your information?
Call all 4 credit agencies and put a block on your data.
With this, nobody can access this. If you go for a loan or a CC, then you will need to unblock it, BUT, it is actually cheaper and safer than paying these monitors monthly.
I prefer the "u" in honour as it seems to be missing these days.
The root of this problem is that this has gone from "Fraud" to "Identity Theft". It is no longer the responsibility of the company that issues the credit/sells the item to determine if the person is who they say they are. As a result, there is no longer a financial incentive for companies to care. The responsibility has been shifted to the consumer who is often not even a part of the transaction (i.e. opening a bank account) but is still liable for lax policies of the issuing company unless they actively monitor their credit reports. They are liable because everything from cellphone contracts to mortgages are based on your credit score and if you have something on your report (even if you didn't do it) you will still pay the penalty by paying higher car insurance or by not being able to get a loan.