Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It only takes a minute to sign up.
Sign up to join this community
You see ads all over the place for services that purport to protect you from identity theft, but my gut tells me that most of these are at best marginally effective and at worst outright scams.
Are any of these services worth the cost of subscribing to them? What is the best strategy for protecting myself from identity theft and similar malice?
Here are a handful of measures I take myself:
I check my credit reports once in a while and look for anything out of the ordinary.
If somebody calls me on the telephone claiming to be from my bank or credit card company, utility, etc. I ask for their number, check it, and call them back. I don't give personal information to people merely claiming to be from a place I do business with.
I never fill out ballots for free contests. Most of the time these are scams. When I get a call telling me "you won a free cruise" for a ballot I supposedly filled out at the mall, I say they're lying through their teeth. For excitement, I'll sometimes buy a lotto ticket instead.
I'm careful when I surf the web. I don't give my personal information to web sites I can't trust. If they look the least bit shady, I'm out. Also, I use different passwords at different web sites. I avoid using a password from a public terminal, but when I must, I change my password soon after.
I'm careful when I download software. I don't install anything I didn't get from a trusted source. I pay for software when necessary, so finding a trusted source is not hard. But, I've heard of people who – to save a buck – would download a pirated application from a shady warez site only to be "gifted" a trojan horse key logging or other spyware along with it.
When I no longer need a bill, receipt, statement, etc. or any document containing personal information, I shred it, and I use a shredder that does a micro-cut, not just a strip- or cross-cut. The micro-cut remains go in the green bin with wet and yucky organic waste.
When I no longer need a hard drive, I use a secure wiping tool like Darik's Boot & Nuke before reusing. If the drive isn't worth reusing, I'll wipe first then take apart with my Torx screwdriver. Once I have the drive platter, I scratch the heck out of it. Remains go to the community recycling depot.
That's all I can think of right now; I probably missed a few :-)
So, what do others do? I'm curious, too.
http://annualcreditreport.com gives you free access to your 3 credit bureau records.
(Annual, not "free". The "free" guys will try to sell you something.)
Every 90 days add an Initial Fraud Alert to each of the 3 major credit bureaus.
I've received letters notifying me of data breaches in the past. In the end, I've never signed up for the offered protection service, figuring if "they" can hack Target or ADP or the IRS, they can hack anybody, like... Equifax.
And now Equifax has been hacked.
My family's Social Security Numbers were stolen from a hospital database. I think that information, plus public information was used to gain further data from the IRS FAFSA tool. (we got a letter from the IRS). Ultimately, fraudsters used whatever data they had to file a tax return with the IRS and with the Cali FTB (we don't and never have lived in California). We got letters from both, and managed to stop the fraud before it really impacted us...other than having to file a paper tax form this past tax season.
Anyway... in a world where Equifax gets hacked: the only solution is:
I don't bother with the crazy password schemes you talk about... I have a few different passwords I use, but most my investment accounts use the same username and password.
It's all about risk. Bruce Schneier says the same thing. The amount to spend on security should depend on what you're trying to protect. I don't care much if somebody gets into my google account, because I have a google account just because I have to. I barely use it at all. Similarly my yahoo account. My yahoo account uses my "insecure password", and my investment accounts use my "secure password". Credit Card info? Meh. Unless they get into the credit card company database, which undoubtedly has my Social Security Number, it's not that big of a deal. Yeah, they can make fraudulent charges, but there are legal protections, so in theory I can't be out any money.
So think this way: what's the risk, and what's the appropriate level of effort to take to mitigate that risk.
I believe the answer is that to protect yourself it is good to get credit protection so you will be notified when new credit is taken in your name.
Also, you can use http://www.annualcreditreport.com/ to look at your credit report.
HINT: While you do that, and while you are in the TransUnion report, you will have the option to DISPUTE adverse items.
I always suggest that people dispute everything adverse. That puts the onus on the other parties to produce evidence to TransUnion within 30 days attesting to the validity of the adverse item.
You would be surprised how many will simply drop off your report after doing that. Everybody should do this
Here is a direct address for TransUnion:
https://dispute.transunion.com/dp/dispute/landingPage.jsp
==> Once the disputes are finalized, the results get communicated to the other two bureaus.
It is amazing how well it works. It can raise your credit score significantly.
It really helps to watch your credit report yourself, and also to get whatever protection is offered that may help protect you against others opening new accounts in your name.
