The post Groups Express Concerns to Senators About Proposal to Expand Reporting Regime for Private Financial Information appeared first on Consumer Federation of America.

The post Groups Call for FTC to Address Surveillance and Data Abuses appeared first on Consumer Federation of America.

The post Groups Say CA Bill on Health Research Must Protect Individuals’ Privacy appeared first on Consumer Federation of America.

In a hearing yesterday of the Virginia House of Delegates Committee on Communications, Technology & Innovation, consumer groups that had signed up to testify were not  called upon, nor was there any acknowledgement of the letters and comments that CFA and others submitted expressing serious concerns about the legislation. In her online comments, Ms. Grant pointed out that the opt-out framework in the bill places the burden on consumers to navigate today’s incredibly complex data ecosystem. Consumers must take steps to opt-out of unwanted uses of their information (to the limited extent they are allowed to do so), rather than being asked for consent to use their data for purposes beyond making a transaction or fulfilling their other requests. “Making “opt-out” the default disempowers consumers and poses equity concerns; consumers with less time and resources to figure out how their data is being used and how to opt-out will inevitably be subject to more privacy violations,” Ms. Grant said.

Among other problems with the bill that Ms. Grant highlighted, it:

• Gives consumers no rights concerning the personal data that may be gleaned from social media and other “channels of mass media” if they didn’t adequately restrict access to that information.
• Gives consumers no control over businesses selling their personal information to affiliated companies.
• Requires opt-in for processing consumers’ “sensitive data” but not for uses of their personal information that may be sensitive.
• Allows consumers to opt-out of seeing targeted advertising based on tracking their activities over time on multiple websites and apps and profiling them, but that opt-out does not stop the tracking and profiling from occurring.
• Does not apply to advertising based on tracking consumer’s activities over time on a company’s own website or app and profiling them – the business model of Google and Facebook, which profit from profiling and targeting consumers on behalf of other businesses.
• Only gives consumers the right to opt-out of profiling when it is used “in furtherance to decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer.” There is no overall right to stop being tracked and profiled.
• Does not apply to consumers’ personal information when it is in the hands of financial services companies or other businesses that are covered by other laws, even if the privacy protections of those laws are much weaker.
• Allows parents and legal guardians to exercise consumer’s rights but does not enable consumers to designate others to act on their behalf, as an aging parent who doesn’t understand technology might want.
• Allows businesses to charge consumers more or provide them with lower-quality products or services if they exercise the limited rights they have to opt-out of targeted advertisements, their personal data being sold, or being profiled. In other words, if consumers want privacy, they have to pay more, a blatantly discriminatory policy.
• Lets companies that hold and process consumers’ personal data avoid any responsibility when third parties to which they disclose the data violate the law unless they knew those parties intended to violate the law. (So Facebook would have no liability for what Cambridge Analytica did with users’ personal information.)
• Prevents consumers from taking legal action to enforce their rights.
• Creates a “right to cure” that hampers the ability of the attorney general to take action to stop bad practices and obtain remedies for consumers.

The bill is nearly identical to the Washington Privacy Act, which CFA also opposes. “This legislation is being promoted by Big Tech companies and industry groups around the country as a model for other states to follow,” Ms. Grant noted. “It’s crucial for legislators to take the time to listen to consumer and privacy advocates in order to craft real privacy protections for their constituents.”

Contact: Susan Grant, 202-939-1003

The post Virginia Legislature, Ignoring Consumer Groups, Steamrolls Bad Privacy Bill toward Enactment appeared first on Consumer Federation of America.

 Top Ten Tips for Holiday Shoppers

 Make a List, Check It Twice: Decide how much you can spend this holiday and stick to it. When you make your list, include an amount for each person and, if you know what you’re getting them, what you expect to pay for the item.  Adding your list up at the kitchen table can be an eye opener—so make adjustments early rather than when you are running through the stores or pounding on your keyboard.  And when you’re shopping, keep a running total of your spending—it’s amazing how keeping tabs on your total will protect your wallet as it fills with receipts!

You Gotta Shop Around: You can easily save 10 percent, or considerably more, by comparing prices. When shopping around online, be sure you purchase from a secure site, review receipts for accuracy, and be mindful of shipping costs. If free shipping is available with a minimum purchase, be sure the additional items are really needed and don’t put you way over the ‘free shipping’ requirement.

Give the Scammers Goose Eggs, Not Your Money: If you see a popular item online for much less than the typical price, beware—it could be from a fraudster. That amazing deal may simply be a way to get your credit card information. Stick with companies you know and steer clear of email and social network offers from unfamiliar sellers – they could be scammers who will take your money and run.

Santa’s Receipts are Gold: Whether buying online or in-store, keep all receipts—they are gold! Without a receipt, retailers will usually refund the item’s current price, not what you actually paid.  And if you find an item cheaper elsewhere, many retailers will match the lower price, but only if you have the receipt.

Avoid Extra Treats: When shopping online, be careful of additional “suggested” items based upon your purchases. Your savings after searching for the best price can evaporate when you buy the extras that pop up as you check out.

Don’t Get Wrapped Up in Debt: Avoid borrowing money for holiday gift giving. Remember, the old adage—it’s the thought that counts—not the cost! If you use a credit, rather than debit card, be sure you know the day your payment is due so that high interest charges don’t evaporate the great buys you made.

Dream of a Green Christmas: To avoid overspending, consider paying with cash. Surveys show we spend more when using a credit card—doling out the “green” is a great way to limit your spending.

Don’t Let the Grinch Steal Your Christmas: Identity thieves love unsecured wireless networks—so only connect to networks that require a security key or certificate.  If you use a wireless connection at home, be sure that the security features are turned on and set your own password, rather than use the default password.

Ask Santa About Returns: Before checking out, double check return policies and time limits. Some retailers will let you return online purchases to their stores to avoid return shipping charges, others actually provide free return labels.

Checkout with Care: Watch out for “savings” coupons and clubs when checking out—you may be signing up for a monthly program and your credit or debit card number could be transferred to a another company. These programs typically charge $10 to $15 a month and the rigmarole to cancel can be a hassle.

The post Shopping Smart: CFA’s Jack Gillis Releases His Latest Tips to Keep Holiday Shopping From Becoming a January Hangover appeared first on Consumer Federation of America.

CFA Privacy Comments

The post CFA Leads Groups in Comments to the CFPB warning of the Privacy and Security Concerns in the Agency’s Proposed Debt Collection Rule appeared first on Consumer Federation of America.

Another crucial step is to annually check one’s credit report, which is free to do from each of the three credit bureaus (Equifax, Experian and TransUnion). “Despite the increasing importance of checking one’s credit reports, our recent research shows a disturbing trend: the percent of consumers who believe it’s important to check one’s credit report has declined from 2012 to 2019, from 82% to 67%,[1]” said Jack Gillis, Executive Director of the Consumer Federation of America.

A potential cause of the steep decline can be attributed to the improving economy and consumers’ financial condition. When CFA started surveying consumers on credit score knowledge in 2012, many Americans faced challenging credit card and mortgage debts, so checking one’s credit score was top of mind. As personal finances have improved, consumers have become less vigilant about checking their credit scores and reports.  “The problem,” said Gillis, “is that with the increase in data breaches, it’s never been more important to keep a watchful eye on your credit reports.”

To help increase consumer knowledge of credit scores and reports, CFA and VantageScore Solutions® developed the Credit Score Quiz, an on-line tool for consumers to test and improve their credit score knowledge.

By using the Quiz, over 230,000 consumers have learned about the damage identity theft can cause and the many ways a credit score can affect one’s life.  Problematic credit scores effect consumers by:

• Denying them access to needed credit.
• Increasing the costs of consumer, auto and mortgage credit.
• Increasing deposits required by utilities and cell phone companies to obtain service.

With free access to credit reports, and a multitude of inexpensive or even free credit monitoring services, consumers can stay on top of their personal credit status.  Consumers who have been involved in a data breach, can often get free credit monitoring. “There are few things that have more impact on your personal finances than your credit status—staying on top of it needs to be a number one priority for all of us,” said Gillis.

[1] The research reported the findings of eight annual surveys of consumer knowledge about credit scores and reports.  The most recent survey was conducted by the Engine Telephone CARAVAN survey, who on April 25-28, 2019, interviewed 1,002 representative adult Americans by landline or cell phone.  The survey’s margin of error is plus or minus three percentage points.

Contact:

Jack Gillis, Consumer Federation of America, 202-939-1018

Jeff Richardson, VantageScore Solutions, 203-363-2170

The post With Data Breaches Becoming Increasingly Prevalent, it has Never Been More Important to Check One’s Credit Report appeared first on Consumer Federation of America.

Typically, the scam starts when a consumer receives a call out of the blue from someone claiming to be from the Social Security Administration. These callers may ask you to confirm your Social Security number, ask for additional personal information to increase your benefits, and even threaten to withhold your benefits unless you provide it.

It is important to know that Social Security officials will never call you and threaten to terminate your benefits, nor will they ever state that you will face potential arrest or other legal action if you fail to provide information or pay a fee.

Be sure to follow these tips to avoid falling for the Social Security impostor scam:

• Never provide personal information, such as your Social Security number or bank account details, over the phone or online unless you are certain the request is from a legitimate source. In general, the Social Security Administration and the IRS will not contact you via phone or send an email asking for your personal information.
• Whenever you are in doubt, contact the government agency at a phone number you know to be legitimate. This will help you verify whether the request is real or part of a scam. Don’t call back using caller ID information because scammers can use spoofing technology to put whatever phone number they choose on your caller ID screen. To reach the Social Security Administration, call 800-772-1213. To reach the IRS, dial 800-829-1040.

• Don’t try to keep the Social Security scammer on the phone or otherwise engage the con artist. It is best to simply hang up and report the scam to the Office of the Inspector General of Social Security by calling 800-269-0271 or by submitting a report on the OIG website: https://oig.ssa.gov/report.

This blog is one of a series of articles contributed by state and local consumer agencies in connection with the annual survey about consumer complaints conducted by Consumer Federation of America. The survey report provides “real life” examples of complaints and tips for consumers. Have a consumer problem or question? Find your state or local consumer agency at https://www.usa.gov/state-consumer.

The post Social Security Scams Hit Americans appeared first on Consumer Federation of America.

AB 1130 Support Letter

The post CFA Joined other Consumer Groups in a Letter Supporting California Bill AB 1130, That Would Expand the Definition of Personal Information in California’s Data Breach Notification Statute appeared first on Consumer Federation of America.

Why are so many consumers making assumptions about how dark web monitoring protects them that simply aren’t true? It may be due in part to the fact that it’s hard to tell from the ads exactly what these services do. Also, because most of us don’t have direct experience with these services, we don’t know how they work. While dark web monitoring can be helpful for consumers whose personal information has been stolen, it’s important to understand that these services can’t put the genie back in the bottle.

The dark web is a small part of the internet that can only be reached with special browsers. Those browsers disguise the computers that are being used, providing a high level of privacy. That’s great for whistle-blowers, investigative journalists, people organizing against repressive governments, law enforcement agencies, and others who need to shield their identities and locations in order to communicate safely. Unfortunately, the dark web is also attractive to people who take advantage of its anonymity to sell stolen personal information and other illicit goods and services.

As we explain in our updated guide, Nine Things to Consider When Shopping for Identity Theft Services, identity theft services that monitor consumers’ personal information, including on the dark web, can alert them about possible fraudulent use of their data. These services also provide advice about what to do to avoid or limit the damage that could be caused and remedy any problems that have occurred. We also describe how you can monitor many of your accounts yourself for free.

If you believe that your personal information has been stolen, you don’t need dark web monitoring to know that it could end up for sale there. The steps you should take, outlined in our new tips, Dark Web Monitoring: What You Should Know, apply to any situation in which these types of personal information are in danger of fraudulent use:

• Financial and other account numbers. Notify the places where you have those accounts. You may need new account numbers and to make other changes to stop those accounts from being misused from that point on. If fraud has already occurred, ask what you need to do to clear up the problems. You have the right to challenge credit card charges and debits you did not make.
• Passwords. Change them. And if you’ve used the same passwords for multiple accounts (a common but dangerous practice, since crooks often try them in several different places to see if they work), be sure to change them everywhere.
• Driver’s license and passport. Contact the agencies that issued them.
• Email address and phone number. It’s probably not worth the hassle to change them, but be on guard for your email address being used to send spam or your phone number being “spoofed” to make calls look like they’re coming from you. Contact your service provider if that happens.
• Social Security number. This is the most dangerous type of personal information in the hands of identity thieves because it can open the gate to serious fraud, from obtaining credit in your name to impersonating you to get medical services, government benefits, your tax refunds, employment – even using your identity in bankruptcy and other legal matters. It’s hard to change your Social Security number and it’s not a good idea because it is connected to your life in so many ways. There are a number of things you can do, including alerting the Social Security Administration, Internal Revenue Service and by placing fraud alerts or a security freeze on your credit files.

Additionally, if information about you resulting from identity theft shows up in your credit reports, public records or companies’ databases, you can correct or remove it. What no one can do, however, is grab stolen information out of the hands of identity thieves. That’s one reason why data breaches are so worrisome for those affected.

Fortunately, there is plenty of free help available for identity theft victims, including the Federal Trade Commission’s www.identitytheft.gov, which provides step-by-step recovery plans tailored to their particular situations, and the nonprofit Identity Theft Resource Center, which offers free one-on-one counseling online at www.idtheftcenter.org or by phone, 888-400-5530. Our own www.IDTheftInfo.org website has information about free security freezes and other ways to protect yourself and deal with identity theft problems.

In short, there are many resources to help people with identity theft issues, from fee-based to no-cost. To make informed decisions about identity theft services, consumers need to be provided with clear, complete information about what they do. In our Best Practices for Identity Theft Services, which we developed several years ago with identity theft service providers and consumer advocates, we encourage companies to describe the benefits and limitations of their services and to be careful not to overstate or misrepresent, directly or by implication, how they help consumers. In light of our survey results, it seems that the companies that offer dark web monitoring could do a better job of explaining what it can and can’t do to help consumers.

The post Consumers are in the Dark About Dark Web Monitoring Services appeared first on Consumer Federation of America.

You may see ads for identity theft services claiming that they will look for your Social Security number, credit card numbers, or other personal information for sale on the “dark web.” Do you know what these services do if they find it? In a survey commissioned by Consumer Federation of America, 36 percent of people who have seen these “dark web monitoring” ads believed that these services could remove their personal information from the dark web, and 37 percent thought they could prevent the information that’s sold on the dark web from being used. In reality, neither is true!

Here is what you need to know about the dark web, how identity theft services work, and what you can do if your personal information is in danger.

What is the dark web?

Picture the internet as an iceberg. The part above the water is the “surface web,” where you can find webpages using search engines such as Google or Bing.

The part of the iceberg under the water is the “deep web.” Search engines won’t bring you to the pages here. This is where you are when you sign into your bank account online with your username and password. It’s where the content is beyond paywalls. It’s where you communicate with other people through social media, chat services and messaging platforms. The deep web also houses large databases and many other things. It is a significantly bigger chunk of the internet than the surface web.

The “dark web” is a small part of the deep web. Mozilla Firefox, Internet Explorer, Google Chrome and other commonly-used web browsers won’t get you there; you need a special browser such as Tor. One of the features of Tor is that it disguises the computer that is being used to reach the internet, providing a high degree of privacy. While Tor can be used to go anywhere on the internet, if a website address ends in “.onion” it’s in the dark web and only accessible via Tor.

The dark web sounds like scary place, but not everyone there is up to no good. It’s used by whistle-blowers, investigative journalists, people organizing against repressive governments, law enforcement agencies, and others who need to shield their identities and locations. There are legitimate discussion groups, news sites, and publications there. But there are also people selling child pornography, illegal drugs, stolen personal information and other illicit goods and services. They commonly take payment in the form of Bitcoins or other “cryptocurrency” that can’t be traced. The anonymity of the dark web makes it challenging for law enforcement to find and prosecute these people.

What can identity theft services do if my personal information is for sale on the dark web?

Identity theft services look for signs that that your personal information may have been used fraudulently. They usually check your credit reports, and some will monitor your financial accounts as well. They may also look at public records, commercial databases, and the internet. They have tools that the average person doesn’t for accessing places that are hard to reach, such as sites that sell stolen personal information on the dark web. If they find something suspicious, they’ll let you know.

Identity theft services also provide advice about what to do to remedy the problems they find. Some offer one-on-one counseling to guide you through the steps you need to take, and some go further, actually getting your permission to remedy the problems for you.

You can correct, and in some cases remove, information about you in commercial and public records that has resulted from identity theft. That’s because you’re dealing with legitimate companies, agencies or organizations that will cooperate with fraud victims. The dark web, however, is another matter. The people who trade in stolen personal information there won’t cooperate with an identity theft service or anyone else, so it’s impossible to get the information removed, stop its sale, or prevent someone who buys it from using it. What dark web and other types of monitoring can do is alert you so that you can take action to avoid or limit the damage that the fraudulent use of your personal information could cause and remedy any problems that have already occurred.

Even if you don’t have dark web monitoring, if there is reason to believe that your personal information has been stolen, you should assume that it can end up for sale on the dark web.

What should you do?

This will depend on the types of personal information involved.

• Financial and other account numbers. Notify the places where you have those accounts. You may need new account numbers and to make other changes to stop those accounts from being misused from that point on. If fraud has already occurred, ask what you need to do to clear up the problems. You have the right to challenge credit card charges and debits you did not make.
• Passwords. Change them. And if you’ve used the same passwords for multiple accounts (a common but dangerous practice, since crooks often try them in several different places to see if they work), be sure to change them everywhere.
• Driver’s licenses and passports. Contact the agencies that issued them.
• Email address and phone number. It’s probably not worth the hassle to change them, but be on guard for your email address being used to send spam or your phone number being “spoofed” to make calls look like they’re coming from you. Contact your service provider if that happens.
• Social Security number. This is the most dangerous type of personal information in the hands of identity thieves because it can open the gate to serious fraud, from obtaining credit in your name to impersonating you to get medical services, government benefits, your tax refunds, employment – even using your identity in bankruptcy and other legal matters. It’s hard to change your Social Security number and it’s not a good idea because it is connected to your life in so many ways. There are a number of things you can do, including alerting the Social Security Administration, Internal Revenue Service and by placing fraud alerts on your credit files.

Medical records, diplomas and other personal information may also be found for sale on the dark web. At the Federal Trade Commission’s www.identitytheft.gov website you can get step-by-step instructions for what to do, tailored to your specific situation. The nonprofit Identity Theft Resource Center also provides free help for identity theft victims. Go to www.idtheftcenter.org or call 888-400-5530.

If you are a data breach victim, take advantage of free identity theft services if they’re offered. Thinking about buying identity theft services? Shop around and make sure you understand how they work, what they cost, and what help they provide if you become a victim before deciding whether to sign up and which one to choose. Do not be swayed by scare tactics, claims that an identity theft service can prevent you from becoming a victim, or million dollar guarantees. To learn more read CFA’s tips, Nine Things to Consider When Shopping for Identity Theft Services, and go to our www.IDTheftInfo.org website, where you’ll find additional information about identity theft from many trusted sources.

The post Dark Web Monitoring: What You Should Know appeared first on Consumer Federation of America.

1. Beware of false prevention claims. Identity theft services may detect some problems, such as new accounts fraudulently opened in your name, more quickly than you might otherwise discover them. But they can’t prevent your personal information from being stolen or fraudulently used and shouldn’t claim they can.

2. Resist scare tactics. Identity theft can cause financial and emotional harm. Not everyone will become a victim, however, and some of the most common problems resulting from identity theft are easy to fix. For instance, if there are fraudulent charges on your credit card you’re only responsible for up to $50 and you probably won’t have to pay anything if you report them promptly. Some identity theft problems can be more difficult to deal with, but you may never have them and there is plenty of free advice available if you do. Don’t be swayed by advertisements that try to scare you into buying identity theft services.

3. Look carefully at what the service monitors. Most identity theft services provide “credit monitoring,” checking your credit reports for signs of possible fraud. Since the main credit reporting companies (Experian, Equifax, and TransUnion) may not have the same information about you, look for a service that checks all three. Some identity theft services monitor consumers’ financial accounts. Not all financial institutions are included, though, so you’ll need to ask about yours. Identity theft services may also check public records, commercial databases, and the internet for clues that your personal information is being fraudulently used. Generally the broader the monitoring the better because it provides a fuller picture of the problems that may be lurking. No service can guarantee to find every problem, however. Identity theft services should make clear how frequently they do the monitoring and how they alert you they find something suspicious.

4. Understand how the service will help you if you become an identity theft victim. Most identity theft services provide general advice about what to do, and many offer one-on-one counseling to guide consumers through the process of remedying the problems that identity theft has caused them. But you still have to do the work yourself. Some services go further, actually getting consumers’ permission to remedy their identity theft problems for them. Read how the assistance is described carefully. If you became a victim of identity theft before purchasing a service, it’s also important to know if it will provide help for the problems you already have or that may result from that incident in the future.

5. Get the facts about insurance. Many identity theft services include insurance that will reimburse you for expenses to remedy identity theft problems such notary fees, faxes, copies, and postage. It may cover lost wages if you had to take time off from work. Attorney’s fees may also be covered. In most cases, the insurance won’t reimburse you for money stolen from your accounts. “Guarantees” that some identity theft services offer are often insurance policies. As with any insurance, there are limits on what’s covered and how much will be paid, and strict requirements for making claims. The details of insurance or guarantees should be available on identity theft services’ websites and from their customer service. Since this insurance generally provides little value, however, it’s more important to consider what the identity theft services will do to help victims remedy their problems.

6. Know the cost and terms before you commit. Identity theft services should make the cost clear before you’re asked for any personal information or payment. “Free trial offers” are often used to market identity theft services. While this allows you to test features such as online “dashboards, you won’t really be able to judge how well the monitoring or victim assistance work since it’s unlikely that you’ll become an identity theft victim during the trial period (usually a week or two). In most cases the burden will be on you to cancel before the end of the trial to avoid being charged. Some services offer a basic version of their programs for free and then try to get you to upgrade to one with more features, for a fee. Always check the cancelation and refund policies before you enroll. Keep in mind that if you’re a data breach victim, you’ll probably be offered identity theft services at no cost to you.

7. Read the privacy policy. Identity theft services collect a lot of very sensitive personal information to verify consumers’ identities when they sign up, process their payments, provide monitoring services and help them with problems, but they may also use that information to sell other services to them and share it with other companies. They should clearly explain what personal information they collect, how they use it, how they safeguard it, whether and why they share it with others, and what control, if any, you have. This information should be available on their websites and through their customer service.

8. Ask questions if something isn’t clear. It’s sometimes hard to tell exactly what identity theft services do and how they work from their advertisements, websites or other materials. Look for a toll-free number and call if you have questions.

9. Do your own thing. If the answer is no, steer clear! Identity theft service providers that follow good practices should make it easy to find information on their Web sites and through their customer service representatives about exactly what the insurance or guarantee does for you and in what situations. For instance, if it reimburses you for expenses related to resolving identity theft problems, the identity theft service provider should explain what types of expenses are included, whether there are limits to how much you can get or other restrictions, and what’s required to make a claim. Identity theft service providers should also tell you if things aren’t included that you might expect the insurance or guarantee to cover. For example, if you won’t be reimbursed for money stolen by identity thieves, or you’re not covered for identity theft that is committed by a family member, that information should be easy to find and clearly explained. If the guarantee is that the service provider will resolve your identity theft problems for you, any limits to the situations that are covered or the assistance that will be provided should be clearly spelled out.

The post Nine Things to Consider When Shopping for Identity Theft Services appeared first on Consumer Federation of America.

“Our survey indicates that many consumers are making assumptions about how dark web monitoring protects them that simply aren’t true,” said Susan Grant, CFA’s Director of Consumer Protection and Privacy. “Dark web monitoring may be able to alert consumers that their stolen personal information is being offered for sale on the internet, but it can’t put the genie back in the bottle.”

CFA commissioned the survey because dark web monitoring is featured in many advertisements for identity theft services. “The dark web sounds scary, so there is the potential for advertising that plays on consumer fears,” said Ms. Grant. The dark web, which is a small part of the internet, can only be reached by special browsers. Those browsers disguise the computers that are being used, providing a high degree of privacy. While the dark web is used for many legitimate purposes, including by whistle-blowers, investigative journalists, people organizing against repressive governments, law enforcement agencies, and others who need to shield their identities and locations in order to communicate safely, it is also attractive to people who take advantage of its anonymity to sell stolen personal information and other illicit goods and services.

Identity theft services that monitor consumers’ personal information, including on the dark web, can be helpful in alerting them about possible fraudulent use of their data. These services also provide advice about what to do to avoid or limit the damage that could be caused and remedy any problems that have occurred. They can’t erase the information on the dark web, however, or keep buyers from using it.

When information about consumers resulting from identity theft shows up in records maintained by legitimate companies, agencies or organizations, it can be corrected or removed. That is not the case in the dark web marketplace. “The people who trade in consumers’ personal information on the dark web aren’t going to cooperate with an identity theft service or anyone else who asks them to remove the information, stop selling it, or not to use it,” Ms. Grant said.

In collaboration with identity theft service providers and consumer advocates, CFA issued Best Practices for Identity Theft Services several years ago to encourage companies to provide clear, complete information about their services and discourage unfair and deceptive practices. The Best Practices document addresses many concerns, including the fact that the benefits and limitations of some identity theft services may not be easy for consumers to understand, and calls for clear and unambiguous explanations. It also says that identity theft service providers should be careful not to overstate or misrepresent, directly or by implication, how the features of their programs help consumers. “It is worrisome that more than a third of consumers who have heard about these services think they can remove or prevent the sale of their information on the dark web,” said Grant. “It would be helpful for the companies that offer dark web monitoring to do a better job explaining its limits as well as its benefits.”

To address consumer misperceptions, CFA has developed a short consumer guide, Dark Web Monitoring: What You Should Know, explaining what the dark web is, how dark web monitoring works, and what to do if one’s information is in danger of fraudulent use. CFA has also updated Nine Things to Consider When Shopping for Identity Theft Services to help consumers learn more about identity theft services and what they can do to reduce the chances of becoming identity theft victims, spot fraud, and remedy problems. CFA’s www.IDTheftInfo.org website also provides additional information about identity theft from many trusted sources.

Contact: Susan Grant, 202-939-1003

The post Too Many Consumers Believe Identity Theft Services Can Remove Personal Data From The Dark Web appeared first on Consumer Federation of America.

Download PDF

The post Consumer and Privacy Groups Oppose Inadequate Consumer Privacy Bill Proposed in Washington State appeared first on Consumer Federation of America.

All Americans are entitled to request free copies of their credit reports once every 12 months. It’s simple to do by going to the website operated by “big three” credit reporting agencies, Equifax, Experian and TransUnion, or calling 1-877-322-8228. Since identity theft can strike at any time, it’s also a good idea to check your credit and other financial accounts regularly for signs of unusual or unauthorized activity. But for people on active military duty, it may not be so easy to get their credit reports or keep a close eye on their accounts. Free credit monitoring will be a big help to these military members.

Before it can start, however, the Federal Trade Commission (FTC) must write rules to define “electronic credit monitoring services,” “material additions or modifications” to credit reports, and other terms. The rules will also cover what information can be required for members of the military to prove their identities and active duty status and bar unfair practices such as misrepresenting that it’s necessary to buy a product or service in order to get the free credit monitoring.

The comments that CFA and other consumer groups made to the FTC about the proposed rules included these important points:

• When military members receive alerts from the credit monitoring services, they should have free online access to their credit reports. Not all events will trigger alerts – for instance, people won’t be notified every time their credit reports are updated to show they’ve paid a bill on time. So when something does result in an alert, people are going to want to check their credit reports to see if there is a problem – that’s the reason for offering the free credit monitoring in the first place. They should be able to do that without having to use their free annual reports or paying a fee.
• The definition of “material additions or modifications” that would trigger alerts should include a significant drop in the person’s credit score. This could be a sign of fraud; for example, it could be caused by an identity thief taking over an existing account and drastically increasing use of the credit limit.
• The proof of identity required to request the free credit monitoring should accommodate the special circumstances of active duty military personnel. Questions like what addresses have you lived at in the last two years may be too burdensome for members of the military who’ve had to move around frequently. It’s relatively easy for people to prove their identities when they purchase credit monitoring services; it should be just as easy for active duty military members who request free credit monitoring.
• The personal information that military members must provide to get free credit monitoring services shouldn’t be used for marketing or other unrelated purposes. Limits must be put in place to protect military members’ privacy and prevent inappropriate uses of their personal, confidential information.
• Advertising for other products and services shouldn’t be allowed during the process of enrolling in free credit monitoring. Military personnel should be able to sign up for the free credit monitoring without being distracted by come-ons for other things. And even after enrolling, they shouldn’t be solicited to buy identity theft insurance, which, as a government study found, have very little value.
• Military members shouldn’t be asked to agree to terms and conditions such as “forced arbitration” in order to get the free credit monitoring. Congress gave active duty military members the right to request free credit monitoring. It’s not appropriate to ask them to give up other rights in return, such as the right to take legal action if they’re treated improperly.

Americans in active duty military service have enough to worry about without having to wonder if they’re identity theft victims. While credit monitoring doesn’t detect all fraudulent uses of one’s personal information, it can alert people to some of the most common types of identity theft and give them a head start on resolving the problems that may result. We all should be able to check our credit reports, any time we want to, for free. This new law is a good first step.

The post Free Credit Monitoring for Active Duty Military Members appeared first on Consumer Federation of America.

• The FTC should include as part of any “electronic credit monitoring service” free online access to credit reports when an active duty military consumer receives notification of a material addition or modification to their credit file. Otherwise, there is a significant risk that the nationwide consumer reporting agencies (CRAs) will entice active duty military consumers into paying expensive monthly fees to subscribe to paid access to their own credit reports. Our men and women in uniform deserve free access to online credit reports as part of their right to electronic credit monitoring.
• We support the FTC’s proposed definition of “material additions and modifications,” including the exclusion of prescreening and account review inquiries.
• The FTC must tailor the requirement for “appropriate proof of identity” to accommodate the special circumstances of active duty military consumers. In general, the nationwide CRAs’ identification requirements are overly difficult for consumers to meet, and are more demanding than what the nationwide CRAs require from consumers paying for their reports.
• We support the use, disclosure and advertising restrictions proposed by the FTC, which are appropriate and necessary to protect the privacy interests of active duty military consumers and prevent inappropriate use of their information.
• We support the FTC’s proposal to prohibit the nationwide CRAs from asking or requiring an active duty military consumer to agree to terms or conditions in connection with obtaining the free electronic credit monitoring service that the CRAs are obligated to provide. This prohibition is necessary and appropriate, especially to prevent active duty military consumers from being compelled to agree to forced arbitration provisions in order to exercise their right to electronic credit monitoring services.

Download PDF

The post Consumer Groups Weigh in On Military Credit Monitoring appeared first on Consumer Federation of America.

What does a freeze do?

Consumer reporting agencies are companies that collect information about people, including whether they pay their bills on time, to help businesses determine their credit-worthiness. When you apply for a credit card or a loan, the card issuer or lender checks your file at one or more of these consumer reporting agencies. A freeze prevents them from getting access to the file; without that information, the application will likely be turned down. So if someone is using your personal information to try to get credit, freezing your file acts as a roadblock.

Even with a freeze in place, your creditors will still be able to update the information in your credit file, and you’ll still be able to exercise your rights to get your file for free. Insurance companies that use information in consumers’ credit files in setting their rates, employers that use it (with individuals’ written permission) in making hiring and firing decisions, and landlords that check it before accepting new tenants will not be blocked by freezes. If you have a credit monitoring service, it will still have access to your file as well.

While a security freeze can’t prevent all fraudulent uses of your personal information – for instance, it won’t stop someone from falsely claiming to be you to get your tax refund or other government benefits – it can shield you from some negative consequences of identity theft.

Isn’t it a hassle to place and lift a freeze?

It shouldn’t be hard or take long to place or lift a freeze, and you can do it as often as you want. Here are some important things to know:

• You’ll need to do it separately with each consumer reporting agency.
• You can request and lift freezes online, by calling a toll-free number, or by mail. If you have access to the internet, online is probably the easiest way to go.
• You’ll be asked for personal information, including your Social Security number. This is for your protection, to confirm it’s really you making the request.
• If you request a freeze online or by phone, the consumer reporting agency must place it on your file within one business day; if you request it by mail it can take up to three business days. Saturdays, Sundays and federal holidays are not business days.
• Within five business days of receiving your request the consumer reporting agency must notify you that the freeze is on your file and tell you how to lift it. If you requested the freeze online or by phone, the response will probably be quicker.
• You may be given a PIN number or be asked to create a user name and password for your freeze, which you’ll need to lift it. Don’t lose or share that information!
• Lifting a freeze is supposed to be fast – within one hour if you do it online or by phone, within three business days if you do it mail. You can lift a freeze temporarily and specify when it should go back on, so if you’re doing something that requires a credit check, ask how long that will take. If the lift isn’t temporary and you want to re-freeze your file, you’ll have to go through the whole freeze request process again.
• You can also do freezes for your children or minors under your guardianship.

Where do I go to freeze my files?

What about these ads I see to “lock” my credit files?

A “lock” on your credit file has exactly the same effect as a security freeze. After the massive data breach at Equifax last year, that consumer reporting agency began offering free locks to anyone who wanted them. TransUnion offers a lock as part of its free “TrueIdentity” service. Experian also provides a lock but it’s not free; it is bundled into identity theft services that the company sells. Of course, even with the free locks, Equifax and TransUnion are hoping that you’ll buy other products and services from them. Many other companies that sell credit monitoring and other identity theft services now include locks as part of their programs.

To use a lock you must go online or have a mobile app. Locks may sometimes be more convenient and faster than freezes, but not always – for example, TransUnion has an app that claims to make placing and lifting freezes quick and easy. Whenever you’re considering signing up for a service or downloading an app, check the privacy policy to see if your personal information will be used or shared for marketing purposes and what control you have over that.

Experian allows you to have a freeze and a lock on your credit file at the same time. But if you need to allow access to your file, you’ll have to lift the freeze and unlock it. With Equifax and TransUnion you must choose one or the other. If you have a lock as part of an identity theft service, make sure you know which consumer reporting agency or agencies it applies to.

Are there other consumer reporting agencies?

Innovis is smaller than Equifax, Experian and TransUnion, but if you’re going to freeze your files, do it there, too. The National Consumer Telecommunications and Utilities Exchange focuses specifically on people’s payment histories for telephone and utility services. Since the FTC’s statistics show that identity theft victims’ personal information is often fraudulently used to open new phone and utility accounts, it makes sense to freeze that file as well.

Download Fact Sheet

Infographic

The post Take Advantage of Your New Right to Freeze Your Credit Files for Free appeared first on Consumer Federation of America.

How can you reduce the chances of becoming an identity theft victim?

• Protect your Social Security number. Only provide it to trusted sources and never over the telephone.
• Avoid giving your personal information over the phone or through the mail unless you initiated the contact.
• Watch out for “phishing emails” from scammers pretending to be from your bank or someone else you have an account with and asking to confirm your personal information.
• Use different passwords for your accounts. Knowing that people often use the same passwords for all of their accounts, an identity thief who obtains your password for one account is likely to test it to see if it works with other places where you might have accounts.
• Be sure to shred documents containing personal information before disposing them.
• Place a security freeze on your credit report. This prevents credit reporting companies from releasing your credit report without your consent.  With a security freeze on your credit report it would be unlikely for a thief to succeed in opening new accounts using your personal information.  As of September 21, 2018, you have the right to ask each of the credit reporting companies to freeze your credit file, to lift the freeze when needed, and to re-freeze your file whenever you want, at no charge.

How can you detect possible identity theft?

• If a bill does not arrive as normally scheduled, call your creditor.  Mail theft or diversion is a common tool used in identity theft.
• Regularly monitor your billing statements and bank charge accounts.  If there are charges that you did not make, you might be a victim of identity theft.
• Regularly monitor your credit reports by contacting annualcreditreport.com. You should know that there are several credit reporting agencies.  Among the most prominent are: Transunion, Equifax, Experian, Innovis and National Consumer Telecommunications and Utilities Exchange (NCTUE).  While Innovis is a distant fourth to the first three, it is fast rising as a credit reporting agency of general use.  NCTUE is primarily used by telecommunication outlets when consumers (or fraudsters) apply to open accounts for cell phones and other data devices.

Are you a victim of identity theft?  If so, take immediate action!

• Contact the five credit bureaus (Experian; Equifax; Trans Union , Innovis and NCTUE) and place a fraud alert on your credit reports.
• Contact your local law enforcement agency and report the fraudulent activity.
• Report identity theft to the FTC and FBI.  If you’re a victim of IRS tax fraud, report it to the Treasury Inspector General for Tax Administration.

• Go to https://www.identitytheft.gov/ for more advice about the steps you should take in your particular situation.

This blog is one of a series of articles contributed by state and local consumer agencies in connection with the annual survey about consumer complaints conducted by Consumer Federation of America. The survey report provides “real life” examples of complaints and tips for consumers. Have a consumer problem or question? Find your state or local consumer agency at https://www.usa.gov/state-consumer.

The post Protect Your Identity appeared first on Consumer Federation of America.

Download PDF

The post Consumer and Privacy Groups Oppose HR 6743, the Consumer Information Notification Requirement Act appeared first on Consumer Federation of America.

• Keep your contact list updated so you know who is trying to reach you. Scammers use technology known as “spoofing” to impersonate calls with your local area code and local exchange (the first three numbers in a 10-digit phone number). Scammers use these familiar numbers to try to make you believe someone from your community is calling you. Don’t believe it!
• Only answer calls if you know the caller! Let any unknown numbers leave a voicemail so you can reach legitimate callers later and ignore the scammers.
• Make phone calls only to numbers you independently verify. Don’t respond to text messages from unknown numbers or click on pop-up messages on your devices.
• Don’t plug your iPhone into a computer you don’t trust. Plugging your phone into an unknown computer opens you up to a number of security risks, including “trustjacking,” where scammers remotely hack your device. Make sure to always click “Don’t Trust” on your iPhone when you plug it into an unknown or untrusted computer.
• Use the National Do NOT Call Registry at ftc.gov or call 1-888-382-1222. Registration on the National Do Not Call Registry is free and does not expire.
• Many states have their own Do Not Call Registry as well. If your state has one, use it.

Think you’ve answer a phone call from a scammer? Hang up!

• If you hear an unnaturally long pause followed by a prerecorded message, hang up.
• If you are asked to dial a number to “opt out” of something, hang up. By dialing a number, you are notifying the scammer’s database your number is active and they will keep calling.
• If a caller you do not know asks you to pay taxes, fees, or to give personal information in exchange for something, hang up.

Report phone scams to www.ftc.gov. Reporting helps catch scammers.

This blog is one of a series of articles contributed by state and local consumer agencies in connection with the annual survey about consumer complaints conducted by Consumer Federation of America. The survey report provides “real life” examples of complaints and tips for consumers. Have a consumer problem or question? Find your state or local consumer agency at https://www.usa.gov/state-consumer.

The post Phone Sense appeared first on Consumer Federation of America.

Download PDF

The post CFA Urges FTC to Seek Legal Reforms to Improve Its Ability to Meet 21st Century Consumer Protection Challenges appeared first on Consumer Federation of America.

Download PDF

The post CFA Offers Vermont Leaders Suggestions for Protecting the Privacy of Vermonters appeared first on Consumer Federation of America.

But not everyone checks consumers’ credit files at the “big three.” Many phone companies, for instance, rely on information about new account applicants from the National Consumer Telecommunications and Utilities Exchange (NCTUE). Never heard of it? I hadn’t, either, until I read an article by security expert Brian Krebs. Some gas, electric, water and cable companies also use the information from NCTUE in their approval process for new accounts. If you want to prevent someone from using your personal information to get phone or utility services, you need to freeze your file at the NCTUE.

As with other credit reporting agencies, you have the right under federal law to ask the NCTUE for a copy of your credit file (which it calls the NCTUE Disclosure Form) free once every twelve months. Krebs reported that this is easy to do by calling 1-866-349-5185, or you can mail your request to NCTUE Disclosure Report, P.O. Box 105161, Atlanta, GA 30348. I couldn’t see any information on the NCTUE website about what documentation you have to provide with your request to prove you’re really you, so I suggest that you request your file by phone. Krebs says that the automated system will ask for your Social Security number and your street number.

There is an online option to freeze your file at NCTUE, but when Krebs tried it he ran into problems – the same kinds of problems that he encountered when he tried to freeze his files online at Equifax after that company’s gigantic data breach. Ironically, Equifax happens to run the database for NCTUE. But freezing your file at Equifax does not freeze your file at NCTUE – the two systems are separate. So the best way to freeze your NCTUE file is by calling 1-866-349-5355. You may have to pay a small fee – the free “lock” (which is pretty much the same as a freeze) that Equifax now offers does not apply to the files at the NCTUE.

Should you bother to do any of this? Well, according to the Federal Trade Commission’s latest statistics on fraud and identity theft, phone or utilities fraud was the third most common type of identity theft reported to the agency last year. Reports of new landline phone accounts fraudulently opened with consumers’ stolen information jumped by a whopping 150 percent. If someone got phone service in your name and doesn’t pay the bills on time, you may be in for an unpleasant surprise the next time you try to open new phone account.

Consumers should have the right to freeze and lift freezes on their credit files for free whenever they wish. But until that happens, it’s probably worth paying a small amount for the extra security and peace of mind that a freeze gives you. A freeze won’t keep anyone from taking over an account that you already have, but there are things that you can do to make that harder, too. Consider it self-defense.

The post A Credit Reporting Agency You Probably Never Heard Of appeared first on Consumer Federation of America.