Truston and Identity Force team up to provide identity theft protection/recovery services

Truston -- who provides a privacy and user friendly means to protect a person from identity theft -- has announced a partnership with Identity Force.

Truston allows a person to protect themselves without giving up any of the personal information that is normally used by identity thieves to commit a wide assortment of crimes. It also allows a person to protect themselves, as well as, find out if they have anything to be concerned about free-of-charge.

A person is only charged for using the service when they recover from identity theft and then is only charged for however long the process takes. This is a big difference from most identity theft protection/prevention services, who charge a person on a long-term basis regardless of whether or not they have been actually become an identity theft victim.

Many of the identity theft protection services do not cover a person unless they were signed up (and paying) at the time they became a victim.

In addition to this, the monthly charge for using the recovery services is about the same as most of the competition. Because the recovery services are used on an "as needed" basis, the overall cost of using Truston is far less than the competition.

Identity Force provides identity theft protection services to a large number of customers including government agencies, such as the Department of Veterans Affairs, Transportation Security Administration, Federal Emergency Management Agency, National Institutes of Health, U.S. Coast Guard and Department of Education.

Because of this, Truston will now be available to a substantial customer base, many of whom, might not want to provide all their personal information to a third-party. Given that many of these people were referred to Identity Force after a data breach -- where a system was compromised and their information was exposed -- Truston provides an approach that might give them greater piece of mind.

Here is part of the announcement from the press release:

Truston, a provider of award-winning online services for identity theft protection, today announced that it has partnered with Identity Force to provide its customers with Truston's online identity theft recovery and prevention services.

As Truston's web-based platform is designed to be private-labeled by partners, the myTruston features will be offered through the Identity Force member dashboard and completely integrated for a seamless customer experience. Through the use of Truston's application programming interface, the myTruston service is embedded within the Identity Force website, taking on its look-and-feel and not requiring an additional user login.

Recently, Truston was named one of the Hot Companies of 2008 by the Network Products Guide in Silicon Valley.

Tom Fragala, Truston's CEO, was himself an identity theft victim and has spent thousands of hours advocating for victims of this growing crime.

He also does a blog on identity theft, which can be seen, here.

Full press release on the Truston/Identity Force partnership, here.

0 comments

Truston Identity Theft Services wins 2008 Hot Company Award

(Tom Fragala, CEO of Truston and Identity Theft Victim Advocate)

The identity theft protection/prevention industry is enjoying double-digit growth in what many believe is a faltering economy. Everyone seems to be jumping into it, even the big three credit bureaus and a LOT of members of the financial services industry.

Critics of the identity theft protection industry say the services they provide are available for free and the proponents say they are making a difficult process easy for busy people.

Tom Fragala, CEO of Truston, introduced a product awhile back that addressed another concern, which is how well is a person's information is protected after it is turned over to an identity theft service and maintained somewhere it might be compromised all over again.

Some of these services ask their customer's to provide them with a power of attorney -- which is something people should consider carefully before handing over -- especially to someone they really don't know.

Tom feels rather personally about this. He has been a victim himself, spent thousands of hours advocating for victims and blogs to make people aware of the problem, also.

In real terms, Truston allows a person to protect their identity effectively without handing over any personal information. It's also cheaper (even free for the protection part of it) than the competition. Using Truston's platform a person is guided through the sometimes difficult process of preventing and recovering from identity theft. The platform even provides reminders if you forget to finish one of the steps.

Because of this, Truston has now been named a winner in the 2008 Hot Company Awards. The announcement was made in a press release and on Tom's personal blog, where he wrote:

On Tuesday, at the Technosium Conference in Silicon Valley, Truston was selected as a winner of the 2008 Hot Company awards by the Network Products Guide, published by Silicon Valley Communications. This comes after being named a finalist in November. All finalists were required to give presentations to a panel of judges prior to the winners being determined.

Having followed the evolution of Truston (I helped test the software), I found this pretty impressive since they were up against companies like "Cisco Systems, Inc, IBM, Juniper Networks, Intel, HP, and Oracle. Other winners of the 2008 Hot Company awards include Blade Network Technologies, Engate Technology, Insightix and Vericept."

When I stated that a lot of players are jumping into this industry, I want to remind everyone that some of them have been the source of information for identity thieves for years. Buying and selling personal information is another highly profitable industry. Problem is that when it is bought and sold numerous times, it's pretty hard to determine where it might end up.

The less places you allow your information to be stored has a direct correlation to how likely it is your information will be stolen.

I guess it all boils down to how valuable a person considers their identity? Truston provides an economical and easy way to protect your personal information.

And if you have an identity worth protecting, it's probably valuable to a "wannabe evil twin" lurking somewhere out there in the shadows, also.

Tom's blog post about Truston being named as a "Hot Company of 2008," here.

Currently, Truston is running a 45 day free trial where you don't have to worry about canceling their service and finding out months later you were still being charged for it.

Previous posts, I've written about Truston, which include some work we've done together on educating people, here.

0 comments

Truston ID Theft protection and recovery platform rakes in another award!

It appears that Tom Fragala and the MyTruston team have raked in (yet) another award. This time from the Pacific Coast Business Times as one of the hot start-up companies coming from California's Central Coast.

Tom Fragala, Truston's CEO wrote on his blog, "This recognition comes on the heels of being named a 2008 Hot Company and receiving a technology award from the Info Security Products Guide."

Here is the reason why they were chosen:

Truston's MyTruston® service is the only fully online identity theft recovery system. It is web-based software that can help millions of people easily recover from and prevent identity fraud by supporting virtually any type of ID theft. MyTruston walks consumers step-by-step through the entire prevention or recovery process—dramatically reducing the time, financial cost, and emotional impact. And it can easily be embedded into a partner's own website on a private-label basis.

The press release also contains a comment from Tom Fragala, CEO of Truston:

“The Pacific Coast Business Times recognition of Truston as one of the hottest startups in Central California further validates our innovative products and strategy of offering our services to large partners in the identity theft, direct marketing and financial services markets,” said Tom Fragala, CEO and founder at Truston. “Superior technology and support for partners differentiates Truston from other companies in the identity theft protection market.”

Tom developed Truston based on his own personal experience as an identity theft victim and has spent thousands of hours assisting other victims of identity theft.

Because of this, coupled with the fact that he is selling this technology to large partners, he still takes care of us "little people" by offering a free 45 day trial (no credit card needed) of the Truston platform.

Saying that, I should mention that the platform has always protected people free of cost and only charges for using it to recover after a person is a confirmed identity theft victim. Most companies charge you right from the beginning and will only help you if you were paying at the time of the crime (pardon the pun). Many of them also require that you surrender all your personal details, which they maintain on a database. Information on databases are a favorite place for identity theft thieves to obtain the resources they need to commit their crimes.

There are some, who believe one of the root causes of identity theft is the multi-billion dollar business of buying and selling information, which is normally maintained in databases.

If you are interested in checking out the Truston platform while it is still free, I've provided a link, here.

0 comments

Keeping an ID Theft Victim's Information Private is Catching On

Tom Fragala, CEO of Truston Identity Theft Services, started his MyTruston identity theft and recovery product based on the principle that he didn't believe an identity theft victim should have to give up their information to a third-party to protect themselves. After all, most of this information gets stored in a database, which is one of main places (besides trash cans) identity thieves go to steal information.

Information stored on databases is legitimately bought and sold by information brokers all the time. Criminals sometimes pose as having a legitimate interest to access the information. Of course, there have also been cases of dishonest employees selling it without a so-called legitimate purpose. This makes it extremely difficult to determine exactly where any stolen information originally came from. At this point in time, so much information has been stolen, we routinely hear about it being sold in chat rooms right over the Internet.

It didn't make sense to Tom to put all this information in another place, where it could potentially be compromised again. Databases have created an ability to store more information than ever before and transfer it with a click of a mouse.

Having been an identity theft victim himself, Tom had some rather personal feelings on the subject. It should also be mentioned that Tom has spent thousands of hours being a personal advocate for victims of this crime.

Since launching the do-it-yourself tool — where you don't have to be an expert to protect yourself or recover from identity theft — it has received numerous awards and become a hot topic within the technology industry itself. Besides not having to be an ID theft expert — you don't have to expose any of your personal information to a third party and the protection aspect is and always has been free. There is a charge for using the recovery tool, which can be cancelled anytime. I'll tell you a secret about that last statement, further down.

I discovered the latest news that the Truston concept is catching on when reading Tom's blog, which is well worth a read if you are interested in identity theft or privacy issues. "Today we announced that our MyTruston product has been included in the portfolio of the Affinion Security Center, the largest provider of identity protection and privacy services. Affinion has nearly 35 years of industry experience and over 65 million members of their many products. Clients of their identity protection and privacy products include Wells Fargo, Bank of America and The Hartford Insurance. Truston's Software-as-a-Service technology is deeply integrated within the Affinion Security Center’s core solution platform, IdentitySecure," according to Tom himself.

Just the day before, Truston also announced a partnership with CreditFYI, which is a one-stop shop for the best credit card rates, best loan rates, as well as, to learn how to protect your good name and credit rating.

Besides Affinion Group and CreditFYI, Truston is a private label partner with Identity Force, which provides identity theft protection services to the U.S. Government. Truston has been given a Four-Star rating by PC Magazine and has received several awards. "Truston's awards include a 2008 Product Innovation Award, a Hot Company 2008 Award, being selected for 10 Companies to Watch in 2008 by the Pacific Coast Business Times, the 2008 Tomorrow's Technology Today award, and it was identified as a leader by Javelin Strategy & Research in their December 2007 identity theft market report," according to the press releases.

If you are interested in just how user-friendly the tool is, the Truston site has a tour you can take.

I've also had the pleasure of speaking with Tom on several occasions and beta tested the tool myself before it rolled out. I've covered this in several blog posts on Tom and the MyTruston identity theft tool.

Now for the secret I promised earlier in the post. I mentioned that using the tool always has been and always will be free, but there is a nominal charge for using he recovery services. The secret is that if you go directly to the Truston site - you can use everything free for 45 days. Last, but not least, this free trial doesn't require you give them a credit card (which will get charged if you forget to cancel) until after the trial expires.

0 comments

Truston Identity Theft Services recognized as a 2008 Hot Companies Finalist

There are very few identity theft protection services that I TRUST one-hundred percent. The reason for this is most of them require that a victim, or even someone who wants to protect themselves from identity theft, provide them with all their personal information.

Some of them even require that you furnish them with a power of attorney, which is even scarier. In the wrong hands, a power of attorney would give the wrong person the ability to do a lot of damage to a name, or financial portfolio.

In the era of outsourcing and phone banks, not giving someone else control over your name and finances is something worthy of consideration. We never seem to know exactly, who is being given access to this information, anymore.

Most identity theft protection services take advantage of free services, which someone who had a fair amount of knowledge could do themselves. The problem is that a lot of people don't have the knowledge, or want something that makes it easy for them.

Truston addresses both these issues by allowing a person to keep their personal information personal and providing a user friendly platform to protect themselves, or if need be, recover from having their identity stolen.

The protection services are always free and if need be, the recovery procedures are a lot cheaper than anything else I've seen on the market. The recovery services are only $10 a month, and only need to be purchased for the time frame they are needed.

The majority of the services out there require a long-term commitment and have clauses (normally written in fine print) covering preexisting conditions.

Because of this, Truston and it's CEO, Tom Fragala have been named as a 2008 Hot Companies finalist by Silicon Valley Communications.

From the press release regarding this matter:

Truston, a provider of award-winning online services for identity theft protection and consumer credit management, announced that it has been named a 2008 Hot Companies finalist by Silicon Valley Communications. Truston was selected after a global analysis of information technology vendors around the world. Truston was chosen based on the "4Ps" selection criteria-Products, People, Performance, and Potential. The 2008 Hot Companies analysis encompassed companies in all areas of information technologies including security, wireless, storage, networking, software and communications.

The Hot Companies 2008 evaluation process also assessed candidates for entrepreneurial spirit, seasoned executives with relevant experience, clear understanding of their IT market segment, products and solutions that are positioned to take advantage of the emerging market opportunities, well developed revenue-growth model and clearly planned expansion strategies.

Tom Fragala, who has a background in the IT world was a identity theft victim himself, which prompted him to design a service that is both effective and privacy friendly.

He has also spent a lot of time as an advocate for identity theft victims and blogs on the subject, here.

Having known him for awhile through our mutual interests, I've done some other posts on Truston (which if anyone is interested) can be viewed, here.

0 comments

Privacy friendly Truston ID Theft prevention/recovery platform wins 2008 Tech Award

After just being named a 2008 Hot Company, Tom Fragala and the Truston team have another award under their belt.

From the Marketwire press release:

Truston®, a provider of award-winning online services for identity theft protection, announced today that Info Security Products Guide, the world’s leading publication on security-related products and technologies, has named myTruston® a winner of the 2008 Tomorrow’s Technology Today Award.

Truston has largely been launched via word of mouth and doesn't offer a lot of gimmicks. What it provides is a DIY (do it yourself) method of protecting yourself and recovering from identity theft.

The press release describes the MyTruston technology:

MyTruston is the only fully online identity theft recovery system. It is hosted web-based software that can help millions of people easily recover from and prevent identity fraud by supporting virtually any type of ID theft. MyTruston walks consumers step-by-step through the entire prevention or recovery process—dramatically reducing the time, financial cost, and emotional impact. And it can easily be embedded into a partner's own website. To read more about this award winning technology, please visit www.infosecurityproductsguide.com/technology.

Tom Fragala, Truston's CEO, is amongst other things an actual identity theft victim, a blogger and spent thousands of hours advocating for identity theft victims before the his technology was launched.

He firmly believes in the basic information security principle that the less places information is stored, the less likely it is to be compromised. This is the reason that MyTruston never asks a person for any of their personal information.

Most identity theft protection services require you give them all your personal details and in some instances, a power of attorney. Given how information is bought and sold and with everything being outsourced to call centers that provide cheap labor, this is something that bears consideration.

Additionally, the prevention and "discovery" process is completely free-of-charge and the service only charges for using the software to recover from identity theft.

There is no long-term commitment to protect yourself.

Tom freely admits that a person can recover from identity theft, if they know how to do it and have the knowledge. One of the reasons there are so many players in the identity theft protection field is that most people find it confusing and difficult to get through all the red tape after becoming a victim.

What Truston provides is a free platform to discover the problem and an interactive means to effectively solve it without having to do a lot of research.

Marketwire press release on Truston's latest award, here.

If you want to test out the free portion (now includes a free trial) of MyTruston, here is a link.

0 comments

Truston Identity Theft Services recognized in Javelin Report as standing apart from the competition

Tom Fragala, CEO of Truston just dropped me a line about his "privacy friendly" identity theft protection and recovery service being mentioned in the most recent Javelin report.

In Tom's own words:

Truston was featured in a Javelin Strategy & Research research report entitled "Identity Fraud Protection Services: Double Digit Growth to Continue."

The report, released December 2007, provides a comprehensive analysis of the key identity theft protection services and is based in Javelin's leading consumer survey data. According to the report, "MyTruston stands apart from other identity protection vendors in this space."

Other companies featured include Equifax, Experian, TransUnion, Fair Isaac, LifeLock, Debix, FraudStop (Identity Safeguards), Identity Guard (Intersections,Inc.) and TrustedID. Read the report brochure here (PDF) and our press release.

Truston stands apart from the other services because it is privacy friendly. Other services require that you give them all your personal information to be maintained in (my guess) another data base. The other feature Truston offers is free prevention tools. A customer only pays for recovering IF and when they become a victim.

The report mentions that there is double digit growth in this industry despite reports showing that identity theft has been on the decline for the past three years.

Please note that a lot of people, watching the identity theft problem, don't necessarily agree with this statement. Maybe this is one of the underlying reasons for the double-digit growth?

One of the biggest problems in compiling accurate statistics is that not all identity theft is reported. A large portion of it is simply written off as a loss by financial institutions, and never reported outside these institutions to the organizations putting together the statistics.

Tom is also a blogger and writes about identity theft. His blog can be seen, here.

0 comments

Identity Theft Service wins Network Products Guide 2008 Product Innovation Award

Tom Fragala announced on his blog that "Truston received a 2008 Product Innovation Award from Network Products Guide for our myTruston Software-as-a-Service (SaaS) platform."

Tom is a well known blogger on the subject of identity theft, was really a victim himself and has spent a lot of time advocating for victims.

He quoted Networks Product Guide as saying:

“Truston's innovative SaaS platform offers an organized approach to getting a stolen identity back and keeping it safe.

myTruston is the only ID theft product that does not require sensitive data, is the only SaaS product in the space, supports virtually all fraud types, has unlimited content extensibility, is built on a patent-pending task management engine and allows for seamless integration with partner's web sites.”

Truston is a platform that allows the individual to protect themselves and recover from identity theft without handing over their personal and financial information. Many of their competitors maintain this information in databases, which seem to be compromised, frequently.

Some of them also require you sign a power of attorney to use their service.

In fact, there is so much compromised information out there, no one is really sure how much there is. Finjan, a noted computer security company, has recently been finding crime servers containing a lot of stolen information that no one knew had been compromised before. Ironically, the owners of these crime servers didn't even bother to password protect them in certain instances.

Despite this, we read about known data breaches all the time.

This isn't the first award Truston has received from the Technology industry and I suspect it won't be the last.

The neat thing is that if you are reading this post, Tom is still offering a free 45 day trial. Of course, the protection part always has been free.

If you would like to try the services for free, click here.

Recently MyTruston created a partnership with Identity Force and their platform is now being used by government agencies. These include the Department of Veterans Affairs, FEMA, US Coast Guard, Transportation Safety Administration, and Department of Energy.

While identity theft is a growing problem and no one can protect themselves 100 percent, MyTruston offers a platform to do so that is at least as good (if not better) than anything else in the industry. If you see advertising for an identity service that is 100 percent bulletproof, I recommend exercising the sage principle of caveat emptor (buyer beware) before shelling out your hard-earned money.

The reason I say better is that it was built on principles that protect privacy and by an individual that wanted people to "trust" his product.

If you would like to learn more about MyTruston, their site has a FAQ page that answers a lot of questions.

Press release on this latest award, here.

0 comments

MyTruston -- where you can see if someone is stealing your identity for free!

You won't get a million dollar guarantee and Tom Fragala's social security number if you decide to use myTruston identity theft prevention/recovery services. You also aren't going to get the paid endorsements for his product by Fred Thompson, Rush Limbaugh, Sean Hannity, or Howard Stern.

Tom, who is the CEO/Founder of MyTruston doesn't believe in buying endorsements, paying bloggers, or doing massive advertising campaigns to promote his service.

He trusts that once a prudent consumer looks at his product and the value it provides, the service sells itself.

Tom was an identity theft victim himself and has spent thousands of hours advocating for other victims. Many of the basic principles behind myTruston were based on both of these personal experiences.

What you get with myTruston is a "piece of mind" that if you have to protect yourself from identity theft -- your information isn't being exposed in another place -- where it might be compromised.

Preventing identity theft using myTruston is and always has been free, you only pay for the recovery services, if and when you need them.

Most identity theft services require that you provide them with all of your personal information, and in some instances, even your power of attorney.

With myTruston you can protect your identity, and if need be, recover from identity theft without giving up your information to a third-party.

With call centers being outsourced -- the possibility of insider theft, and hacking techniques that seem to routinely defeat current security technology -- this might be something to think about when protecting your identity and financial well-being.

All identity theft services bundle free services that theoretically could be done for free. It's a low overhead and immensely profitable business. The trick to it is making sure you do everything properly, and this is where a third-party service can add value.

The unique twist with Truston is that it's free to prevent identity theft and you only pay to recover from it. In other words, you don't pay for something that might never happen to you, which seems to be a common denominator with a lot of the services out there.

Many of the services out there charge $10.00 and up a month to protect you, which is free at myTruston. Many of them (also) do not cover you if you were compromised before you paid for their services (read the fine-print).

What Truston provides is an easy do-it-yourself (DIY) platform that makes it easy for the average person to ensure they are not being compromised, and take effective action if they have been.

Truston recently announced they were upgrading their service and lowering the cost of their paid (recovery) service. The paid portion of the service only needs to be used as long as the customer feels it is necessary.

Here is a portion of the announcement from their blog:

This week we released a new version of our award-winning myTruston service. The new features are FREE to current members for a 45–day free trial period. These four new prevention and privacy services are:

1. Credit bureau fraud alerts
2. Chexsystems fraud alerts
3. Stop pre-approved credit offers
4. Stop telemarketing calls

We updated our product names: we now have myTruston Free and myTruston Plus. myTruston Free has the same features since we first launched (inspecting your credit reports year round). myTruston Plus includes what you get with Free, the four new prevention/privacy features, and our ID theft recovery tools. Also, the price for the Plus service is reduced 50% to just $10 a month!

What I like about these new features is they begin to address the growing problem of synthetic identity theft. Synthetic identity theft occurs when different parts of people's identity are crafted to form another one. This is getting to be a big problem, which is expected to get worse.

In the near future, employers will have to take action when they have employees, who have social security numbers that don't match their names. In the past, this was never enforced, and social security numbers could be made up (literally).

With this new development, up to 20 million illegal immigrants are going to have to use social security numbers that match an identity. This could lead to an explosion in the already staggering amount of identity theft that is occurring.

Watching your identity carefully, is probably a better idea than ever before.

The Chexsystems alerts are a part of this new effort. Fraudulent checks that tie into identity assumptions do not always show up on credit reports.

In case you missed the Certegy data breach, where 8.5 million people's checking account information was compromised, this might be something that will help a few people out there. Please note this compromise was accomplished by a not very honest insider, therefore no amount of computer security could have stopped it.

Two other enhancements are the ability to put yourself on the no-call lists and stop all those pre-approved credit offers. Most privacy experts recommend we do this to avoid having our information sent all over the place.

Tom, whom I speak to on a semi-regular basis, has indicated that he and his team are working on even more enhancements to provide more value to his service in the future.

They are also working with industry partners to bundle their services and provide them as an option to a wider audience, who might want to a take a more private approach to preventing, or recovering from, identity theft.

I would highly recommend getting in touch with Truston if you are providing these services to your employees, or perhaps considering providing them to your customers.

Victims of identity theft are sometimes cautious about giving up their information after they've been victimized. MyTruston provides a viable solution for these customers, as well as, customers who are careful about protecting their privacy.

For the full announcement, which includes a free trial period for current customers on the paid services (you don't have to provide a credit card number, then remember to cancel)link, here.

I've noticed this is another neat marketing trick (requiring a credit card) employed by a lot of entities offering services for free lately. I suspect they count on busy and forgetful people like me, who forget to cancel the service.

PS: I got to know Tom from his blog and work as an advocate for identity theft victims. If you are interested in identity theft or privacy issues, I highly recommend you consider it as another free resource, he provides.

0 comments

Russian identity thieves target the rich and famous

Photo courtesy of CarbonNYC at Flickr

An interesting story hit the news this week about some Russian identity thieves targeting the rich and famous.

The ringleader was talked into meeting Federal Agents in the Dominican Republic, then entered the country (he believed illegally) and was arrested. Not very bright, especially given the clout of his intended victims.

Tom Fragala at the Truston Blog had some interesting and well thought out commentary about how the less rich and not so influential might be targeted in a caper like this.

In Tom's own words:

ID thieves going after the ultra-rich or celebrities is nothing new. That is not what makes this story interesting to me. It’s that the “ring” of thieves showed a bit of ingenuity in how it targeted the victims. The ring leader allegedly did public records searches such as home purchases. That’s right, if you purchase a home, then tremendous amounts of information about you is made available to anyone for a small fee. The law requires the information is made public via a UCC filing (uniform commercial code). Then using that information, such as the bank listed on the mortgage documents, and piecing together parts of your identity from other places, your financial accounts might be able to be compromised. In other words, if the thief knows your brokerage account is with Wells Fargo, the thief can then pose as you to authorize a withdrawal. Perhaps a wire transfer to Russia, Vanuatu or Nigeria.

And your bank is not necessarily going to come riding to the rescue and return your funds because, well, “they have to, right?” Not exactly. Can you name the US federal statute that provides consumer fraud protections for your brokerage or home equity account like FCRA does for your credit card? Don’t waste your time, it doesn’t exist. What about the Federal Trade Commission, don’t they help you? Nope, they have no jurisdiction. Banking oversight is handled by a hodge podge of agencies depending on where and how your bank/credit union is chartered.

According to the story, the information to do this was data mined online (probably from a County or State website).

Too much personal information being stored on government sites is a huge problem. Recently, I did a post about Betty Ostegren a.k.a. (also known as) the Virginia Watchdog. Betty actively goes after State and County governments, who leave information on their sites that could be used to commit identity theft, or worse. Although, a lot of sites have pulled some of the information off their sites, it's still a major problem.

When I was working on the post, Betty was able to show me how she has been able to view the personal information of a lot of prominent people from the comfort of her home.

In this instance, the crooks were caught, but the amount of money they almost got away with is scary.

Truston blog post, here.

Tom is the CEO of Truston, which is the only identity theft detection/recovery service (that I know of) that doesn't require you provide all your personal information to them. They are also unique in the fact that their detection (prevention) services are free.

A lot of identity theft services out there require you to surrender all your information and even give them your power of attorney.

As evidenced in the recent Certegy data breach, a dishonest employee, who has been given access to the information can compromise the best computer security. Besides internal compromises, external hackers seem to still be able to get into databases. TJX was recently compromised by hackers, who stole about 45 million personal and financial records.

A lot of their critics were quick to point out that they shouldn't have been storing some of this information in their proprietary databases.

Interestingly enough, one of main principles of PCI (Payment Card Industry) data security standards is to not store information in too many different places. These standards were set by the payment card industry to protect information, but as of this writing, not everyone has adopted them.

This is a Catch 22 (no-win) situation because (I suspect) many merchants store information to avoid chargebacks for fraudulent transactions.

I've often wondered how quickly this would all get fixed if compliance was mandatory to accept debit/credit card transactions?

Storing our personal and financial information in too many places is probably one of the root causes of the problem with data breaches.

0 comments

An Identity Theft Protection and Recovery Service Based on Trust

The new identity theft protection and recovery service by Truston is live. The service is unique because it doesn't require you to give up your personal information, which could be stored in a database, and used to commit identity theft if it falls into the wrong hands.

In case you've missed the weekly stories, databases are being compromised all the time and according to the Privacy Rights Clearinghouse (which is keeping tabs), 97,326,222 people in the United States have been compromised by data-breaches since February, 2005.

I probably need to make a disclaimer that this number might grow before I publish this post. Nonetheless, here are the ugly statistics as of this writing.

Tom Fragala, who is the CEO and a former identity theft victim himself did a great post on his blog describing the service:

myTruston is a web-based service that protects you from identity theft. It is simple and safe.

How simple? One minute sign up. And myTruston works by providing you a recipe-like format, one task at a time, for dealing with identity theft. That goes for both prevention and recovering from fraud.

Why is it safe? Because our members never send us any confidential personal information. All we need is your email address to help you. Every other prevention and recovery service requires you to give them your name, address, SSN, and even power of attorney.

What does it cost? Our prevention services will always be free! And our recovery services are free until January 2007.

We’re getting some nice kudos from people. You can see an updated list here. One example:

"Very slick. You're a genius for coming up with something so simple yet effective & helpful. I'll definitely spread the word." - Jed Tucker, myTruston member

The bottom line is that finally we have a resource where someone can protect themselves and recover (if they are victimized) without putting themselves at additional risk.

And even I had no problem "navigating" it!

Here's the previous post, I did about myTruston:

Truston - An Identity Theft Service I Trust

If you would like to check out myTruston, link here.

0 comments

Sears site violates people's privacy!

Ran into this story on the Truston blog. Tom Fragala, CEO of Truston writes:

The internet retailer you choose just might, without disclosure, install software on your computer to snoop on your web browsing. Brian Krebs at the Security Fix blog has this story. Would you believe it could be one of the country's oldest retailers though?

"Sears is having a bit of a rough day with the privacy community. The company got off to a rocky start with revelations that many customers who gave Sears their personal details after shopping at the company's Web site also were giving away their online Web browsing habits to marketers, thanks to snooping software silently installed (and ill-documented) by a Sears marketing partner."

Even worse, as revealed in Brian Krebs interesting blog post is that:

The discovery comes from Ben Edelman, an assistant professor at the Harvard Business School and a privacy expert whose research has done much to raise public awareness about the intersection of big business and shady advertising practices.

Sears offers no security whatsoever to prevent any user from retrieving a third party's purchase history, Edelman said, which violates its own privacy policy with such disclosures, no part of which "grants Sears the right to share users' purchases with the general public."

I guess this means that anyone can violate a Sears customer's privacy by using their website as a tool?

Please note that Professor Edelman has shown some pretty good evidence that regular and not just e-commerce customers can be compromised, also.

Going back to Professor Edelman's contention that snooping software was spying on customers -- spyware and adware are used on a lot of sites. In fact, I highly recommend scanning your system on a regular basis using reputable software. I'm always amazed at how much of it I find when I do.

My opinion is that that when information is data mined, there needs to be a transparent way a customer opts-in (authorizes) an entity to use their information.

Current opt-out options are often deceptive and laden with a lot of small print.

So far as Sears, until they disclose what they are doing to fix this (at least answer Mr. Krebs), I'm going to make sure I avoid using their shopping facilities!

0 comments

Advance Fee credit schemes steal from people who are already in financial trouble

A Florida scam artist has been caught after ripping off thousands of people in what is known as an advance fee credit scheme. The scam -- which targets a market segment known as the under banked -- offers credit to people, who wouldn't qualify for it, otherwise.

Although variations of advance fee schemes have been around for centuries, the global and anonymous nature of the Internet has enabled them to spread like a virus with the click of a mouse.

In advance fee credit schemes, after paying a large fee in advance, the people don’t get the credit and are out the fee.

According to the AP, the Florida man, defrauded low income people out of about $12 million in this recent arrest.

Although in this instance, credit cards were being offered, other forms of credit are offered in advance fee credit scams, also.

These scams are spread via spam e-mails all the time, but they also appear in more traditional advertising like newspapers and magazines. People are also often solicited by telephone.

Recently, the Truston blog commented about a New York Times story revealing that InfoUSA, a databroker, was selling lists of senior citizens interested in lotteries and sweepstakes. Lottery and sweepstake scams are rampant on the Internet.

I wonder how many other telephone lists are sold by data brokers, which help fraudsters market their scams?

The Federal Trade Commission (FTC) has a nice page explaining this problem, here.

Suspected activity can also be reported to the FTC:

The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint or to get free information on consumer issues, visit http://www.ftc.gov/ or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

Most scams do not make sense and are too good to be true. Paying a third-party to get credit is unlikely to change, whether or not, an individual qualifies for a particular financial product.

On a final note, it's also not wise to give out your information to someone you don't really know. Doing so, might lead to becoming an identity theft statistic.

AP story, here.

Truston blog post on New York Times article about data brokers selling telephone lists to criminals so they can "market" their scams, here.

0 comments

Another sad statistic, the Stop and Shop data breach

Last weekend, Stop and Shop (Quincy, MA) reported a data-breach at two of their stores in Rhode Island. After an initial investigation, they tracked the theft to two pin-pads.

Consumer Affairs has the most informative story (my opinion) on this current breach. They are reporting that with the assistance of the Secret Service, four more compromised pin-pads have been identified (all in the Rhode Island area).

Martin H. Bosworth makes an interesting point in his article that the United States hasn't been as proactive as our European friends in instituting new technology to stop debit/credit card fraud, such as chip and PIN.

Of course, implementing PCI data protection standards are not exactly 100 percent, either.

PCI data protection standards were implemented by the payment card industry, and even when they are violated, the only consequence seems to be that the merchant will be fined. The standards are designed to stop merchants from storing information they aren't supposed to.

Consumer Affairs story, here.

Of interest (in this case) is that (it appears) PIN pads were tampered with inside the stores, which makes me wonder if there is some sort of inside connection?

Tom Fragala (CEO, Truston Identity Theft Services) did a recent post on his blog, where he linked to a video on how easily a remote ATM machine can be compromised in a store, here.

Of note, Truston is the only service for victims (that I know of), where someone doesn't have to submit all their personal information to a database, which could be compromised, also.

This is a good video, but note the ATM was in a pretty concealed area, and I'm guessing that these pin-pads were in the check out lanes in stores?

Attrition.org and PogowasRight provide information on data breaches (frequently updated), here.

Someone should start a chronology of how many of the people stealing this information get caught. Unfortunately, the list wouldn't be very long.

*(Update): I must have missed that Attrition.org is recording arrests, but the results are not encouraging.

The most recent news about legislation to protect the people being victimized by this growing problem isn't good.

A recent article by Scott Bradner (Network World) about how special interests are preventing the passage of any meaningful legislation argues this point, eloquently:

The Leahey privacy bill: coddling the criminals?

0 comments

Tools to verify those too good to be true financial instruments you got in the mail

(Counterfeit check picture courtesy of cknlomein at Flickr)

There are a record amount of counterfeit cashier's checks, official checks, money orders, travelers and gift cheques in circulation. This is an attempt to pass on information that the average person can use to tell IF the item is real or a counterfeit (fake).

As a disclaimer -- this is only a guide and if you deposit or cash items from people you don't know -- you do so at your own risk. The quality of these items is getting better all the time.

I’ve put together a list of the known counterfeit items in circulation, along with the current telephone numbers to verify them. You will probably receive these items after being lured with a (too good to be true) get rich quick scheme that doesn't make very much sense.

The best method to verify an item is to go to the maker, or issuer of the check (cheque). They probably will know if they issued it. The key here is to make sure you are speaking with the real issuer (maker) of the item.

Never trust a number provided on the instrument, fake telephone numbers are sometimes set up that will even verify in 411 (information).

Simply stated, as long as the communication companies think they are being paid, setting up a fake number is no problem. We are seeing fake numbers set up by scammers pretty frequently.

Since these numbers are often set up in 411 (information) rather easily, I recommend using Phonevalidator.com. This site provides a service that shows if a number belongs to a cell, or a land line. It also provides telephone directory and Google results for the number queried.

Quite often, fake numbers set-up to verify checks are cell phones.

The Internet is a good way to find the true issuer (maker) of an item. The key is to make sure you are visiting a legitimate site.

Fake websites (especially those pretending to be financial institutions) are a growing problem, also. An easy way to check if a site is legitimate is by using TrustWatch, which verifies whether a site is known (trusted) or not.

If you are interested in taking a look at some fake sites, claiming to be financial institutions the Artists Against 419 has some great examples of them on their site.

A common denominator in most of the scams is that there will be a request to send the proceeds, minus your paltry cut (normally via wire transfer) back to the person sending you the instruments. That is (unless) they are buying goods from you. In this case, your property is what they want you to send to them.

Some of these lures include, but aren't limited to (new lures surface frequently), secret shopper, romance, lottery, work-at-home and auction scams.

The National Consumers League recently set up a site (fakechecks.org), which is a great reference on Internet scams involving checks (complete with visual presentations), here.

So far as auction scams, eBay will no longer offer any protection for paper financial instruments on their site.

Here are some of the known items being counterfeited in large quantities and literally circulating worldwide:

Visa Travelers Cheques: 1-800-227-6811.

MoneyGram Money Orders (counterfeits may still use the old Travelers Express logo): 1-800-542-3590.

US Postal Money Orders: 1-877-876-2455 (mail fraud) option 4, then go to option 2.

American Express Gift and Travelers Cheques: 1-800-221-7282.

FDIC Alerts on the counterfeit cashier's and official checks in circulation, here. There is a feature that allows you to search them. I would try it by using the name of the institution.

Counterfeit cashier's and official checks change almost daily. The counterfeiters use legitimate account numbers and convincing looking check stock that will verify in most automated telephone verification systems.

It's probably good advice to never trust an automated system. In the case of a counterfeit, real ABA/account numbers are used by the counterfeiters. Because the information is real, they get past an automated verification system fairly easily. If you really want to know and believe an item is a counterfeit, ask to speak to a live person, preferably in the fraud department.

If you are dealing with a suspected counterfeit cashier's, or official check, I highly recommend reading a post I collaborated on with Tom Fragala (CEO of Truston Identity Theft Protection Services):

Counterfeit Cashier's Checks Fuel Internet Crime

Bank employees sometimes verify counterfeit instruments as legitimate. In some instances, especially at a teller window, they have been mistaken. If this occurs, you will be notified days later and the bank will take no responsibility.

Even more alarming, I have talked to and get comments/e-mails from people all the time who are getting arrested after trying to negotiate these items.

Here is what I wrote about this growing phenomenon in a previous post, along with my personal speculation as to why this is happening more frequently:

When the check is discovered to be fraudulent, anywhere from right on the spot to about ten days later the person passing the item is left holding the bag. This can translate into a loss of their freedom (getting arrested), being held financially liable, or a combination of both these consequences.

The real victims can probably blame this new phenomenon on all the criminals, who are pretending to be victims and then cashing the items themselves. Here is how I described this in a recent post, where an International task force discovered millions of dollars (face value) of these items destined to be shipped, worldwide:

A new trend has been noted called reverse-scamming, also. This occurs when scammers have the bogus instruments sent to them, cash them and then never follow the instructions to wire the money.

If confronted, these reverse scammers will normally claim to be victims. A key way to pick out a reverse scammer is that, in most instances they forget to wire the money back to the scammer that sent them the counterfeit instrument.

0 comments

TJX class action settlement only addresses about one percent of the total people compromised

Friday evening, MarketWatch announced that TJX -- who suffered a data breach compromising over 45 million of their customers --has agreed to settle the class action lawsuits that were filed against them after the data breach was disclosed.

The class action lawsuits referred to were filed in both the United States and Canada.

Since most of the financial losses have been incurred by financial institutions -- who had to reissue the compromised cards and settle the fraud claims -- this settlement appears to primarily address the customers compromised by the breach of TJX's refund database.

This would amount to about 455,000 people, or one percent of the total number of people compromised.

Another issue that is still pending is how information is stored, and who will be responsible for paying for the administrative costs arising from data breaches in the future. Consumers Union is pushing that one of these bills, already passed in California, be signed into law. Minnesota has already passed legislation that addresses this.

MarketWatch reports:

Under the settlement, which is subject to court approval, TJX will offer three years of credit monitoring and identity theft insurance to customers who returned merchandise without a receipt and to whom the company sent letters reporting that their driver's licenses or other identifying information may have been compromised.

TJX will also reimburse the customers for documented costs of certain license replacements and certain losses from identity theft if identification numbers compromised were the same as their Social Security numbers.

The company will hold a one-time three-day customer appreciation event, in 2008 or later, at which prices will be reduced by 15%.

One thing that concerns me is that the settlement offer states that one of the requirements to receive compensation will be that the identification number compromised has to match their Social Security number.

I guess that TJX and their affiliates don't want to address the rising phenomenon of synthetic identity theft? When synthetic identity theft is committed different parts of a persons identity are crafted to create a new one.

Stephen Coggeshell of ID Analytics was recently quoted as saying:

Five years ago, this crime was hardly seen. Eighty-five to 90 percent of identity fraud is really this synthetic ID fraud, as opposed to the true name identity theft.

Just because the identity and the Social Security number were not compromised together doesn't assure that that the person involved will not become a victim.

This led me to wonder how many Social Security numbers could have been compromised? The answer was right on a FAQ sheet on the TJX site:

We do not receive or store customer social security numbers per se. However, the drivers' license or military ID numbers customers provide us in unreceipted merchandise return transactions are, in some cases and in some states, the same numbers as their social security numbers. We are writing directly to customers we were able to specifically identify whose drivers' license, military or state ID numbers, together with their names and addresses, were found in the information believed compromised and identifying where we believe those numbers may be social security numbers.

Laws have been passed that prohibit the practice of placing Social Security numbers on identification documents.

In the identity theft world -- which is what the concern about this data breach is all about, when a SSN or SIN (in Canada) is compromised -- the criminal compromising the information has all the information necessary to complete a full identity assumption.

In the dark world of Internet forums that sell this information, a complete identity (SSN, or SIN included) is often referred to as a "full." The complete information on a person is simply worth a little more money to the criminals purchasing it.

Retail criminals, who causes billions in losses a year, often refund the merchandise to launder the proceeds of their efforts into cash. This was the very reason -- most retailers implemented databases to track the information of people, who show up at refund desks -- a little too frequently.

With the increasing availability of fake identification and bogus financial instruments -- already being used at retailers to steal merchandise, with a focus on high-value items that are locked up -- it's likely that a lot of the information in these databases isn't completely accurate.

I would guess that the same people, using the bogus financial instruments, purchase the merchandise with them and then head to the refund counter.

So far as the TJX offer to settle this portion of their liability, it still has to be accepted by the court. Of even greater importance is that retailers need to take a hard look at how these refund databases are protected -- and -- whether or not, they are as effective in stopping refund fraud as they used to be.

For more information on the issue of using Social Security numbers on identification documents, the Privacy Rights Clearinghouse has a document, here.

The University of California submitted an interesting document to the Federal Trade Commission on the subject of synthetic identity theft, which can be seen, here.

Last, but not least, Tom Fragala at Truston put together a pretty neat blog post with a lot of references about synthetic identity theft, here.

0 comments

TJX's stolen data is being used - 200,000 accounts identified, so far

My guess is that the recent TJX data breach will prove to be the largest on record. Several sources are already reporting data from this breach is being used to commit fraud.

The Boston Globe is reporting:

The Massachusetts Bankers Association said yesterday that several banks reported fraud linked to debit and credit card numbers pilfered from TJX's computer system for unauthorized purchases made in Florida, Georgia, and Louisiana in the United States, and Hong Kong and Sweden overseas.

Middlesex Savings Bank is reissuing at least 20,000 Visa debit cards and had about a dozen suspected cases of fraudulent activity as far away as California and Japan, bank officials said. The bank said it costs at least $5 to replace a card, and many of the fraudulent charges were occurring at gas stations, discounters, grocery stores, and Internet merchants.

Boston Globe story, here.

This is likely the "tip of the iceberg" because a majority of the affected institutions haven't reported in yet.

Meanwhile up North, thousands of Canadian citizens have been affected. CTV is reporting:

Fraudulent activity has been confirmed on the accounts of thousands of Canadian credit-card holders who had their information stolen during a security breach at the U.S. parent company of Winners and HomeSense.

CTV story, here.

My advice is that if you have shopped at a TJX company recently - watch your statements, carefully.

Especially, if you have a debit-card. Debit cards aren't protected as well as credit cards. Tom Fragala (Truston Identity Theft Services) has a great post on his blog about this, here.

Tom developed this service from a victim's standpoint and has helped many victims, both personally and with his well-known commentary on the subject.

If you are a victim - I can personally recommend his services - which don't expose your personal information (again), also.

Here is my previous post on the TJX data breach:

TJX named as point-of-compromise in International …

0 comments

Facebook invokes the opt-out defense when accused of privacy violations!

FaceBook, the much talked about social networking site, has received a lot of bad publicity recently.

Despite their immense popularity, personal information published on the site has been used to commit everything from identity theft to abusing children.

Hackers are also using the site to drop malicious software on unsuspecting visitors. This leads to even more privacy violations and in many instances, identity theft and financial crimes, also.

Now they are under fire for a marketing scheme, which posts what their members just purchased all over the electronic universe (Internet).

Kimberly Palmer also known as the "Alpha Consumer" at U.S. News and World report recently documented her sister's frustrations with this practice.

In her own words:

This past weekend, after my sister found a great pair of Dansko clogs and ordered them online from Zappos.com, her Facebook friends received a newsfeed message that told them she had just "found something cool at Zappos.com." Since she hadn't planned on announcing her purchase to so many people, she quickly deleted the message but not before feeling that her privacy had been invaded.

It turns out Facebook has relationships with online retailers, including Zappos.com, Fandango.com, and Overstock.com, that allow the social networking site to post information when purchases are made. My sister isn't the only one upset by it; the liberal group MoveOn.org started a petition asking Facebook to respect users' privacy and stop the practice. The blog Binary Freedom has asked Facebook not to ruin the holidays by alerting people to their gifts ahead of time.

Facebook has defended their right to do this by saying that a member can opt-out from having their personal shopping habits disclosed in public.

I always chuckle when the words "opt-out" are used as a defense to justify a violation of privacy.

The financial services industry has been sending us snail mail for years that are called privacy notices. These notices, which are full of small print make a mockery of the meaning of privacy (my opinion). If you fail to respond to these letters, they can and will sell your information to the highest bidder.

Of course, in most of these instances, the institutions involved don't make it easy to respond to these notices.

The problem with opting-out is that the current laws make it too easy to opted right back in.

Opting out is like playing a game of "Whac a Mole," because whenever you conduct a transaction, you might be opting-in again.

Tom Fragala at the Truston blog recently chronicled his frustrations in a post entitled, "Opting-In After You Have Opted-Out." In this post, Tom writes about a personal episode where he was targeted by identity thieves and opted-out, only to be opted-in again.

He also did a follow-up post, "How Direct Marketers Get You to Opt-In After Opting Out," which shows how marketing people have gotten past opt-out legislation in general.

There is little doubt that opt-out laws need to be updated. I wonder if the law were changed so that people had to give their permission for a company to sell their information, we might see a marked decrease in criminal activity enabled by information that is too easy to access!

Sadly, the people making too much money by exposing it for marketing purposes don't seem to want to become more responsible. And as long as they have a lot of money to fuel special interests, the problem isn't going to disappear very quickly!

Kimberly Palmer article, here.

Wikipedia has an interesting article going into detail on all the privacy concerns with FaceBook, here.

12-2-07 (Update): It appears FaceBook is changing their policy on opt-out to make it more user friendly and transparent. Here is a story from the LA Times on the changes, which privacy advocates are claiming as a major victory:

Facebook adds safeguards on purchase data

0 comments

Walmart Employee Scams Customers via Electronic Checks

Processing checks electronically is becoming a standard practice, brought about the Check 21 law, or ACH (Automated Check House) processes.

Electronic checks save businesses a lot of money in processing costs.

Walmart is one business taking advantage of electronic checks - and when a check is written to Walmart - it's scanned in their point-of-sale system - then returned to the customer. From there, everything is handled "electronically."

I read a story put out by KRTK Houston about a Walmart employee, who scammed a customer by keeping the check (supposed to be returned), then used it to purchase merchandise and gift cards numerous times.

KRTK Houston story with video presentation, here.

When the customer noticed the fraudulent transactions on her account, she reported it to the Walmart and the employee was arrested.

The story also indicates that there are other victims out there that haven't been identified yet.

According to the story, the customer isn't being made whole by her bank because she didn't discover the transaction within thirty days and Walmart isn't refunding her money, either.

When check fraud occurs, victims are normally made whole by their bank, who goes after the business by charging them back for the transaction. If a business refunds the customer for their losses, the customer might be able to have the transactions charged back to them, also.

My guess is that Walmart isn't refunding the money because the bank still might charge-back the transactions to them?

Of note, it's probably not completely fair that Walmart is the only one being mentioned in the article. There is no mention of what bank is involved. I hope Walmart and the bank have since sorted this whole thing out and taken care of the people, who were victimized as a result of this.

After all - it only makes sense to do so - processing checks electronically saves them a lot of money by not having to process paper and if more stories surface (like this one), it's likely to affect "consumer trust."

I read consumer tips all the time that we should use our credit cards versus debit cards because they offer better protection in the case of fraud.

Tom Fragala (CEO of Truston) wrote a great post about this, here.

0 comments

Will Heartland Become the Largest Data Breach in History?

According to a press release from Heartland Systems, a payment card processor, their data has been being compromised since sometime last year. On the site, Heartland set up to cover the incident, it says they promptly notified the Secret Service and hired two teams of forensic computer investigators to look into the case after they discovered their systems had been compromised.

Heartland was initially notified by Visa/Mastercard of suspicious activity, which led to malicious software being discovered in their system. The malware in question was harvesting and (obviously) transmitting data. In the press release, they state they believe the breach has been contained. Heartland claims no merchant data, social security numbers or unencrypted PINs were compromised. They were also quick to add that their check management systems, Canadian payroll, campus solutions, micropayments operations and recently acquired Network Services and Chockstone processing platforms had not been compromised, either.

It should be noted that in previous breaches, additional items were later discovered to have been compromised as the investigation progressed.

Brian Krebs at the Washington Post interviewed Robert Baldwin, Heartland's president and chief financial officer, who stated they don't know how many transactions were compromised. In the interview, Baldwin pointed out that since the card numbers compromised didn't have address information; it would be hard for fraudsters to use them in card-not-present (e-commmerce) transactions. Most e-commerce platforms validate the address tied to the card as a security measure. I thought about this for a second and remembered that Visa/Mastercard had warned Heartland about suspicious transactions. If there were suspicious transactions, I would deduct someone is using this data to commit fraud. Besides that, I doubt anyone sophisticated enough to pull this off would go to all this trouble (and potential legal exposure) if they couldn't use the information to make money. This is another thing that might suggest additional information will be discovered as the investigation progresses.

In the interview, Baldwin declined to name any of their customers, who were compromised. Heartland processes payments for about 250,000 customers and processes about 100 million transactions per month. He also said they will not be offering identity theft protection since not enough information was stolen to commit identity theft.

On the Truston blog, Tom Fragala, aptly pointed out that this equates to four billion transactions a year. Many are speculating that this will turn out to be the largest known data breach in history. Tom's company, which offers a privacy-friendly identity theft prevention and recovery service, offers a 45 day free-trial of their services. Even after the 45 days, the prevention part of the service is free.

Tom blogs on matters like this and wrote an interesting article pointing out the consumer protection features of debit and credit cards. Please note, debit cards offer less protection. The point is that if a card owner doesn't discover the fraud in a specified time period, they can be held liable for the financial loss. It's probably a good time for everyone to pay attention to their statements, carefully.

Given the mandatory notification laws, which have been passed in almost all 50 states, this is going to equate a lot of people that have to be notified. Simply stated, it's going to be a "notification nightmare." It should be noted that shutting down all the compromised cards and notifying victims is a substantial cost in any data breach.

SC Magazine also covered the story and got a quote from Rich Mogull, founder of IT security consultancy Securosis, who pointed out there is a trend of malicious software being planted somewhere in the processing system in all the high-profile data breaches seen in recent history. TJX (94 million cards compromised), Hannaford and CardSystems (40 million cards compromised) are all being cited as examples.

According to Visa, Heartland was validated as Payment Card Industry Data Security Standard (PCI DSS) compliant on April 30, 2008. They then stated this status was being reviewed. Trustwave is Heartland's PCI assessor. Hannaford was PCI compliant at the time they were compromised, also. According to the article in SC magazine, TrustWave wouldn't return calls to comment on this.

On the Heartland site, it mentions they are a founding supporter of the Merchant Bill of Rights, which advocates for and educates merchants on fair practices when they accept payment cards. Two of the biggest heartaches for merchants accepting payment cards are the interchange fees and becoming PCI compliant, which is considered an expensive process. Interchange fees are a tariff charged by the credit card companies on every transaction and according to the critics are not very equitable. Estimates have been made in the past that they equate to $30 billion in extra fees added to the cost-of-goods sold with payment cards, yearly. Ultimately, these are costs are often passed on to the consumer.

So far as PCI compliance — which now seems to have been proven ineffective in at least two instances — the National Retail Federation has responded by going on record to challenge the card issuers on their requirements to store data. Because of the cost, a lot of merchants have been slow to adopt PCI data-security standards and the merchants who are not in compliance face fines by the payment card industry.

Storing this data is required to prevent the third headache merchants face when accepting payment cards, or what is known as chargebacks. Chargebacks are when transactions are charged back to a merchant account because of alleged fraud. The NRF contends that being forced to maintain the data to protect themselves makes it easier to compromise.

Heartland is being challenged for releasing this information during the inauguration, when it was less likely to be a hot story. Although this seems to be the case, we need to realize the stakes in data-breaches are high. In the last breach involving a card processor (CardSystems), the card-issuers stopped doing business with the company and the end-result was the company is no longer in existence. Also, it should be pointed out that Heartland wouldn't be the only company that seemed to be very cautious when disclosing the fact that their data was compromised. Once disclosed, there is little doubt that the company in question faces some extremely unfavorable public exposure.

On a closing note, data breaches continue to occur at alarming rates. All sides of the equation need to come together and figure out solutions that work. One of them might be to upgrade the plastic to chip and PIN technology, which has become the standard in other countries. Nigeria was the most recent country to mandate this technology. While this might not directly stop data breaches, it would make it a lot harder to counterfeit the plastic, which is what the criminals use to cash-out the proceeds of data breaches with.

The other problem is that credit card fraud has been made too easy to commit. Card data and the tools to produce counterfeit cards are easy to obtain and even sold in chat rooms. A lot of this technology can also be bought on (what I consider) questionable sites, including eBay. Very few of these fraudsters get caught and because of this; it appears that the activity is getting more and more organized. Historically, the cost of all this seems to have been written off as a cost of doing business. In reality, a lot of these "costs" are passed on to the consumer in the form of higher interest rates and fees.

My prediction is that with the state credit is currently in with the sour economy, coupled with the increase in criminal activity, we are getting to the point where it is going to be hard to simply write-off all the financial costs. Until we start punishing the criminals effectively for this type of activity, it is going to continue to grow and probably prosper.

Update 2/13/09: It appears that the first arrests in the Heartland Data Breach have been made in Leon County, Florida. Three men (Tony Acreus, Jeremy Frazier and Timothy Johns) were encoding numbers stolen in the breach on gift cards and using them at Walmart.

The official press release from the authorities credits Walmart for supporting the investigation.

While it's great a few people got caught -- this probably only accounts for a small amount of the stolen data. My guess is that our three fraudsters bought the numbers via anonymous sources (probably on the Internet).

0 comments