As my colleague John Timpane chronicled in today's Philadelphia Inquirer, he has joined an unhappy club: victims of identity theft. Timpane learned of the crime when a letter arrived from the IRS. Seeking a quick and fraudulent refund, an imposter had tried to file a tax return on Timpane's behalf. He reports that nearly half of all ID-theft reports - a category said to be growing after a two-year decline - now involve tax fraud or attempted fraud.
As Timpane discovered, unraveling an identity fraud and restoring your good name is, at best, a monumental hassle:
As a newbie victim, I'm now dealing with the IRS (to get an explanation, mail my real return, and file an Affidavit of Identity Theft, Form 14039), the Social Security Administration, the FTC (another affidavit), credit agencies (to put an alert on my credit accounts), my bank (ditto, and to make sure no one has tried to withdraw or charge anything), my local police (yet another affidavit), everyone but my priest and my vet.
Now Timpane is worried about another kind of identity theft: new account fraud. An IRS employee warned him: "If they have your Social and your birth date, which is easy to find, and your mother's maiden name" - a popular security question when people open new credit-card or online banking accounts - "they could conceivably open a fake credit account."
Along with medical identity theft, in which your identity might be used to fraudulently obtain thousands of dollars in medical care, new-account theft is the among the worst kinds of identity cons. As annoying as Timpane's tax fraud was, at least he didn't have to fight with a hospital over co-payments for services someone else stole, or explain to his health insurer that he has no idea who got all that Oxycontin from Walgreen's in his good name.
So what's the answer? For years, the credit bureaus and their subsidiaries have been pitching costly "credit protection" or "credit-monitoring" services. Sign up, and you may pay $15 a month for a product that comes with a catchy jingle and good production values, but offers little else to distinguish it from paying close attention to your own credit reports.
But since the mid-2000s, there has been a relatively cheap - sometimes free - way to combat new-account fraud: a security freeze. The trouble is, it doesn't make any money for the credit-reporting agencies that trade in your personal data, so Experian. Equifax and TransUnion do little to publicize it. In essence, the bureaus are encouraging you to pay monthly fees for credit-monitoring and -alert services, so you'll be quick to discover, after the fact, that you've been victimized. Meanwhile, they're almost hiding a better alternative: By giving you control over who can obtain data from your credit report, a security freeze can block new-account fraud before it happens.
How do you impose a security freeze (also known as a credit freeze)? Because they were required by a series of state laws mostly enacted half a dozen years ago, the details vary. But according to the Consumer Financial Protection Bureau, 47 states plus the District of Columbia now authorize freezes, and the bureaus voluntarily offer the service to at least some residents of Alabama, Michigan and Missouri, the holdouts.
As a New Jersey resident, Timpane is entitled to a free "security freeze" - the name varies state to state - from each of the three major credit bureaus. He'd have to pay $5 for a temporary thaw if he wanted to give a particular creditor access to his credit file, or give any creditor access for the next week or two - say, if he knew he was about to go car shopping and wanted to obtain a variety of loan offers. Isn't that a hassle, too? Perhaps - and that's what the credit bureaus will warn you about if you choose to freeze your credit file. But for most people, shopping for more credit is hardly an everyday thing.
The New Jersey Department of Banking and Insurance explains Jersey's procedures here - Timpane would have to make his requests by certified mail, which adds a little extra cost. Pennsylvania, whose procedures are described here, allows each credit bureau to charge $10 to impose a freeze, but that fee is waived for victims of identity theft.
When it comes to financial security, our laws and rules sometimes seem to have it backwards. Armed with your name, address, and Social Security number, an imposter might find it easier to get $1,000 in "instant credit" in your name in the checkout line of Home Depot than you'd find it to get $200 - from your own bank account - at a nearby ATM.
Without a freeze, only one of those two transactions requires a secret PIN code. Does that make any sense at all?