Slashdot

In many states, consumers who want to remove the freeze can use a special identification number to unlock access to their credit file.

Yeah, that's a good idea... So how many ID-Ten-T consumers are going to carry this number around -- in their wallets/purses or leave them unsecured in a filing cabinet? When will legislators get a clue that most people are complete ignorant about the security of almost anything?

They should tell the reporting agencies they have 30 days, and then they have to stop using SSN.

How they fix it it their business.
OTOH, with ID theft becoming more common, reporting agency will eventually be worthless since no one can depend on their reports anymore.

Just give us one time keys.

If I can use a piece of important information only once before it changes then nobody can replay it.

Incidentally, how do you prove you are you to actually put the freeze/unfreeze in place?

I wonder how many people will give up their secret security freeze number to phishers?

Whoever lets someone use a stolen identity to get a loan or credit card or whatever should be responsible for all damages. That means forgiving the loan and restoring the credit of the victim as well as paying damanges if the victim's credit history took a hit.

Seriously, it's not my job to make sure you verify the identity of your clients and I shouldnt have any consequences if you dont do it right.

Also, anybody who loses data used to steal an identity should be responsible for the consequences. If you run over a pedestrian on a sidewalk you pay te medical bills right?

There's a private company (Lifelock is the one I hear on the radio all the time) that also has the ability to lock down your credit. No new legislation required, it would seem. Of course, that costs money so maybe this legislation just enables individuals to lock their credit at the taxpayer's expense.

This is also supposed to stop those pre-approvals that constantly clog up your mailbox... (well, mine at least.)

We ALL now how much better "protected" we are after our politicians pass NEW LAWS to protect us!

What is it, something like 20,000 separate laws "controlling" the ownership and use of guns, yet we still get VaTech?

And, of course, whenever those don't work, why, we'll just PASS MORE LAWS!

How great to be a politician, where you're never graded on what you actually do, just what you SAY.

I could make a very long winded post about this, but what I believe is really very simple: all personal info should be private by default.

Any time anyone wants any of of my personal info, be it SS#, Credit Report, phone number, address, email address, et al. they should be required to get my authorization before it can be released or even used. Kinda like medical/health info except done a lot more robustly. I'd go so far as to advocate serious jail time for individuals who abuse my personal info, for instance all the laptops that various government agencies manage to lose. I'd hope the threat of years in a federal penitentiary would do the trick.

I'm not holding my breath, but it pisses me off to no end that I have to maintain so much of a defense of my information.

What keeps the perp from stealing your identity, freezing your record, and then using the ID number they give him to loot your accounts while you're locked out?

-jcr

The Post also ran a much longer, more in-depth piece looking at the process of passing freeze legislation in Delaware, easily the most banking- and business-friendly state in the union. That piece is here [washingtonpost.com]

One highlight, which looks at the role of the Consumer Data Industry Association (CDIA), the lobbyist group that works for the data broker industry and the credit bureaus:

"Goldberg, who has worked with advocates in more than a dozen states to enact freeze legislation, said that in 2005 the CDIA and the credit-reporting agencies shifted their strategy. They no longer were outright opposed to credit-freeze laws; instead, they worked to convince states to allow the bureaus to charge as much as possible when consumers place, lift or remove credit freezes. "The credit reporting agencies clearly want consumers to pay more for the security freeze than we certainly think they should," Goldberg said. "But given that those same agencies collect all of this sensitive financial data about consumers and then turn around and sell it, we think they should also have the obligation to protect the consumer, and that's where the security freeze comes in.

I'm still amiss as to how people can still get their personal data stolen and their lives ruined by thieves in this way. To me, the biggest problem is the credit reporting agencies themselves who are very anti-consumer. By that, I mean they will very easily and quickly put on a bad credit remark, but are slow to remove it if it's a mistake. Even then, the whole idea of verifying identity in financial transactions is very loose to these guys who only require a name and SSN.

This is one of the problems that requires long-overdue federal legislation to remedy. It needs to consist of the following:

* Complete elimination of the use of SSNs by non-governmental agencies to track individuals, including employers and insurers
* Disallowing tracking numbers for enumeration of individuals to remain the same across any two or more private organizations
* Requirement of independently-verifiable photo and/or hashed/digitally-signed/analog biometric verification of the purchaser for large purchases on credit (not all of the above necessarily - even an original copy of a fingerprint plus a photograph of the person with the contract would be sufficient)
* Increased onus on creditors to prove that the alleged debtor was, in fact, the person responsible for the purchase or transgression in question via the identification as above
* Severe criminal penalties (up to life imprisonment) and civil penalties ($250,000 or triple the value of the offense, whichever is greater, per offense) for those who purposely attempt to steal identities, subvert the security measures for the purpose of identity theft, or facilitate the reporting of false information on debtors for which adequate steps have not been taken to verify identity
* Mandatory FIPS-based security for the storage of personal information
* Withholding of derogatory credit information that is in dispute during the time that affected individuals are making a proper challenge to said derogatory information

Do all of that, and what you'll find is that this problem will vaporize overnight. It won't prevent other problems such as outright credit card theft (for which there are separate solutions anyway), but it will cut this problem off where it needs to be cut off.

Send multiple Arnold Schwarzenegger clones back in time to help recover your stolen identity.

We need federal legislation signed making credit card companies or any organization extending credit civilly and criminally liable for identity theft. In other words if someone under the guise of you opened a Citibank VISA account in your name and rung it up, Citibank could then be sued by you and/or prosecuted for extending credit to someone whose identity was not properly verified.

THEN you'd see some changes taking place. Instead of "oops, sorry" they'd be faced with saying "oops, here's six million for our mistake."

I mean, these guys own the system. They make money off us from their ownership of it. They should be responsible for securing it.