Can answering 2 simple questions on Facebook really give ID thieves the key to figuring out your SSN?

No.  Despite an article I just read on Cincinnati's Fox19.com.  This is just not accurate, or at least not in the manner in which Fox19.com claims.

According to Fox19.com, truthfully answering the Facebook profile questions regarding where you were born and how old you are gives identity thieves enough information to reverse engineer your Social Security number.  While the answers to those questions might accidently help an identity thief guess your SSN, its not that much help and not for the reasons Fox19 claims.

The Fox19.com article claims that the first three numbers of your SSN are based on where you were born.  If that were true, then, yes, correctly providing the city and state where you were born would help ID thieves guess the first three digits of your SSN.

BUT ... the first three digits are not based on where you were born but instead are based on the zip code given on your SSN application.  So it could be in the state where you were born.  But in many, many instances, that's not so. 

For instance, I was born in Louisiana.  At the time that I was born, my parents and siblings lived in Arkansas.  However, we moved to Mississippi when I was four years old and, after moving to the Magnolia State, my parents applied for my SSN.  So the first three digits of my SSN match one of the various sets of 3 digit numbers for Mississippi, not Louisiana where I was born or Arkansas where my family was living when I was born.

Another example - my wife was born in Tennessee but her family lived at the time in Mississippi.  Apparently, her parents also applied for her SSN in Mississippi, because the first three numbers of her SSN also match one of the 3 digit Mississippi combinations, but not the same 3 digit combination that I have.

So its simply not as easy as knowing where you are born.

As for the second part of your SSN, called the grouping, correspond to when you applied for your SSN, which does not necessarily relate to when you were born.  For instance, my grouping would be approximately 4 years after I was born.  My daughter's SSN was also not requested when she was born but years later.  Some people get their kids' SSNs as soon as they are born only to lose them later and have to do it all over again.

So feel free to be honest on Facebook about where and when you were born, unless of course you don't want the internet knowing how old you really are.

A new low

Can you believe this?  A total of six identity thieves plead guilty recently to stealing the identity of more than 50 residents of Maryland, which resulted in the theft of more than $200,000.  The scheme involved defrauding banks in Maryland and five other states and the withdrawal of money from people's personal bank accounts.

Here's the shocking part.  The identity thieves followed funeral processions in order to rob cars parked at cemetaries of credit cards, driver's licenses and social security cards.  They aslo broke into cars parked outside churches, gyms, day care centers and parks.  How brazen and low down is that?  Imagine going to a loved one's funeral, already the victim of grief, only to be victimized again by unscrupulous identity thieves?!
The identity thieves used the information from the stolen cards to get information on personal accounts from banks. Prosecutors said one of the suspects worked at a bank and helped his friends get checks made out to the men in the scheme. The men would then visits the victims' banks and impersonate the people on the cards, sometimes putting on wigs, prosecutors said.

Sickening.

Site steals 250,000 Facebook profiles to raise awareness of online ID theft

Interesting way to raise awareness of the risks of online identity theft - article is by Michelle Castillo and can be found at http://techland.time.com/2011/02/04/site-steals-250000-facebook-profiles-for-a-social-experiment/

You might be signed up for Lovely-Faces.com's dating services and not only know it. Website creators Paolo Cirio and Alessandro Ludovico took information from 250,000 Facebook users and used it to create their project which uses facial recognition technology to categorize users into the kinds of people they look like they would be. Problem is they didn't ask permission first from the profile owners, but they claim since it's part of a "social experiment" it should be fine.

The site's not really a dating site. On Face to Facebook, the minds behind Lovely-Faces.com explain that the website was created to prove how virtual identity is increasingly unstable when you consider how easy identity theft is online and how companies can easily take advantage of this information, with or without Facebook's permission. On the Theory section of the website, they elaborate:

And it'll eventually mutate, from a plausible translation of real identities into virtual management, to something just for fun, with no assumed guarantee of trust, crumbling the whole market evaluation hysteria that surrounds the crowded, and much hyped, online social platforms.

Facebook isn't pleased with this use of their data, even though Lovely-Faces.com promises that they will remove anyone who wants their picture taken off the site. “Scraping people's information violates our terms,” Facebook's director of policy communications Barry Schnitt said to Wired. “We have taken, and will continue to take, aggressive legal action against organizations that violate these terms. We're investigating this site and will take appropriate action.”

Google sponsoring contest to strengthen Chrome against identity theft hacks

Google is sponsoring a $20,000 hacking contest for the purpose of testing the defenses of Chrome, its internet browser, against identity theft hackers.  This year's hacking contest is called "Pwn2own".  The first researcher who is able to exploit Chrome will receive a prize of $20,000.

Pwn2own participants will also attempt to exploit Windows 7 or the Mac OS X, as well as web browsers Internet Explorer, Firefox and Safari.  The first Pwn2own participant who is able to hack Internet Explorer, Firefox, and Safari will receive a prize of $15,000.

The purpose of Pwn2own is for Google to learn any weakness in Chrome's defenses before it can be  victimized by hackers and other individuals involved in identity theft crimes, which could cost Google millions.
The benefit of Pwn2own is that it gives Google the opportunity to identify Chrome’s weaknesses in dealing with hackers and indent theft offenders now rather than later.

New feature

Just added a new feature to the blog.  Its called a "flag counter" and its located on the right hand side of the blog.  Basically, it tracks the people who visit this site and sorts them by their country's flag.  Wish I had found this little gizmo earlier, as I have seen people from all over the world visit this site, which I always thought odd for a site dedicated to a law that has no effect outside the boundaries of the United States. 

So don't think there have only been folks from the U.S. visiting this site.  I predict within a week that there will be multiple countries identified on the flag counter.

Below are the contents of a letter I received yesterday from Elizabeth Warren, Assistant to the President and Special Advisor to the Secretary of the Treasurey on the Consumer Financial Protection Bureau (CFPB) that was created in the first portion of President Obama's term.  Apparently, they are hard at work getting the CFPB up and running.

Dear Colleague,

In July 2010, Congress created a new federal agency to protect American consumers. The Consumer Financial Protection Bureau will be a cop on the beat, working to make consumer financial markets work better for American families. As the first new consumer agency of the 21st century, we can communicate directly with the people we serve.

Today, that work is just beginning. We’re moving quickly—building a terrific team, finding office space, and unpacking a lot of boxes.

Things aren’t all in place yet, but we don’t want to delay reaching out to the people who care about this agency. We’re excited to announce the launch of our website, ConsumerFinance.gov, for one very important reason – to start a conversation with you. With the launch of our site, we will be Open for Suggestions.

We hope you are eager to learn what this new agency will do and how it might affect you. In turn, we are definitely eager to hear what you have to say. Starting today, you can use the Internet to send us your best suggestions and questions for the bureau:

If you have a video camera, record a YouTube video and upload it as a response to our welcome video at http://www.youtube.com/CFPB.

If you like Twitter, tweet your suggestion using the hashtag #CFPB. You can also follow us at http://www.twitter.com/CFPB.

If you are on Facebook, you can “Like” us at http://www.facebook.com/CFPB, and post your suggestion on our wall.

If you want to use our website, you can post suggestions at http://www.consumerfinance.gov/openforsuggestions.

In the coming days and weeks, staff who are building this new agency will record direct video responses to some of the most frequent questions and most interesting suggestions. You’ll see the faces and meet the people who come to work every day to make a difference for the American people. We look forward to getting to know a little more about you, too. More is coming, so be sure to check back at http://www.consumerfinance.gov/openforsuggestions throughout the coming weeks.

Open for Suggestions is just one way that we plan to keep our conversation going with you. Be funny! Be creative! Most of all, be real about what matters to you. This is a great chance to go into your community with a camera, laptop, or mobile phone, or just a pen and paper, and help others participate. Involve your friends, your family, your colleagues and classmates, your faith community, and anyone you know who might be counting on this agency for information and help.

If you aren’t ready with a specific comment, that’s OK. Just let us know you are there—and stay in touch.

We can’t do it without you.

Thanks,

Elizabeth Warren

Go to their new website and make your concerns heard.

Has Yahoo's Bing been stealing Google's identity?

Being a lifelong fan of both baseball and following politics, I often read the blog postings of Nate Silver, who started out as a baseball statistician but began using his analytic ability to predict the outcome of elections through analyzing various political polls.  His blog started out on its own but is now a part of the NY Times website.  He recently posted the following, which I found interesting and hope you do too:

I certainly do not have any expertise in Web search. I can claim some, however, in another area that is highly relevant to it: trying to optimize the performance of statistical algorithms.


In my case, the algorithms are designed to predict the outcome of elections. FiveThirtyEight’s algorithm to forecast U.S. House races, for instance, considers several different “ingredients”– like polls, fund-raising data, and demographic data — and mixes them together in such a way as to maximize the accuracy of the forecasts. Although there are a few nuances one needs to consider, for the most part this is based on which combination of ingredients would have produced the best forecasts in past elections.

Search is similar. The search engines are trying to predict the relevance of the results generated by each query. (How is relevance determined? Basically just by what a human being finds most relevant, which can be measured either through objective data, like how many clicks each link generates, or through testing that asks users for a subjective evaluation of the quality of different results.) There are different inputs that the search engines can consider to rank results — for instance, the text contained on each Web site, its traffic statistics, and the behavior of previous users of the search engine — and they can mix these in different ratios depending on what seems to do be doing the best job of maximizing performance.

A big controversy erupted Tuesday in search: Google accused Microsoft’s search engine, Bing, of cheating off of it. The rather clever way in which they determined this is by manually inserting nonsensical results in response to nonsensical queries. For instance, in response to the gibberish string of characters “uegosdeben1ogrande,” Google rigged its algorithm to return a link to a site selling hip-hop jewelery as the “best” response. This could not plausibly be arrived at unless another search engine were using Google’s results as one of their ingredients. But for several of these queries, lo and behold, Bing returned exactly the same results that Google did.

Microsoft has not really disputed the claim — instead, they’ve said that it’s not such a big deal. Yes, Google search results — which it obtains by tracking the behavior of people who use its Internet Explorer 8 toolbar, perhaps along with other means — are one of the inputs that Bing uses, Microsoft says. But it also uses more than 1,000 others. The reason that Google’s results appear verbatim in response to nonsense queries like “uegosdeben1ogrande” is because in such a case, only the Google results are “relevant”; the other 999 variables don’t shed any light on the problem.

Let me try to referee this dispute. I’m not going to weigh in on the legality or even necessarily the ethics of this — I’m just trying to consider what makes for better search.

Microsoft’s defense boils down to this: Google results are just one of the many ingredients that we use. For two reasons, this argument is not necessarily convincing.

First, not all of the inputs are necessarily equal. It could be, for instance, that the Google results are weighted so heavily that they are as important as the other 999 inputs combined.

And it may also be that an even larger fraction of what creates value for Bing users are Google’s results. Bing might consider hundreds of other variables, but these might produce little overall improvement in the quality of its search, or might actually detract from it. (Microsoft might or might not recognize this, since measuring relevance is tricky: it could be that features that they think are improving the relevance of their results actually aren’t helping very much.)

Second, it is problematic for Microsoft to describe Google results as just one of many “signals and features”. Google results are not any ordinary kind of input; instead, they are more of a finished (albeit ever-evolving) product, one which itself is made up of hundreds of different “signals and features”, which have already been combined together in such a way as to maximize performance in response to the exact same queries that Bing is getting.

Imagine that you opened an Italian restaurant across the street from Mario Batali’s Lupa. It would be one thing if you merely took inspiration from Lupa’s spaghetti carbonara — if you tried to use some of the same ingredients and some of the same techniques. Maybe you’d even go so far as to track down the butcher who sells Mr. Batali his pancetta. All of this would be in the spirit, most of us would think, of good ol’ American competition.

But this is more like, when a customer orders the carbonara, sending a runner across the street to order a plate of it at Lupa, reheating it, and then maybe adding some mushrooms or snow peas. The alterations you made to the dish, whether slight or substantial, might not be all that likely to make it better: it would be hard to improve on Mr. Batali’s carbonara (if peas really made the dish yummier, wouldn’t he already have included them in the recipe?), just as it would be hard to improve on Google’s search results.

There are certainly cases, of course, in which a finished product can made better. In the algorithms that we use to forecast U.S. House races, for instance, one of the inputs is the race ratings (such as “toss-up” or “leans Republican”) generated by outside agencies like Cook Political and CQ Politics. These, essentially, already constitute finished products, since these groups are already trying to weigh a number of different factors together to optimize them.

What we’ve found is that the ratings generated by these groups are very good, and that it would be hard to improve on them by using statistical inputs alone. (This is not the case for Senate or gubernatorial races, where the polling is much more abundant and much more reliable, but it is the case for House races.) However, a combination of these race ratings and statistical inputs (not necessarily weighted equally — the race ratings make up something like 20 percent of the FiveThirtyEight forecasts) does slightly better than either one taken alone.

There are undoubtedly many improvements that Microsoft has in fact made to search; there are a lot of very, very smart engineers there, after all, and I’m sure they have come across a few tricks that Google hasn’t. Also, there are some cases in which Microsoft has access to proprietary data that Google does not. For instance, because Microsoft makes software products, they probably have a good understanding of what things a user does when — as has been known to happen on occasion — Windows Vista crashes. They may therefore do better than Google in responding to queries for technical support, something which search engines are often quite poor at. Bing, also, runs a travel site (which is very good), whereas Google does not, so they might do better in responding to a query like “best fare JFK LAX“.

How much value Microsoft’s engineers are ultimately adding is hard to say. Both they and Google are extremely circumspect about revealing any detail about their algorithms. And in contrast to election forecasts — where it’s fairly straightforward to evaluate performance (who called more races right?) — it is hard to measure the efficacy of a set of search results.

Still, Google has spent many, many years trying to perfect search — probably an order of magnitude more man-hours than Microsoft has. To the extent that Bing’s results are competitive with Google’s across the broad spectrum of potential searches, one wonders how much this is because they are simply using Google’s data.

This article can be found at http://fivethirtyeight.blogs.nytimes.com/2011/02/02/how-much-does-bing-borrow-from-google/ and Nate's blog can be found at http://fivethirtyeight.blogs.nytimes.com/.  If you are a fan of politics, you should really check it out.

Experian credit reports to include positive rental payments

Potentially good news for renters - Experian credit reports are to include positive rental payments.  As far as I know, Experian is the first of the credit bureaus to take this big step.

In the past, only negative information about a renter's payment history was included on credit reports.  That meant that the segment of the population, which often included those trying to establish their credit history (i.e. college students or those just starting out), did not get the benefit to their credit history of their timely rent payments.  Only if their payments were late would the rental payments show up on a credit report.  Obviously, the late payments would damage the credit history of the renter whereas those renters who made their rent payments on time did not see those timely rental payments show up at all in their credit history.

No more.  Now Experian is going to include the positive rental payment history of many consumers on its credit reports.  Here's the details straight from Experian's website -

On-time rental payments now help boost credit scores

In the past, only negative rental payment data such as evictions and collections were reported to consumer reporting agencies. Therefore, your on-time rental payments never helped boost your credit scores, unlike credit card, mortgage or car payments that help raise credit scores when paid on time.

But this has changed now that Experian® will be including positive rental data in consumer credit reports. The addition of this data is a tremendous benefit to anyone who rents, especially those who are non-credit-active, cash-based consumers.

Key Benefits to Consumers

Establish or rebuild your credit — You can now make your continuous on-time rental payments count towards establishing or rebuilding your credit

Qualify for what you deserve — If you were previously unable to qualify for a lease or credit product due to a thin credit file you will now be able to demonstrate past rental payment history and qualify for what you deserve

How It Works

Experian RentBureau receives updated rental payment data every 24 hours from its national network of property management companies. In order for this data to be included in your credit file, your property management company must contribute its rental history data to Experian RentBureau.

Experian recognizes the value of having a good rental payment history. Please contact your property management company and ask them to contribute their data to Experian RentBureau.

If reported accurately, this development could help millions of consumers who otherwise have little or no credit history begin to build a credit history and become homeowners if they so desire.  Of course, if the rent payment history is reported inaccurately in an adverse manner, the damage done to a developing credit history could be disastrous.  Fortunately, the FCRA should help protect victims of rent payment reporting errors in the same manner as it helps rectify credit reporting errors of other kinds.

An interesting article about an identity theft ring based out of a federal prison, straight from http://7thspace.com/headlines/370211/inmate_sentenced_in_ohio_for_running_identity_theft_ring_from_prison.html: 

"The man who led an identity-theft ring that ran up a quarter-million dollars worth of charges from inside a federal prison was sentenced to more than 14 years in prison, Steven M Dettelbach, United States Attorney for the Northern District of Ohio, announced today. “The defendant thought he found a way to occupy his time in prison,” Dettelbach said. “With this prosecution and this sentence, he’ll have lots more time to learn to follow the rules.” Dimorio McDowell, age 34, of Atlanta, Georgia, previously pled guilty to aggravated identity theft and conspiracy to commit wire fraud and bank fraud. McDowell was an inmate at Fort Dix Federal Correctional Institution at the time of the scheme, which took place between August 2009 and April 2010.

United States District Judge Donald Nugent ordered McDowell’s 174-month sentence on this case begin in 2014, when he completes the current sentence that resulted in his incarceration at Fort Dix. McDowell was the ringleader who obtained personal information on people who had credit card accounts at various retailers, including Best Buy, Home Depot, JC. Penney, Lowe’s, Macy’s, Nordstrom’s, Saks Fifth Avenue, Sears and Staples, according to court documents. McDowell contacted the retailers and impersonated the true account holders, store employees, or corporate fraud investigators.

He used information about the account holders, such as name, address, or Social Security number during those calls to obtain additional information about them and adding co-conspirators names as authorized users of the accounts, thus taking over the accounts, according to court documents. After taking over the accounts, adding additional users to the accounts and opening new accounts, McDowell communicated with his co-conspirators, all of whom lived in the Cleveland area. McDowell continued to run his scheme from prison even after he was charged and after he pled guilty. He also posed as a deputy United States Marshal over the telephone and attempted to have prisoners moved, according to information presented during the sentencing hearing.

Overall, the ring purchased more than $254,000 worth of merchandise as part of their scheme, according to court documents. Also charged in the case are: Andre Reese, 37; Jeffery McClain, 39; Kevin McBride, 34; Michael Sailes, 51; Edwin Peavy, 52; Daniel Ashford, 37; James L Wiggins, 47, and Jay Williams, 27, all of Cleveland, Ohio. All have entered guilty plea to charges against them. This prosecution is the result of cooperation from a number of law enforcement agencies who identified the defendants, gathered the evidence and prepared the case for prosecution.

The investigative team included the Federal Bureau of Investigation’s Cleveland Division and Trenton Resident Agency, the United States Bureau of Prisons, the Postal Inspection Service, Bath Township Police Department, Stow Police Department, Mentor Police Department and other state and local law enforcement agencies. The case was prosecuted by Assistant United States Attorney Matthew B Kall. “This case is a stark reminder about the need to protect yourself from identity theft and fraud,” Dettelbach said. “I want to thank the FBI, the Bureau of Prisons and all our partners who made prosecuting this case possible.”

11.7 MILLION Victims of Identity Theft in U.S.

According to a survey conducted in 2008, the results of which were just released on December 16, 2010, by the Bureau of Justice Statistics, an estimated 11.7 million U.S. citizens were victims of identity theft during the two year period prior to 2008.

The losses from this vast number of instances of identity theft totalled more than $17 billion (with a "b").

However, the definition of identity theft used in the survey was quite broad.  It included what we have discussed on this blog as actual identity theft (i.e. the fraudulent use of someone's personal identifiers to open new accounts) as well as account take over (where an existing legitimate account is used by someone other than an authorized user for their personal gain). 

In my experience, many more people are victims of account takeovers than identity theft, so this seriously skews the numbers of this survey.  In fact, I was a victim of an account take over between the period of 2006 and 2008 when someone in Germany made three fraudulent purchases with my Discover card.  My experience was like most who are victims of account takeover.  It was all fixed with a simple call to my credit card.

Identity theft, on the other hand, is never that simple to fix.  It usually takes years of vigilance and time spent by the victim making phone calls, writing letters and generally proving his or her innocence because, unlike in the criminal justice system, the identity theft victim is considered guilty until he proves his innocence and, usually, even after he has proven his innocence time and time again.

According to the survey, the average loss was only $1,870.  This again is skewed by the inclusion of account take over in the identity theft definition the survey used.  I would think that most account take over victims suffer either no financial loss or possibly the cost of a stamp or two.  Identity theft victims, on the other hand, suffer much greater financial loss, usually in the several thousands of dollars.  That's if they are not sued and forced to hire an attorney by the hour to defend them from the frivolous lawsuit against them.  Of course, if they hire someone like me to represent them in a lawsuit against the credit bureaus and/or the fraudulent credit grantors, the attorney should not charge by the hour but should instead be paid a contingency fee after successful resolution of the lawsuit.

Also, 16 percent of the victims in the survey were the victims of multiple types of identity theft, such as the traditional version and attempts to obtain government or health insurance benefits.  I recently represented a victim of identity theft whose brother used his identity to obtain student loans and eventually went to work for Fed Ex in Memphis using my client's Social Security number.  This resulted in my client suffering the tax burden of his brother's wages.  Very much a mess that took a lawsuit against Sallie Mae and others to straighten out.

More stats from the survey -

• 6.2 million were victims of actual or attempted account take overs of traditional credit cards;
• 4.4 million were victims of actual or attempted account take overs of debit cards;
• 1.7 million were victims of true name identity theft;
• Income matters - those with a household income of more than $75,000 were more likely to be victims;
• Gender does not matter - men and women are equally likely to be identity theft victims;
• Only about 17 percent reported the crime to law enforcement (but this again is skewed by the inclusion of account take over victims in the definition of identity theft);
• Approximately 20 percent described the identity theft as "severely distressing" (again skewed by the inclusion of account take over); and
• Nearly 40 percent had some idea how their personal identifiers were compromised.

All in all, some pretty interesting results.

$1 million verdict against Equifax won't be reduced

This man's story reminds me of a client I represented a while back against ... you guessed it ... Equifax.  More about my case below:

By Maria Dinzeo

SAN FRANCISCO (CN) - A cancer survivor who won more than $1 million from Equifax for improperly handling his identity theft report can keep the full award, a federal judge ruled.


U.S. District Judge Susan Illston rejected the credit reporting agency's motions for a new trial or to set aside so-called "excessive" damages.

Eric Drew, who was twice referred to hospice care by hospitals that said they could not treat his cancer, had his identity stolen in 2003 by a phlebotomist working at the cancer center where he had undergone treatment.

Drew discovered that multiple fraudulent credit accounts had been opened in his name with thousands of dollars in balances.

"Plaintiff testified that, while he was away from home being treated for near fatal cancer, he singlehandedly caught the individual who had stolen his identity even though the police and hospital personnel had not believed him or wanted to help him," Illston wrote.

Fearing that his life was in danger, Drew called newspapers, the FBI, police and his hometown mayor in Los Gatos, Calif.

When a local television station picked up his story, the identity thief was caught and convicted of criminal violation of the Health Insurance Portability and Accountability Act.

Over the next two years, however, Equifax and a number of other credit reporting agencies and banks allegedly thwarted Drew's attempts to repair his credit and reinvestigate his claims of identity theft.

After a nine-day trial, a jury awarded Drew $6,326.69 in economic damages, $315,000 in noneconomic compensatory damages and $700,000 in punitive damages.

Among Equifax's requests on appeal, the company argued to reduce "excessive" compensatory and punitive damages to $200,000 and $50,000, respectively.

"Here, defendant leaves the court to speculate where its $200,000 figure comes from," Illston wrote. "It does not explain why $315,000 is shocking to the conscience or unsupported by the evidence while $200,000 is a proper number."

Illston refused to grant remittance, finding that Drew had "presented significant evidence of emotional distress that he suffered as a result of his unique circumstances."

"The evidence strongly supports a finding that the harm plaintiff suffered was not the result of mere accident," the ruling states.

Against all odds, Drew identified the man who stole his identity, beat cancer and launched an unprecedented criminal HIPAA prosecution, "but he couldn't navigate the system that defendant had set up to correct his credit report," Illston wrote.

Now, about my case.  Just like Eric Drew, my client helped the authorities nab his identity thief who, among other things, had opened scores of accounts in my client's name and had even bought 2 or 3 vehicles, including a Harley, using my client's identity.  Thanks to the persistence of my client, the authorities (the FBI if I remember right) caught the identity thief while riding the ill-gotten Harley.  The identity thief was tried, convicted and sentenced.

Unfortunately, just like Mr. Drew, my client's story did not end there.  Equifax and the other three bureaus refused to believe my client's disputes regarding the scores of accounts opened in his name, despite the conviction of the identity thief that opened the accounts.  In fact, the identity thief served his entire sentence before Equifax and the other bureaus finally fixed my client's credit reports and then only after I had sued the bureaus on behalf of my client.  In other words, the conviction of the identity thief was not good enough proof for Equifax, Experian and Trans Union.  But my federal lawsuit ironically got the job done, but not before my client suffered very, very significant emotional distress.  At his lowest point, he was sitting in his closet with a gun in his mouth because of the sheer shambles that this life had been turned into after the complete loss of his financial independence caused by the credit bureaus' failure to do their job.

Luckily, he did not pull the trigger and eventually fought back through his lawsuit, which led to his credit reports being corrected.  Equifax should be ashamed to claim that Mr. Drew's damages did not justify an award of $315,000 in light of their intentional and flagrant disregard for their statutory duties.  I'm glad the judge saw through Equifax's sham of an argument.  But I'm sure they will appeal to the next level.

As for my client, his case never went to trial as Equifax and the other bureaus settled for a "confidential" sum after suit was filed.

Background Screening Company Doesn't Want Equal Employment For All

Judy Gootkind, member of the Board of Directors of the National Association of Professional Background Screeners, a group made up of resellers of consumer reports for background checking purposes, testified yesterday before the House Financial Services Subcommittee regarding a new proposed law entitled "The Equal Employment for All Act", H.R. 3149.  From reading a transcript of her testimony (reprinted below), it appears that NAPBS's main beef with H.R. 3149 is their claim that it would limit the types of companies who could use credit reports as part of background checks to "financial institutions", as defined by the FCRA.  I will have to do a bit more research to see if Ms. Gootkind's claims are valid. 

Her testimony is below:

"Sep 24, 2010 (Congressional Documents and Publications/ContentWorks via COMTEX) --


Chairman Gutierrez, Ranking Member Hensarling and members of the committee, thank you for this opportunity to testify. My name is Judy Gootkind and I appear here today on behalf of the National Association of Professional Background Screeners -- NAPBS. I am a member of the NAPBS Board of Directors. My company, Creative Services, Inc., located in Mansfield, MA, is a member company of NAPBS and I am Vice President of Finance & Administration. Creative Services, Inc. is located in the Fourth Congressional District of Massachusetts, Chairman Frank's district.

NAPBS is a trade association founded in 2003 which represents over 700 companies engaged in employment and tenant background screening across the country. Of this figure, approximately 360 member companies are Regular Members, meaning that they are primarily engaged in the business of providing employment and/or resident background screening services directly to end-users, such as employers, landlords and businesses. The majority of those Regular Members are small businesses, with 12 or less employees. Having said this, our membership does include a range of companies, from Fortune 100 companies to small local businesses. Collectively we conduct millions of employment and tenant screening checks each year.

In the employment context we provide background checks for private employers, volunteer organizations, non-profits, government, public utilities, healthcare, higher education and publicly held corporations. NAPBS seeks to promote ethical business practices, promote compliance with the Fair Credit Reporting Act and State law analogs and foster awareness of issues related to consumer protection and privacy rights within the background screening industry.

Our industry is highly regulated, both by the Federal Trade Commission and the newly created Bureau of Consumer Financial Protection. n1 Our ability to provide our employer end-users with consumer reports is driven by consumers' consent for such reports to be generated when they apply for employment or seek a promotion.

Before responding to the Committee's questions provided to NAPBS, I would like to point out our concerns with H.R. 3149, "The Equal Employment for All Act". We believe this legislation, as drafted, too narrowly restricts the use of credit reports for employment purposes, and all but prohibits them in the private employment space. As drafted, the legislation would limit the use of credit reports for those jobs requiring national security or FDIC clearance, state or local government agency employment, supervisory, managerial, professional, or executive positions at a financial institution, or when otherwise required by law. Our specific concerns are as follows:

* The legislation would limit the use of credit reports in private employment to certain positions at financial institutions, a narrowly defined term under current law. The term "financial institution" is defined in the Fair Credit Reporting Act to mean, "...a State or National bank, a State or Federal savings and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds a transaction account (as defined in section 19(b) of the Federal Reserve Act) belonging to a consumer." n2

* The legislation as written would prohibit the requesting of credit reports for the following types of positions, all of which are examples of actual job applicants for which NAPBS member companies provide credit reports: lawyers, mortgage lenders, property managers, cashiers, pharmaceutical representatives, pharmacists, asset management and financial planners, public safety officers, jewelers, health providers, NBA referees, executives in non-financial institution employers, accounting employees, finance employees, Information Technology employees, procurement employees, academic financial aid employees, Human Resources employees and other positions where employees have access to large amount of cash spending or personal information of other employees or customers.

Some would say that credit reports are reputation collateral and for many consumers, their credit history may be a good thing rather than the negative light in which they are being cast. NAPBS feels that there are instances beyond those which H.R. 3149 would allow in which it would be important and/or necessary to our employer end users to request a credit report. While NAPBS understands that this legislation seeks to limit the use of credit reports so that the credit history has some bearing on a person's job responsibilities and duties, as written, it eliminates many other positions where credit could be at least a potential sign of someone's judgment.

In your letter of invitation, you have asked NAPBS to address particular issues and questions regarding credit reports and employment background checks.

Committee Question -- Please explain the process of developing the reports that you provide to employers, including what types of information is used and how it is filtered. For example, do you alter or modify the information that you receive from the credit bureaus? If so, why and how?

Some background on how we operate is necessary to answer this question. Each Company who provides consumer reports to a third party is defined under the Fair Credit Reporting Act ("FCRA" or "Act") as a "consumer reporting agency". We provide "consumer reports" to third party end-users, for a variety of "permissible purposes" under the Act, including for employment purposes. The FCRA specifically lists those "permissible purposes" for the use of such reports in section 604 which is entitled "Permissible purposes of consumer reports". One such permissible purpose is for employment purposes, which is defined in the law as, "...a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee." n3

A consumer report could include information from a variety of sources, including a credit report/credit history, public record information such as a criminal report, or employment or education verification. It is important to mention that in the context of employment checks, a credit score is never included. The three major credit bureaus do not sell credit scores for employment purposes nor are consumer reporting agencies able to report such scores if the purpose of the consumer report is for employment purposes. In fact, contractual agreements are in place which prohibit our access to, or use of credit scores, in the employment context. Moreover, the bureaus audit end users as well as resellers of credit information for compliance with their agreements. As such, technical measures are in place to ensure that an end user identifies its permissible purpose upon ordering the report, leaving little room for an end user to receive an actual credit score by accident or otherwise.

Important steps in the background screening or consumer report preparation process. Prior to requesting a consumer report, an employer must provide to the prospective employee a written notice stating what information will be requested, the source of the information and the purpose for which it will be used. An employer must also provide a copy of the consumer report, including the credit report, to the consumer upon request, and prior to taking an adverse action in whole or in part based on the credit report. With the report, an employer must also provide a copy of the Federal Trade Commission's document entitled "A Summary of Rights Under the Fair Credit Reporting Act." The employer must then wait a reasonable period of time before making the ultimate decision thereby allowing the consumer the opportunity to dispute any inaccurate information in the report. n4 If an adverse employment action is taken against a prospective employee based on any information contained in a consumer credit report, for instance, the end user must provide the name and contact information for the consumer reporting agency to the consumer. Consumers can also request and obtain all the information about themselves in the files of a consumer reporting agency and they have the right to dispute incomplete or inaccurate information n5. Furthermore, consumer reporting agencies must correct or delete inaccurate, incomplete or unverifiable information.

Committee Question -- Has the use of credit reports/checks for employment purposes increased over the past decade?

This question is better addressed to the end users of such reports as we do not have such statistical data on hand at NAPBS.

Committee Question -- Do you add any information to the reports you receive from credit bureaus? If so, please explain what, why and how.

Generally, No. As a reseller of credit reports, most consumer reporting agencies merely pass through the credit reports they receive from the credit bureau(s).

Committee Question -- What kind of information is included in the reports you provide to employers?

A credit report includes information about a consumer and their credit experiences, such as name, addresses, employers, social security number, trade accounts, credit limits, balances, payment history, collection accounts, bankruptcies and tax liens. It may also provide additional verification and/or identify discrepancies with regard to the applicant's name, address, social security number and employment history.

Committee Question -- Do you have any proof that a credit record is an indicator of someone's propensity to commit a crime or their ability to successfully perform the duties of the job for which they might be considered? Please explain your views on this particular issue.

As consumer reporting agencies, we are the providers of information to end users when they are requesting background information, be it education or employment references/verification, credit history or criminal history. We believe the Committee is better served by facts rather than our personal views.
One study that may be of interest to the Committee is that conducted by the Association of Certified Fraud Examiners entitled "2008 Report to the Nation on Occupational Fraud & Abuse" which states that "...credit checks were by far the least common form of background check performed by victim organizations. Past research indicates that financial pressures are one of the key motivating factors of occupational fraud, and indeed, in [their] survey [they] found that the two most commonly cited behavioral red flags among fraudsters were 'financial difficulties' and 'living beyond one's means'". n6

Committee Question -- Please provide the subcommittee a standard, sample credit report for employment purposes that would normally be purchased by your clients. You may redact any personal or confidential information.

A sample credit report is included with this statement.

n1 The Bureau of Consumer Financial Protection was created by the Consumer Financial Protection Act of 2010 (Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203).

n2 Section 603(t), FCRA.

n3 Section 603(h), FCRA.

n4 Section 604(b)(3), FCRA.

n5 Section 609(a), FCRA.

n6 Association of Certified Fraud Examiners, "2008 Report to the Nation on Occupational Fraud & Abuse" found at http://www.acfe.com/documents/2008-rttn.pdf

New scam aimed at attorneys!

As if attorneys weren't maligned enough, I just received this from the Mississippi Bar Association.  Apparently there is a new scam out there targeting lawyers.  Every lawyer out there needs to be aware of this scam because I could see how one could easily fall for it.

The Bar has been advised of at least two scams being perpetrated on lawyers involving a common set of facts. The lawyer is hired by an out of state client to assist it with collecting a debt from a local business debtor. The premise is that the creditor believes it might settle with the local debtor, but wants to get the case ready just in case. The amounts involved are in the low six figures. The lawyer is either hired by phone or email and may or may not insist on a written employment contract. A day or two after the lawyer agrees to represent the fraudulent client and before the lawyer contacts the debtor, an official bank check appears in the mail for the full amount of the collection. Many of the scams involve an official Citibank check (although any bank could be used in the scam).

Often, the mailed checks originate in Canada, even though the debtor is a local business. The envelopes containing the official bank check have Canadian postmarks and are sent via air mail. The lawyer is asked to deposit the check into his or her trust account. A few days letter, the lawyer is asked to wire the funds overseas due to an emergency and to remit the funds net of attorneys fees. The check eventually is returned as account closed, NSF, or for other reasons in a week or two. The lawyers trust account debited for the full amount. Since the funds were wired, the opportunity to retrieve the funds from an overseas bank account is virtually nonexistent. The Bar urges all lawyers to develop specific policies to insure trust account funds are protected at all times.

So, fellow barristers, beware!

Time Limit for Reporting Tax Liens

Tax liens are treated differently than any other item on a credit report.  Most adverse items are allowed to be reported for seven years from the date of delinquency, regardless of whether the item is ever paid.  Tax liens, on the other hand, potentially fall under two different seven year reporting periods.

15 U.S.C. 1681c(a)(3) says that paid tax liens are allowed to be reported for seven years from the date they are paid.  All other tax liens fall under the catch all provision found at 15 U.S.C 1681c(a)(5) and are allowed to be reported for seven years from the date they come into existence (since they are immediately considered adverse). 

Thus, you could have an unpaid tax lien reported for seven years, fall off the report, then, when paid, reappear for another seven years.  It is therefore not in a consumer's best interest (at least as far as credit reporting) to pay a tax lien after seven years.  But, it would be in the consumer's best interest to pay the tax lien as early in the seven year unpaid tax lien reporting period as possible, since this will allow both seven year periods to run more or less concurrently.  Kind of like a two for one sale.

But what about tax liens that are satisfied and/or released without any payment.  For instance, I had a client call me about an eight year old tax lien appearing on his credit report that had been "released" due to his bankruptcy about four years ago.  In this instance, the lien should have fallen off the report as obsolete since it was over seven years old and had never been paid.  A release does not always mean payment.  This is one such instance.  Another is where the lien is entered in error and released not because of payment but because of a recognition of the erroneous nature of the lien.

Unfortunately, the credit bureaus do not appear to have a mechanism in place to recognize the interplay between 1681c(a)(3) and 1681c(a)(5) when applied to tax liens.  As a result, tax liens often appear on consumers' credit reports longer than they should and often require a dispute to the credit bureaus (or more) to get them removed.

FTC cracks down on advertising for non-free services while ordering your free credit reports

NewJersey.com reports on new restrictions by the FTC -

In an attempt to make sure credit reporting agencies don't put a fast one over on consumers seeking free credit reports, the Federal Trade Commission has adopted tough new disclosure rules in response to more than 1,000 comments it received from consumers and others last fall.

Under a federal law passed in 2003, the three credit reporting agencies — Equifax, TransUnion and Experian — are required to provide consumers with a free copy of their credit report each year, but the agencies have found ways to recoup fees they used to get for those reports.

Part of the problem is that the gateway to the free reports — AnnualCreditReport.com — takes you through sites for the individual agencies. There, they try to sell services for which there is a fee, such as monthly reports (rarely needed) or your credit score (needed only occasionally).

And it's not just the three agencies, as other commercial sites use bait-and-switch tactics, drawing you in with the lure of free reports before pushing you to pay services.

Starting April 1, the commercial enterprises will still be able to sell their wares, but they'll have to do a better job of distinguishing between free and paid services.

The rest of the article can be found here - http://www.northjersey.com/news/business/85754242_Indeed__a_free_credit_report.html.